Privacy policy

1. Who is responsible

Timo Scholz-Fritsch, BlastRev, Kaiserallee 12, 58511 Lüdenscheid, Germany. Email: support@blastrev.com. Write to this address for any question or request about your data.

2. In short

This website sets no tracking cookies and uses no analytics. The quizzes on it run in your browser. The BlastRev Shopify app stores what it needs to work for a store: the store’s catalog and quizzes, anonymous quiz results, anonymous counts of quiz use, and the IDs and amounts of orders placed after a quiz. It stores no shopper names, addresses or email addresses. Quiz results and order links are deleted after 24 months.

3. This website

Hosting. The website runs on Cloudflare. To deliver pages and protect them from abuse, Cloudflare processes technical data of each request, such as your IP address, browser, the requested page and the time. We do not keep access logs ourselves. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

No cookies, no tracking, no third-party fonts. We set no cookies for analytics or advertising and use no tracking tools. Fonts are served from our own domain.

Quizzes on this website. The hair and skin quizzes on our template pages run in your browser. Your answers are not sent to us and not stored.

Email. If you write to us, we use your address and message to answer you (Art. 6(1)(b) or (f) GDPR) and delete them once the matter is settled, unless the law requires us to keep them longer.

4. The BlastRev Shopify app

Merchants. When a store installs BlastRev, we process the store domain, Shopify access tokens (encrypted), the store’s products as synced from Shopify, the quizzes the merchant builds, the chosen plan and subscription ID, and, if connected, a Klaviyo API key (encrypted). Payment is handled by Shopify; we receive no payment details. Legal basis: providing the app under our contract with the merchant (Art. 6(1)(b) GDPR). Access tokens and the Klaviyo key are removed when the app is uninstalled; all store data is deleted when Shopify asks us to after uninstall (shop redaction). After that deletion we keep only the store domain and the date a free trial was used, so each store gets the free trial once (legitimate interest, Art. 6(1)(f) GDPR).

Shoppers in a merchant’s store. For quizzes shown in a store, the merchant is the controller and BlastRev processes data on the merchant’s behalf under a data processing agreement. Please contact the store first. BlastRev processes:

• Quiz answers, the result and the recommended products, as an anonymous session with no name, IP address or cookie.
• Anonymous daily counts of how a quiz is used: how often it was seen, started, answered step by step and finished, and how often a recommended product was opened or added to the cart, split into mobile and desktop. These are totals with no session ID, IP address or cookie, so no count can be traced to a shopper.
• Only after you allow analytics in the store’s cookie banner: a session marker on your cart, so a later order can be linked to the quiz. For linked orders we store the order ID, the order total and the value of products added from the quiz, not who placed it.
• Only if the store asks for it and you tick the consent box: your email address, which is passed straight to the store’s own Klaviyo account and not stored by BlastRev.

Quiz sessions, usage counts and linked orders are deleted automatically after 24 months, and earlier when the store uninstalls the app or Shopify asks us to delete a customer’s data.

5. Who receives data

Cloudflare, Inc. hosts the website and the app. The app’s database is stored in the European Union. When a merchant uses the optional AI assistant in the app, Cloudflare Workers AI processes that merchant’s catalog data and quiz texts; no shopper data is sent and Cloudflare does not use it to train models. Shopify provides the platform the app runs on and handles billing. Klaviyo receives data only when a merchant connects their own Klaviyo account and a shopper opts in; the merchant’s own agreement with Klaviyo applies. We do not sell personal data and do not share it for advertising.

6. Transfers outside the EU

Cloudflare, Inc. is based in the United States and may process requests in data centers outside the EU. Such transfers rely on the EU-US Data Privacy Framework and the EU Standard Contractual Clauses.

7. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interests (Art. 15 to 21 GDPR). You can withdraw consent at any time with effect for the future. You can also complain to a data protection authority, for example the one responsible for us: State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf (www.ldi.nrw.de).

We make no decisions based solely on automated processing that have legal or similarly significant effects on you.

8. Changes

We update this policy when the website or the app changes. The date at the top shows the current version.