Privacy Policy for Post Purchase Upsell Hero

Last updated: 14 October 2026

1. Who we are and what this policy covers

1.1 This policy explains how HeroSoftware GmbH processes personal data when you visit the Post Purchase Upsell Hero website, install and use the Post Purchase Upsell Hero Shopify app as a merchant, contact us, talk to us in a call, are contacted by us as a potential customer, visit our social media pages or apply for a job with us.

1.2 Controller:

HeroSoftware GmbH
Walramstraße 23, 65510 Idstein, Germany
Represented by the managing director: Calvin Blick
E-mail: post@hero.software

1.3 Data of your customers (buyers) is not covered by this policy. When Post Purchase Upsell Hero processes data of buyers in a merchant's store, it does so on behalf of the merchant. The merchant is the controller and informs its buyers in its own privacy policy. Our role is governed by the Data Processing Agreement, which forms part of our Terms of Service. If you are a buyer and have questions about your data, please contact the store where you placed your order.

2. Data we process, purposes and legal bases

The legal bases in brackets refer to the GDPR and apply in the EU/EEA, correspondingly under the UK GDPR and under the Swiss FADP.

2.1 Installing and using the app

When you install Post Purchase Upsell Hero, Shopify provides us with information about your store: shop domain, store name, store e-mail address, store owner name, country, currency, plan and the time of installation. When you or your staff use the app, we process your settings, usage of app features, the Shopify user ID and technical session data.

We use this data to provide the app, to calculate fees, to secure the app and to improve its functions (Art. 6(1)(b) GDPR, contract; Art. 6(1)(f) GDPR, our legitimate interest in a secure and functional app).

2.2 Billing

Fees are charged through Shopify's billing system. We receive information on your plan, charges and payment status, but no payment card details (Art. 6(1)(b) GDPR). We keep invoices and accounting records as required by commercial and tax law (Art. 6(1)(c) GDPR).

2.3 Support, feedback and communication

When you contact us by e-mail, via the chat or feedback widget in the app, via a shared Slack channel or by other means, we process your name, e-mail address, store, your message and the history of the conversation in order to answer your request (Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR if no contract exists yet).

The chat and feedback widget in the app is provided by Productlane. When you open it, the widget loads from Productlane's servers and Productlane receives technical connection data and the messages you send.

2.4 Customer relationship management

We record installations, contacts and the course of our business relationship with merchants in our CRM system in order to manage and develop our customer relationships (Art. 6(1)(f) GDPR). When you install the app, your store is created in the CRM automatically with the data described in Section 2.1. We may also name merchants as customers with company name and logo on our website and in presentations (Art. 6(1)(f) GDPR); you can object at any time (Terms of Service, Section 6.3).

2.5 Product news by e-mail

We send merchants who have installed the app information about our own similar apps and features (Art. 6(1)(f) GDPR; § 7(3) UWG). We inform you of this and of your right to object when you install the app (Terms of Service, Section 5.3). You can object at any time without incurring any costs other than transmission costs at basic rates, for example via the unsubscribe link in every e-mail or by writing to post@hero.software. If you have subscribed to our newsletter yourself, we send it on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

When you subscribe via the form on our website, your e-mail address is sent directly from your browser to our newsletter provider Loops. To prevent repeated submissions, the form stores the time of your last signup attempt in your browser's local storage. This is technically necessary for the requested service (§ 25(2) No. 2 TDDDG). You can delete it via your browser's site data settings.

2.6 Calls and demos

If you arrange a call or demo with us, we process the information you provide (name, e-mail address, company, appointment, any notes) in order to arrange and hold the appointment (Art. 6(1)(b) GDPR, pre-contractual measures). Video calls take place via Google Meet.

Demos can be booked on our website via Calendly.

2.7 Visiting our website

Hosting and server logs. Our website is hosted by Replit. When you visit it, your browser automatically transmits technical data, such as IP address, date and time, page requested, referrer, browser and operating system. This is necessary to deliver and secure the website (Art. 6(1)(f) GDPR). Replit retains these log data for 7 days; we do not combine them with other data.

Consent management. When you first visit the website, we ask for your consent to analytics and marketing technologies. We store your choice in your browser (Art. 6(1)(c) GDPR in conjunction with the consent requirements; § 25(2) TDDDG). You can change or withdraw your choice at any time via the "Cookie settings" link at the bottom of every page. Our consent banner is our own solution; no third-party consent provider receives your data.

Google Analytics. With your consent, we use Google Analytics 4 to understand how visitors use our website. Google sets cookies and processes device, browser and usage data; IP addresses are used only to determine the approximate location and are not stored (Art. 6(1)(a) GDPR; § 25(1) TDDDG). Google Analytics data is deleted after 2 months.

Meta Pixel. With your consent, we use the Meta Pixel to measure the effectiveness of our advertising on Facebook and Instagram. Meta sets cookies and receives information about your visit, which Meta may link to your Meta account (Art. 6(1)(a) GDPR; § 25(1) TDDDG). For the collection and transmission of the data, we and Meta Platforms Ireland Ltd are joint controllers (Art. 26 GDPR). The essential content of the agreement is available at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for any further processing. Meta is responsible for fulfilling your rights under Art. 15 to 20 GDPR regarding this data; information on Meta's processing is available at https://www.facebook.com/privacy/policy.

Meta Conversions API Gateway. If you have consented to the Meta Pixel, the same events are additionally transmitted to Meta via the Meta Conversions API Gateway, which we operate on servers of Amazon Web Services in the USA (Art. 6(1)(a) GDPR).

Referrer measurement. With your consent to analytics, we store in your browser's local storage from which external website you last came to our website and when, in order to understand which channels lead to installations (Art. 6(1)(a) GDPR; § 25(1) TDDDG).

Google Ads. With your consent, we use Google Ads conversion tracking to measure whether visitors who clicked on our Google ads install the app or book a demo. Google sets cookies and processes device, browser and usage data (Art. 6(1)(a) GDPR; § 25(1) TDDDG).

Calendly. The demo booking calendar is provided by Calendly. It is loaded only when you click "Book a demo"; only then does your browser connect to Calendly's servers and transmit technical connection data, such as your IP address. This is necessary to provide the booking you requested (Art. 6(1)(b) GDPR; § 25(2) No. 2 TDDDG).

Fonts are served from our own server. No data is sent to Google Fonts.

2.8 Call recordings and meeting notes

With the consent of all participants, we record calls with merchants and prospects or have them transcribed and summarised automatically, using Attio call recording and Google Meet recording and note-taking (Gemini). We ask for consent at the start of each call; if a participant does not agree, the call is not recorded. Recordings, transcripts and summaries are stored in our CRM and used to document and follow up on the conversation (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future. Recordings, transcripts and summaries are deleted after 12 months at the latest.

2.9 AI assistance in communication and CRM

We use AI features to summarise, sort and draft responses to e-mails and to analyse CRM data (Spark AI, Attio AI, Claude, ChatGPT). In doing so, the content of your communication with us and the CRM data described in Section 2.4 are processed by the respective provider. For Claude and ChatGPT we use business plans under which Anthropic and OpenAI do not use our data to train their models (Art. 6(1)(f) GDPR, our legitimate interest in efficient communication).

2.10 Contacting potential customers

We contact businesses that may be interested in our apps, in particular operators of Shopify stores. In the EU/EEA and Switzerland, we contact you by e-mail for advertising purposes only with your prior consent; in the UK, we do so without consent only to corporate subscribers where PECR permits; otherwise we contact you via LinkedIn or by telephone where permitted. For this purpose, we collect business contact data (name, role, business e-mail address, business telephone number, company, store domain and publicly available information about the store) from publicly accessible sources (e.g. store websites, LinkedIn), from store directories (e.g. Store Leads), from commercial data providers (e.g. Apollo, Clay, Lusha) and via the enrichment function of our CRM (Art. 14 GDPR). We process this data to identify suitable contacts and to approach them (Art. 6(1)(f) GDPR, our legitimate interest in acquiring customers). You can object to this at any time; we will then no longer contact you and delete your data, except for a blocking entry that ensures we do not contact you again. If no business relationship arises, we delete the data 2 years after our last contact.

2.11 Our social media pages

We maintain company pages on LinkedIn, Instagram, Facebook and YouTube. When you visit these pages, the respective platform processes your data under its own privacy policy. For the statistics that LinkedIn and Meta provide to us about visits to our pages (Page Insights), we and the platform are joint controllers (Art. 26 GDPR); the essential content of the agreements is available at https://legal.linkedin.com/pages-joint-controller-addendum and https://www.facebook.com/legal/terms/page_controller_addendum. We process messages and comments you send us there to communicate with you (Art. 6(1)(f) GDPR).

2.12 Applications

If you apply for a job with us, we process your application documents and contact details via the applicant management system JOIN in order to carry out the application process (Art. 6(1)(b) GDPR, steps prior to entering into an employment relationship). If we do not hire you, we delete your data 6 months after the end of the process, unless you have consented to a longer storage.

2.13 Records for compliance with data protection law

We keep records of requests from data subjects and how we handled them, and of consents given on our website where applicable, in order to be able to demonstrate compliance with data protection law (Art. 6(1)(f) GDPR, our legitimate interest in demonstrating compliance, Art. 5(2) and Art. 7(1) GDPR). We keep these records for 3 years.

2.14 Is providing data required?

The data described in Sections 2.1 and 2.2 is required to conclude and perform the contract; without it, you cannot use the app. Providing data in all other cases is voluntary. If you do not provide it, we may not be able to answer your request or book a demo.

3. Recipients

We do not sell personal data. We share personal data only with the following service providers, who process it on our behalf and on the basis of a data processing agreement, unless stated otherwise:

Commercial data providers and store directories from which we obtain business contact data (Section 2.10) act as independent controllers.

We also disclose personal data to authorities, courts or advisers bound to professional secrecy (e.g. tax advisers, lawyers) where we are legally obliged to do so or where this is necessary to establish, exercise or defend legal claims (Art. 6(1)(c) and (f) GDPR).

4. International transfers

Some of the recipients listed above are located in the USA or the United Kingdom, or have access to data from there.

EU/EEA: Transfers to the United Kingdom and Switzerland are based on the European Commission's adequacy decisions. Transfers to the USA are based on the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards by writing to post@hero.software.

UK: Transfers from the UK are based on UK adequacy regulations, the UK Extension to the Data Privacy Framework or the UK International Data Transfer Addendum.

Switzerland: Transfers from Switzerland are based on the Federal Council's adequacy recognition, the Swiss-U.S. Data Privacy Framework or Standard Contractual Clauses adapted for Swiss law.

5. Retention

We delete personal data as soon as it is no longer needed for the purposes described above, unless we are legally required to keep it. Retention periods for call recordings, potential customers, applications and compliance records are stated in Sections 2.8, 2.10, 2.12 and 2.13.

• Data in the app: for as long as the app is installed. After uninstallation, we keep it blocked for 30 days so that the merchant can request an export, then delete it from our active systems; backup copies expire within a further 7 days.
• Store and contact data in our CRM: 3 years after our last contact or the end of the business relationship; for potential customers see Section 2.10.
• Invoices and accounting records: 6, 8 or 10 years in accordance with § 147 AO and § 257 HGB.
• Support conversations and CRM data: 3 years after our last contact with you, unless they are part of records we must keep for longer.
• Product news by e-mail: until you object or unsubscribe.
• Website analytics: 2 months in Google Analytics. Cookies expire as described in the consent banner.

6. Your rights

6.1 EU/EEA and UK: You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw any consent with effect for the future (Art. 7(3)).

6.2 EU/EEA and UK: Right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests, you may object at any time on grounds relating to your particular situation. You may object to the use of your data for direct marketing at any time without giving reasons.

6.3 EU/EEA: You may lodge a complaint with a supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

6.4 UK: You may complain to us at post@hero.software; we acknowledge complaints within 30 days. You may also lodge a complaint with the Information Commissioner's Office (ICO), ico.org.uk.

6.5 Switzerland: You have the rights under the Swiss FADP, in particular to information and to rectification or deletion, and may contact the Federal Data Protection and Information Commissioner (FDPIC).

6.6 To exercise your rights, write to post@hero.software. We may ask you to confirm your identity.

7. Notice for US residents

7.1 We provide this notice voluntarily; US state privacy laws may not apply to us. We collect the categories of personal information described in Section 2: identifiers and contact details (e.g. name, e-mail address, shop domain), professional information (e.g. role, company), commercial information (plan, charges), internet and network activity (website and app usage), audio and video recordings of calls (with consent), the content of your communication with us and, for applicants, employment-related information. The purposes and recipients are described in Sections 2 and 3. Retention is described in Section 5.

7.2 We do not sell personal information in exchange for money. With your consent, we use advertising technologies (Meta Pixel, Google Ads) on our website, which may qualify as "selling" or "sharing" for cross-context behavioral advertising under California law. You can opt out at any time by declining or withdrawing consent via "Cookie settings". We honor Global Privacy Control (GPC) signals as an opt-out.

7.3 Depending on your state of residence, you may have the right to know, access, correct and delete your personal information and, where applicable, to opt out of selling or sharing. We will not discriminate against you for exercising these rights. To submit a request, write to post@hero.software. You may use an authorised agent.

8. Security

We protect personal data with appropriate technical and organisational measures, including encryption in transit, encryption at rest for our app data, multi-factor authentication for all employees and access by our own staff only from Germany. Service providers access data only as described in Sections 3 and 4.

9. No automated decisions

We do not make decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you (Art. 22 GDPR). Automated checks carried out by our apps in merchants' stores take place on behalf of and according to the rules of the respective merchant (Section 1.3).

10. Changes

We may update this policy when our processing changes or the law requires it. The current version is always available on this page. The date at the top shows the last change.