Privacy Policy

Last updated: April 2026

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you. For detailed information on the subject of data protection, please refer to our privacy policy listed below.

Data Collection on This Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the section "Information about the Responsible Party" in this privacy policy.

How do we collect your data?

Your data is collected in part by you providing it to us. This may be data that you enter into a contact form, for example.

Other data is collected automatically or with your consent by our IT systems when you visit the website. This is primarily technical data (e.g., internet browser, operating system, or time of page access). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Some of the data is collected to ensure the error-free provision of the website. Other data may be used to analyze your user behavior.

What rights do you have regarding your data?

You have the right to receive information about the origin, recipients, and purpose of your stored personal data free of charge at any time. You also have the right to request the correction or deletion of this data. If you have given your consent to data processing, you can revoke this consent at any time for the future. You also have the right to request the restriction of the processing of your personal data under certain circumstances. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

2. Hosting

We host the content of our website with the following provider:

Cloudflare Pages

This website is hosted via Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When you access this website, technical data (in particular IP address, browser type, access time) is automatically transmitted to Cloudflare servers. Cloudflare uses a globally distributed Content Delivery Network (CDN) so that the website is delivered via the geographically nearest server.

The personal data collected on this website is stored on the servers of the host. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses, and other data generated via a website.

External hosting is carried out for the purpose of fulfilling contracts with our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast, and efficient provision of our online offering by a professional provider (Art. 6 para. 1 lit. f GDPR).

We use the following host:

Cloudflare, Inc.
101 Townsend St
San Francisco, CA 94107, USA

Cloudflare is certified under the "EU-US Data Privacy Framework" (DPF) and is committed to complying with European data protection standards.

Data Processing Agreement

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract required by data protection law, which ensures that the service processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

3. General Information and Mandatory Disclosures

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data that can be used to personally identify you. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

We would like to point out that data transmission over the Internet (e.g., when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.

Information about the Responsible Party

The responsible party for data processing on this website is:

Diallo Media
David Diallo
Schwachhauser Heerstr. 18
28209 Bremen
Germany

Phone: +49 176 58696398
Email: diallomedia@web.de

The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of the processing of personal data (e.g., names, email addresses, etc.).

Storage Duration

Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods); in the latter case, the deletion will take place after these reasons cease to apply.

Right to Object to Advertising Emails

The use of contact data published within the framework of the imprint obligation for sending unsolicited advertising and information materials is hereby objected to. The operators of the pages expressly reserve the right to take legal action in the event of unsolicited sending of advertising information, such as spam emails.

4. Data Collection on This Website

Cookies

Our website uses so-called "cookies." Cookies are small data packets and do not cause any damage to your device. They are either stored temporarily for the duration of a session (session cookies) or permanently (permanent cookies) on your device. Session cookies are automatically deleted after your visit. Permanent cookies remain stored on your device until you delete them yourself or they are automatically deleted by your web browser.

Cookies that are necessary for the execution of the electronic communication process, for the provision of certain functions you require, or for the optimization of the website (necessary cookies) are stored on the basis of Art. 6 para. 1 lit. f GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies for the technically error-free and optimized provision of its services.

You can set your browser so that you are informed about the setting of cookies and only allow cookies on a case-by-case basis, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be limited.

5. Plugins and Tools

Google Fonts

This site uses so-called Google Fonts provided by Google for the uniform display of fonts. When you call up a page, your browser loads the required fonts into its browser cache to display texts and fonts correctly.

For this purpose, the browser you are using must connect to Google's servers. This gives Google knowledge that this website has been accessed via your IP address. The use of Google Fonts is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the uniform display of the typeface on its website.

If your browser does not support Google Fonts, a standard font will be used by your computer.

Further information about Google Fonts can be found at https://developers.google.com/fonts/faq and in Google's privacy policy: https://policies.google.com/privacy.

The company is certified under the "EU-US Data Privacy Framework" (DPF). Further information can be obtained from the provider at: https://www.dataprivacyframework.gov/participant/5780.

6. VisualFlow Shopify App

This section describes how the VisualFlow Shopify app (installed by merchants from the Shopify App Store) processes data. It applies in addition to the website sections above whenever you use the app in your Shopify admin.

Scope and Purpose

VisualFlow is a Shopify-embedded app that helps merchants bulk-manage product images in their Shopify store. The app uses AI-based image matching to automatically assign uploaded images to the correct products, and applies them to the store after the merchant's review.

No End-Customer Personal Data

VisualFlow does not collect, process, or store any personal data of end-customers (shoppers) of Shopify stores. The app exclusively processes product data and images owned by the merchant. Consequently, Shopify's mandatory customers/data_request and customers/redact webhooks are received and logged, but contain no data to return or erase.

Data We Process

To provide the app's functionality, VisualFlow processes the following categories of data:

• Shop metadata: Shop domain (*.myshopify.com), preferred language, installed plan, and OAuth access token required by Shopify.
• Product data: Product titles, descriptions, variants, images, and image positions — read and written via the Shopify Admin GraphQL API.
• Uploaded images: Images that you upload inside the app for a batch, including filename, MIME type, size, and the resulting Shopify file ID.
• Batch and campaign data: Batch names, scheduling timestamps, status, AI matching confidence scores, and error logs generated during execution.
• Backup snapshots: Lightweight references (product IDs, image positions, Shopify file IDs) to your product images before a batch is applied, so you can restore them.
• Billing data: Current subscription plan (Free / Pro / Premium), usage counters, and the Shopify charge ID — never your payment details, which are handled entirely by Shopify.

Third-Party Data Processors

VisualFlow relies on the following third-party processors to provide its functionality:

Shopify Inc. (151 O'Connor Street, Ground floor, Ottawa, ON K2P 2L8, Canada) — the Shopify platform itself. All product, file, and billing operations run through Shopify's Admin API. Shopify is certified under the EU-US Data Privacy Framework.

Railway Corporation (85 2nd Street, 4th floor, San Francisco, CA 94105, USA) — cloud hosting provider for the app backend and its PostgreSQL database. All app data (sessions, batches, backup snapshots, error logs) is stored on Railway's EU-region servers. A Data Processing Agreement is in place.

OpenRouter Inc. (2261 Market Street #4382, San Francisco, CA 94114, USA) — AI model gateway used for image matching. When you run a batch, VisualFlow sends the Shopify CDN URLs of your uploaded images (not the raw image bytes) and the product titles of your store to OpenRouter, which forwards them to a large language model with vision capabilities. The model returns a best-match product ID and a confidence score. OpenRouter and its upstream model providers are located outside the EU (primarily USA). By using VisualFlow, you consent to this international data transfer under Art. 49 GDPR for contract performance. No personal data is transmitted — only product images and product titles.

Data Retention and Deletion

While the app is installed: All data listed above is stored for as long as the app is installed in your Shopify store and is necessary for the app's operation (e.g., displaying batch history, restoring backups).

Backup retention: Backup snapshots expire automatically based on your plan (Free: 3 days, Pro: 14 days, Premium: 60 days) and are then deleted from our database and from the Shopify Files library.

On app uninstall: VisualFlow automatically deletes all your shop data (sessions, batches, backups, error logs, settings) immediately when Shopify sends the app/uninstalled webhook. Shopify additionally sends a shop/redact webhook 48 hours after uninstall — our handler performs the same deletion again as a safety net, in line with Shopify's GDPR requirements.

Your Rights as Shop Operator

As the merchant operating the Shopify store, you remain the data controller for product and shop data under GDPR. You have the right to access, correct, export, or delete the data VisualFlow holds about your shop at any time. You can:

• Export or delete individual batches, backups, and uploaded images directly in the app UI.
• Uninstall the app at any time — all your data will be deleted automatically as described above.
• Contact us at diallomedia@web.de for any data-protection request. We will respond within 30 days.

Legal Basis

The processing of shop data described in this section is based on Art. 6 para. 1 lit. b GDPR (performance of the app-subscription contract between Diallo Media and the merchant) and Art. 6 para. 1 lit. f GDPR (legitimate interest in providing a secure, efficient, and functional merchant tool).