Privacy Policy – Studyvio

1. Who we are and how to contact us

This Privacy Policy explains how Tim Wessels UG (haftungsbeschränkt) processes personal data in connection with the Studyvio Shopify app and the website studyvio.app.

Controller within the meaning of Art. 4(7) GDPR (for the processing described in Sections 3–6):

Data protection contact: We are not legally required to appoint a data protection officer (Art. 37 GDPR, § 38 BDSG), and we have not done so. For all data protection questions and requests, please contact our managing director, Tim Wessels, at support@mapmigo.io with the subject line “Privacy”, or by post at the address above.

2. Scope of this policy – our two roles

Studyvio is a Shopify app for businesses (“merchants”) that create and sell online courses. It is offered exclusively to businesses. Depending on whose data is involved, we act in one of two distinct roles:

2.1 We are the controller for merchant-facing data. When you install and use Studyvio as a merchant, contact our support, or visit studyvio.app, we decide why and how your data is processed. This Privacy Policy mainly covers this processing (Sections 3–12).

2.2 We are a processor for student data. When merchants use Studyvio to sell or provide courses to their own customers (“students”), we process student data only on the merchant’s behalf and according to the merchant’s instructions (Art. 28 GDPR). In this case, the merchant is the controller, not us. The details are set out in our separate Data Processing Agreement (“DPA”), available at studyvio.app/dpa. See Section 7 for a short summary.

If you are a student or course participant: your contract for a course is with the merchant whose store you bought from or registered with. Please read that merchant’s privacy policy and direct any requests about your data to the merchant. If you contact us, we will forward your request to the merchant concerned.

Shopify is the merchant’s own commerce platform. Shopify processes data under its own terms and privacy policy and is not a service provider (subprocessor) engaged by us.

3. Data we process as controller, and where it comes from

3.1 Installation and use of the app

When you install Studyvio, Shopify transmits certain data to us, and you enter further data while using the app:

• Shop data: your shop domain (e.g. yourstore.myshopify.com), Shopify shop ID, shop name, and your plan or installation status.
• Account and contact data: the name and email address of the shop owner or staff member using the app, where Shopify provides them in session or shop data.
• Login and session data: session tokens and technical session identifiers used to authenticate you securely through Shopify.
• App settings and content: your configuration, and the courses you build (sections, lessons, text, images, PDFs, videos, and links to embedded videos). If your course content contains personal data, for example your own name or image, we process it to host and deliver the content.
• Billing data: subscription plan and charge status received via Shopify’s billing system. We do not receive your payment card details.

Shopify API access scopes. To provide the app’s features, Studyvio requests the following Shopify permissions:

Scope	Why we need it
read_products	To let you link a Shopify product to a course.
read_orders	To recognise purchases of linked products and grant course access to the buyer.
read_customers	To identify the buyer and show them in your “Students” area.
customer_read_customers	To recognise logged-in customers on your storefront so they can access their courses.
write_app_proxy	To serve course pages on your storefront through a Shopify app proxy.

Customer and order data obtained through these scopes concern your students. We process it as your processor (see Section 7), not for our own purposes.

3.2 Support communication

If you contact us by email (support@mapmigo.io) or through the Crisp chat widget in the Studyvio admin area, we process your name, email address, shop domain, the content of your messages, any attachments, and the time of contact. The Crisp widget is available only inside the app’s admin area and is loaded only once you open the chat. It is not loaded on merchants’ storefronts.

3.3 Technical data and logs (source: your browser and our systems)

When you use the app, our systems create application and error logs. These contain technical request data such as timestamps, request paths, error details, and the shop concerned. We do not store IP addresses in our application database. Our hosting and infrastructure providers may process IP addresses technically during ordinary server operation, for example to route requests and protect against attacks.

3.4 Our website studyvio.app (source: your browser and you)

This section covers the marketing website at studyvio.app only. For the app itself, see Sections 3.1 to 3.3.

Hosting. Our website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, on a server located in the EU. When you visit the website, our hosting provider automatically creates server log files containing your IP address, the date and time of the request, the page requested, the referrer URL, and information about your browser and operating system. This data is technically necessary to deliver the website and to keep it secure and stable. We do not use it to identify you and we do not combine it with other data. Log files are retained for the period set by our hosting provider’s default configuration, and for no longer than 30 days. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable and error-free operation of our website.

No external resources. The website loads no content from third-party servers. We do not use external fonts, content delivery networks, embedded videos, social media buttons or similar embeds. The typeface used is hosted on our own server. As a result, your IP address is not transmitted to any third party when you visit the website.

No cookies and no tracking. The website sets no cookies. We do not use analytics tools, tracking pixels, or advertising technologies of any kind, and we do not create usage profiles. For this reason, no cookie consent banner is required.

Light and dark mode. If you use the switch in the page header to change between the light and dark design, we save your choice in your browser’s local storage (key: studyvio-theme). The stored value contains only “light” or “dark”. It contains no personal data, it is stored only after you actively use the switch, it serves solely to display the website as you have requested, and it is never transmitted to us. You can delete it at any time through your browser settings. Legal basis: § 25(2) no. 2 TDDDG. This storage is strictly necessary to provide a service you have explicitly requested, so no consent is required. As no personal data is transmitted to us, no processing under the GDPR takes place.

Search field. The website includes a search field that runs entirely in your browser. Your input is not transmitted to our server and is not stored by us.

No contact form and no newsletter. The website has no contact form and we do not operate a newsletter. If you contact us by email, please see Section 3.2.

4. Purposes and legal bases

Purpose	Data	Legal basis
Providing the app under our Terms of Service: installation, authentication, storing and delivering your courses, settings and support for contract-related questions	Sections 3.1, 3.2	Art. 6(1)(b) GDPR (performance of a contract)
Answering enquiries that are not related to an existing contract, e.g. pre-sales questions	Section 3.2	Art. 6(1)(f) GDPR. Our legitimate interest is responding efficiently to business enquiries.
Operating the app securely and stably: error analysis, abuse and attack prevention, application and error logs	Section 3.3	Art. 6(1)(f) GDPR. Our legitimate interest is keeping the service secure, available and free of errors.
Enforcing, establishing or defending legal claims	Relevant data	Art. 6(1)(f) GDPR. Our legitimate interest is protecting our legal position.
Keeping business records such as invoices and commercial correspondence as required by commercial and tax law	Invoices and commercial correspondence	Art. 6(1)(c) GDPR together with § 257 HGB and § 147 AO (legal obligation)
Non-essential storage on or access to your device, and optional website tools such as analytics or newsletter, where used	Sections 3.4, 8	Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent)
Storage on or access to your device that is strictly necessary for a service you have explicitly requested	Section 8	§ 25(2) no. 2 TDDDG. Any subsequent processing of personal data is based on Art. 6(1)(b) or (f) GDPR.

We do not sell personal data. We do not use merchant data or student data for advertising, and we do not use it to train AI or machine-learning models.

5. Recipients and service providers

We share personal data only where necessary for the purposes above. Our service providers act as processors on our behalf under Art. 28 GDPR agreements.

Recipient	Role / purpose	Location of processing	Transfer safeguard
Fly.io, Inc., USA	Application hosting	Servers in Frankfurt, Germany	Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). Fly.io is also certified under the EU-U.S. Data Privacy Framework (DPF).
Supabase Pte. Ltd., Singapore (contracting entity), with Supabase, Inc., USA as data importer	Database and file storage (images, PDFs). Uploaded files are kept in a private storage bucket and served only via signed URLs that expire after approximately five minutes.	Servers in Stockholm, Sweden. Administrative and support access may take place from the USA and Singapore.	Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two, supplemented by encryption in transit and at rest. Supabase is not certified under the EU-U.S. Data Privacy Framework.
BunnyWay d.o.o. (“bunny.net”), Ljubljana, Slovenia	Video hosting, transcoding and content delivery. Videos are served via server-generated, token-authenticated links that expire after approximately five minutes.	EU storage region. Global CDN edge servers may serve or temporarily cache video content outside the EEA.	Within the EU, no transfer safeguard is required. Where edge servers outside the EEA are used, transfers take place under the safeguards set out in bunny.net’s data processing agreement.
Crisp IM SAS, Nantes, France	Support chat in the Studyvio admin area only. The widget is not loaded on merchants’ storefronts.	Chat content and message history are stored in the EU (Netherlands). According to Crisp, its relay servers in the USA, the United Kingdom and Singapore store only connection logs (IP address, date of connection, user-agent and source website).	Chat content remains in the EU. For connection logs: United Kingdom under the EU adequacy decision (Art. 45 GDPR); USA and Singapore under the Standard Contractual Clauses in Crisp’s data processing agreement.
Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus	Hosting of the website studyvio.app	Server located in the EU	Within the EU, no transfer safeguard is required.
External development and support service provider, United Kingdom	Software development, maintenance and technical support, with access to production systems where necessary	United Kingdom	EU adequacy decision for the United Kingdom (Art. 45 GDPR). We disclose the provider’s identity on request.
Tax advisors, auditors, legal advisors	Accounting, audits, legal advice	Germany/EU	Bound by professional secrecy. Independent controllers.
Authorities and courts	Where we are legally obliged to disclose data	Germany/EU	Art. 6(1)(c) GDPR

Fly.io, Supabase, bunny.net and the UK service provider are also subprocessors for student data under our DPA. Crisp processes only merchant support data and therefore does not appear in the DPA’s subprocessor list.

6. International data transfers

We store and process your data primarily in the EU (Germany, Sweden, Slovenia, the Netherlands). Some of our service providers are established in, or can access data from, countries outside the EU/EEA (“third countries”). We transfer data to third countries only if the requirements of Art. 44 et seq. GDPR are met:

• United Kingdom: The European Commission has decided that the UK ensures an adequate level of data protection (Art. 45 GDPR).
• USA and other third countries: Fly.io is a US-headquartered company; Supabase contracts through its Singapore entity with a US data importer. For both, we rely on the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), supplemented by additional measures such as encryption in transit and at rest. Fly.io is additionally certified under the EU-U.S. Data Privacy Framework, so the Commission’s adequacy decision of 10 July 2023 applies to it in addition. Supabase is not DPF-certified and relies on the Standard Contractual Clauses alone. Our support chat provider routes connection logs through servers in the USA, the United Kingdom and Singapore under the safeguards described in Section 5.
• CDN edge locations: Video content may be served or temporarily cached outside the EEA under the safeguards described in Section 5.

You can request a copy of the relevant safeguards by writing to support@mapmigo.io.

7. Student data: our role as processor (summary)

When merchants use Studyvio, we process the following data about their students on the merchant’s behalf:

• names and email addresses;
• Shopify customer and order identifiers;
• course enrolment and access status;
• course progress, quiz answers and results, and certificates issued;
• data a merchant enters when adding students manually.

We do not store students’ IP addresses. Our infrastructure providers may process IP addresses technically during ordinary server operation. For visitors to fully public courses who are not registered, progress is saved only in the visitor’s own browser (sessionStorage) and never on our servers.

For this processing, the merchant is the controller. The merchant decides on the legal basis, informs students, handles their requests, and obtains any consent required on its storefront. Our obligations as processor, including the list of subprocessors, merchants’ right to object to new subprocessors, technical and organisational measures, audits, assistance and deletion, are governed exclusively by our Data Processing Agreement, available at studyvio.app/dpa. Students should consult the privacy policy of the merchant concerned.

We support merchants in meeting their obligations through Shopify’s mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact), which Studyvio has implemented.

8. Cookies and similar technologies (§ 25 TDDDG)

Under § 25 TDDDG, storing information on a user’s device, or accessing information already stored there, requires consent. There are two exceptions: storage or access that is strictly necessary to provide a digital service the user has explicitly requested (§ 25(2) no. 2 TDDDG), and storage or access whose sole purpose is to transmit a message. This rule covers cookies as well as browser storage such as localStorage and sessionStorage.

Technology	Where	Set by	Purpose	Duration	Our assessment
localStorage (studyvio-theme)	Website studyvio.app	Studyvio	Remembers whether you chose the light or dark design. Stored only after you use the switch; contains only “light” or “dark” and is never transmitted to us.	Until deleted by you in your browser settings	Strictly necessary to provide the display setting you explicitly requested (§ 25(2) no. 2 TDDDG)
sessionStorage (progress in public courses)	Merchant storefront	Studyvio	Remembers which lessons a non-registered visitor has completed in a public course. The data stays only in the visitor’s browser and is never sent to our servers.	Deleted automatically when the browser tab or session is closed	Strictly necessary for the course function requested by the visitor (§ 25(2) no. 2 TDDDG)
localStorage (video player)	Merchant storefront, wherever videos are hosted via bunny.net	bunny.net video player	Remembers the playback position and player preferences, such as volume or quality, so a video can resume where it was left	Until deleted by the user	Convenience function. Whether it is strictly necessary is debatable. Depending on the configuration, consent may be required.
Crisp cookies (crisp-client/…)	Studyvio admin area only	Crisp	Maintain your chat session and message history with our support team	Until the chat session data is cleared by you or expires under Crisp’s settings	The chat widget is loaded only after you open it. The cookies are then strictly necessary to provide the chat you have explicitly requested (§ 25(2) no. 2 TDDDG), so no separate consent is required.
Third-party embeds (YouTube, Vimeo, Loom)	Merchant storefront, only if a merchant embeds such videos	The respective platform	Video playback. These platforms may also use their own cookies for analytics or advertising.	Under the platform’s own policy	Generally not strictly necessary. Consent is usually required.

Responsibility on merchants’ storefronts. Course pages are part of the merchant’s online store, and the merchant decides which content, such as embedded third-party videos, appears there. The merchant is responsible for providing information about storage on students’ and visitors’ devices, and for obtaining any consent required (e.g. through Shopify’s cookie banner / Customer Privacy API or its own consent tool), and for deciding whether to embed third-party videos. YouTube, Vimeo and Loom process data under their own privacy policies. We have no influence on their processing.

Studyvio admin area. Apart from the Crisp cookies described above, the Studyvio admin area uses only the session mechanisms provided by Shopify that are needed to authenticate you (Shopify session tokens). No analytics or advertising cookies are used.

9. How long we keep data

• Application and error logs: 7 days, then deleted automatically.
• Installation, account, settings and course content: for as long as the app is installed. When you uninstall Studyvio, your active sessions are terminated. As specified in Shopify’s developer documentation, Shopify sends us a shop/redact request 48 hours after uninstallation. When we receive it, your data, uploaded files and videos are queued for deletion and deleted within 30 days.
• Support communication: 24 months after your request is closed, unless it has to be kept longer as commercial correspondence (see below) or to defend legal claims.
• Commercial and tax records: for the statutory periods under § 257 HGB and § 147 AO, namely 8 years for accounting vouchers such as invoices, 10 years for books, inventories and annual accounts, and 6 years for commercial correspondence relating to the conclusion or performance of a contract. During this time the data is restricted to these purposes.
• Consent-based data (website): until you withdraw consent, or as described in Section 3.4.
• Student data: retention and deletion are governed by the DPA and the merchant’s instructions.

10. Your rights

You have the following rights under the GDPR:

• Access to your personal data (Art. 15 GDPR);
• Rectification of inaccurate data (Art. 16 GDPR);
• Erasure (Art. 17 GDPR);
• Restriction of processing (Art. 18 GDPR);
• Data portability, i.e. receiving the data you provided to us in a structured, commonly used, machine-readable format (Art. 20 GDPR);
• Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR). Withdrawal does not affect the lawfulness of processing carried out before it.

To exercise your rights, email support@mapmigo.io. We may ask you to confirm your identity. Students should direct requests to the merchant concerned (see Section 2.2).

11. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement. The authority responsible for us is:

Der Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen
Georgstraße 122–124
27570 Bremerhaven, Germany
Phone: +49 421 361-2010
Email: office@datenschutz.bremen.de
Website: datenschutz.bremen.de

12. Is providing your data required?

Providing the data described in Section 3.1 is necessary to conclude and perform the contract for using Studyvio. Without it, the app cannot be installed or used. There is no statutory obligation to provide data. Contacting support is voluntary, but we cannot answer your request without your contact details and message. Optional website features that rely on consent can be declined without any disadvantage.

13. No automated decision-making or profiling

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

14. Security

We use appropriate technical and organisational measures to protect personal data (Art. 32 GDPR). They are described in detail in Annex 2 to our DPA and include:

• encryption in transit (HTTPS/TLS) and encryption at rest;
• server-side authorisation checks on every request for course content, and separation of merchants’ data through shop ownership records;
• uploaded images and PDFs in a private storage bucket, delivered only via signed URLs that expire after approximately five minutes;
• videos delivered via server-generated, token-authenticated links that expire after approximately five minutes, with video-platform API keys held on the server side only;
• individual accounts for administrative access, and role-based, least-privilege access control;
• short log retention (7 days).

No transmission over the internet is completely secure. Please keep your Shopify account credentials confidential.

15. Children

Studyvio is a business-to-business service and is not directed at children. Merchants are responsible for ensuring their courses, and any data they process about students, comply with applicable rules on minors.

16. Changes to this policy

We may update this Privacy Policy if our services, service providers or the legal requirements change. The current version is always available at studyvio.app/privacy-policy. We will inform merchants of material changes in advance by email or in the app. Where a change requires your consent, we will ask for it.

Effective date: 25.09.2026