Privacy policy : Marktbrücke
Last updated: 18 October 2026
Published at: https://aoex.be/en/marktbrucke/privacy
French version: https://aoex.be/marktbrucke/confidentialite
This policy explains how the Shopify app Marktbrücke : eBay Sync ("Marktbrücke", "the app") collects, uses and protects personal data.
1. Who we are
Marktbrücke is developed by aoex, an independent developer based in Belgium.
- Website: https://aoex.be/
- Contact: contact@aoex.be
- Postal address: available on request by email (contact@aoex.be)
- Company number (BCE/KBO): pending attribution
GDPR role: for merchant data (the Shopify store that installs the app), aoex is the controller.
This release of Marktbrücke does not import eBay orders and does not read or store end-customer (buyer) data. Marktbrücke is an independent app and is not affiliated with eBay.
2. Data we collect
Merchant data
- Shopify store information: shop domain, ID, language, and the Shopify access tokens the app needs to work.
- eBay credentials: OAuth access/refresh tokens from the merchant’s eBay seller account. They are encrypted with AES-256-GCM before storage and are never sent back to the browser.
- Settings: eBay.de marketplace configuration; inventory location; fulfillment, payment and return policies; optional markups where offered.
- Product and listing data: SKU, EAN where applicable, price, stock, category, photos metadata and status of synced listings.
- Technical data: sync and error logs (technical codes, without full personal data).
- Subscription: at launch the app is free. When billing is enabled later, trial/subscription status is handled by Shopify Billing; Marktbrücke never receives payment card data.
End-customer data
Not collected in this release. The app does not import orders and does not process buyer names, addresses, emails or phone numbers.
3. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Provide the app: eBay OAuth connection, listings, price and stock sync | Merchant data, settings, product data, eBay tokens | Performance of contract (Art. 6(1)(b)) |
| Customer support and diagnostic emails | Merchant data, email exchanges, technical diagnostics | Performance of contract (Art. 6(1)(b)) |
| Security, abuse prevention, error diagnosis | Technical logs | Legitimate interest (Art. 6(1)(f)) |
| Accounting and legal obligations | Billing data (when present) | Legal obligation (Art. 6(1)(c)) |
Data is never sold or used for advertising or profiling.
4. Retention
- eBay tokens and settings: kept while the app is installed, then deleted within 48 hours after uninstall (Shopify shop/redact webhook).
- Product / listing sync data: kept while needed to run sync, then removed with the shop on uninstall / shop/redact.
- Technical logs: 30 days, then automatic deletion.
- Backups: Fly.io managed Postgres snapshots / volume backups (volumes encrypted at rest), rotated per Fly.io policy.
5. Recipients and subprocessors
| Recipient | Role | Location |
|---|---|---|
| Shopify (Shopify International Ltd., Ireland, and affiliates) | E-commerce platform where the app runs; subscription billing when enabled | EU / Canada / US as per Shopify |
| eBay (eBay Inc. and affiliates) | Marketplace that receives listings, prices, stock and photos. eBay is an independent controller for its own data. | EU / US as per eBay |
| Fly.io (Fly.io, Inc.) | Application and Postgres database hosting | Primary region: Paris (cdg), EU; US-based company |
| Email delivery | Customer support via contact@aoex.be (SMTP when configured) | Depends on the SMTP provider used |
Transfers outside the EU: Fly.io and eBay are international groups, so data may be transferred to or accessed from the US. These transfers are covered by the providers’ Standard Contractual Clauses / DPAs and, where applicable, the EU-U.S. Data Privacy Framework.
6. Security
- eBay OAuth tokens encrypted with AES-256-GCM and never displayed or returned to the browser. The encryption key is stored separately from the database (Fly.io environment secret).
- All traffic encrypted over HTTPS/TLS.
- Fly.io volumes encrypted at rest (managed Postgres).
- Production access limited to the aoex developer, with strong authentication (unique passwords and 2FA on Fly.io, Shopify Partners, GitHub).
- Data minimisation: only data needed to publish listings and sync stock/prices is processed.
- App logs record technical events without full PII.
7. Shopify GDPR webhooks
Marktbrücke implements Shopify’s mandatory compliance webhooks:
- customers/data_request: responds for any customer data held (none for end customers in this release);
- customers/redact: deletes any customer data held;
- shop/redact: deletes all of a store’s data after uninstall (~48 hours).
8. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, port and object to the processing of your data.
- Merchants: email contact@aoex.be.
We respond within one month. You can also lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, https://www.dataprotectionauthority.be, or with the supervisory authority in your country.
9. Changes
This policy may be updated. The last-updated date appears at the top of the page. Merchants will be notified of significant changes by email or in the app.
10. Contact
aoex, Marktbrücke
