Valence Metrics

Privacy policy

Last updated: 15 October 2026. This policy covers the website valencemetrics.com and the Shopify app Valence Metrics.

1. Controller

Tobias De Cristofaro, Valence Metrics, c/o Impressumservice Dein-Impressum, Stettiner Str. 41, 35410 Hungen, Germany, email: [email protected].

2. Website

The website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as our processor under its Data Processing Addendum. When you visit the website, connection data (IP address, date and time, requested page, browser) is processed briefly to deliver the page and to protect it against attacks, based on our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). We do not keep access logs of the website ourselves. The website uses no cookies, no analytics, no tracking and no external fonts. Cloudflare may process data in the US; such transfers are currently based on the EU-US Data Privacy Framework and, in addition, standard contractual clauses.

3. Contact by email

When you email us (including via "Get early access"), we process your email address, name, the content and metadata of your message to answer your request. The legal basis is Art. 6(1)(b) GDPR where your request concerns a contract or its preparation, otherwise our legitimate interest in answering (Art. 6(1)(f) GDPR). Emails are received and stored in a mailbox at Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands, in its EU data center, as our processor under a data processing agreement. We delete emails once your request is settled; business correspondence is kept for up to six years as required by German tax law (§ 147 AO). Early-access requests are deleted no later than 12 months after the app launches if no contract is concluded.

4. Shopify app: what we process

  • Store information: store domain, primary domain and installation status.
  • Account of the person who installs or opens the app, as provided by Shopify (for example name, email, language) to keep you signed in.
  • Product data: product titles, vendor, product type, image URLs and existing alt text, to find images without alt text and suggest descriptions. Suggestions are generated by our own software from your product data; no external AI service is used. Alt text is saved to your images only after you confirm. We log each change (image ID, product title, previous and new alt text, time) for 90 days so you can undo it.
  • Scan results of your public storefront pages (home, a collection, a product page, cart), including short code excerpts of affected elements.
  • Storefront password, only if you enter it, stored encrypted and used only to open your storefront for scanning.
  • Plan status (free or paid) as reported by Shopify. Payments are handled by Shopify; we do not receive card data.

We receive account and store data from Shopify. Without this data the app cannot be used. Where you are our contracting party, the legal basis is Art. 6(1)(b) GDPR. Where staff of a merchant use the app, we process their account data based on our legitimate interest in performing our contract with the merchant (Art. 6(1)(f) GDPR). We do not access orders or personal data of your customers. No automated decision-making within the meaning of Art. 22 GDPR takes place. A data processing agreement is available on request.

5. Recipients and service providers

The app is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers in Germany, under a data processing agreement. Shopify (for merchants in Europe: Shopify International Limited, Dublin, Ireland) provides the platform, sign-in and billing and is responsible for its own processing; see Shopify's privacy policy.

6. Retention

We keep app data while the app is installed. After you uninstall, Shopify sends a deletion request after 48 hours; we then delete your store's data within 7 days and from backups within 30 days. App server logs are deleted after 14 days. Billing and payout records are kept for up to eight years as required by German tax law (§ 147 AO).

7. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). Contact us at [email protected]. You may also lodge a complaint with a supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

8. Right to object (Art. 21 GDPR)

Where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

9. Security

Data is transmitted encrypted (HTTPS). Storefront passwords are stored encrypted. Access to production systems is limited to the controller.