Lexara

Legal information

Privacy Policy

This policy explains how Lexara processes personal data when you visit our website, contact us or use the Lexara Shopify application.

Effective date: 1 November 2026 · Version 1.0

1. Who is responsible for your data?

For the processing described in this policy where Lexara acts as a controller, the controller is Igor Kazazic, sole trader, Kronetorpsgatan 68 B, 212 27 Malmö, Sweden. Contact: igorkazazic1989@gmail.com ("Lexara", "we", "us" or "our").

For certain information processed through the application on behalf of a Shopify merchant, that merchant is the controller and Lexara acts as a processor. This distinction is explained in section 5 and in the Data Processing Agreement.

2. Personal data processed when you visit this website

The Lexara marketing website is informational. It currently has no visitor account, checkout, contact form, analytics tool, advertising pixel or marketing-cookie system. We do not use the website to build visitor profiles.

Our hosting and delivery infrastructure may process ordinary technical connection information needed to deliver, protect and troubleshoot the website. Depending on the request, this may include an IP address, requested page, time of request, browser or device information and referring page. We use this information for the legitimate interest of operating a secure and reliable website. Infrastructure logs are retained according to the hosting provider's operational and security retention practices.

The website includes a video that is loaded from YouTube only after you choose to play it. When you press play, your browser connects to YouTube/Google's privacy-enhanced video service. YouTube/Google may then process technical information under its own terms and privacy policy. You can avoid this processing by not playing the video.

Our pages also link to external services, including the Shopify App Store. When you follow an external link, the provider of that service processes your visit under its own privacy notice.

3. Information you send to us

If you email us, we process your email address, the contents of your message and any information or attachments you choose to provide. We use this information to respond to your enquiry, provide support and keep a record of relevant business correspondence. The legal basis is taking steps at your request or performing a contract, where relevant, and our legitimate interest in responding to and managing business communications. We retain correspondence for as long as needed to handle the matter and comply with applicable legal obligations.

4. Information processed by the Shopify application

Depending on the features you use and the permissions granted through Shopify, the application processes the following categories of information:

  • Store and settings data: store domain, settings you choose (such as markets, business role, languages and notification email), economic operators you enter (including company names, addresses and contact details), product-compliance information, green-claim findings and evidence, digital-passport data, packaging data and an audit log of changes.
  • Staff information: Shopify user ID, name, email address, whether the staff member is the store owner, their role in the application, and when they were first and last seen. Audit-log entries may record the staff member's name and email alongside changes.
  • Limited order information (packaging module only): order ID, destination country, product and variant IDs, quantities, and fulfilment and cancellation dates. The application does not store customer names, postal addresses, email addresses, phone numbers or payment details as part of this packaging calculation.

The application uses this information to provide its features, show who changed what, manage access, calculate packaging volumes by destination country and send notifications you enable.

5. Controller and processor roles

For staff information and order information processed to provide the application to a merchant, the merchant generally decides why and how the information is used and acts as controller. Lexara processes that information on the merchant's documented instructions as processor. The Data Processing Agreement describes this processing.

Lexara acts as a controller for its own account administration, billing records received from Shopify, support correspondence and security logs. The legal bases are performance of the contract, compliance with legal obligations where applicable, and our legitimate interests in administering and securing the service.

Individuals whose information is processed inside a merchant's store should generally direct privacy requests to that merchant. We assist the merchant as processor in accordance with the DPA.

6. Service providers and recipients

We use the following providers to operate the application and website:

  • Shopify Inc. / Shopify International Ltd: the commerce platform through which the application is installed and from which it receives authorised store information, and the provider of the App Store and subscription billing.
  • Railway Corp.: application and website hosting and PostgreSQL database hosting in the EU West region (Amsterdam, Netherlands).
  • Anthropic PBC (United States): receives product, page and passport text only when a merchant on the Pro plan actively uses an AI feature. It does not receive order data or customer details for these features. Transfers are protected by the EU Standard Contractual Clauses as described in our application privacy information.
  • Email delivery provider (SMTP): used only where a merchant enables email notifications; it receives the store's notification address and the notification content.
  • YouTube/Google: receives a connection from your browser if you choose to play the embedded website video.

7. International transfers

The application and its database are hosted in the EU. If a Pro-plan merchant actively uses an AI feature, product, page or passport text may be processed by Anthropic in the United States. The transfer is covered by the EU Standard Contractual Clauses. The website video is provided by YouTube/Google and may involve processing under that provider's own international-transfer arrangements.

8. How long information is kept

  • Application store data: kept while the application remains installed. After uninstallation, Shopify sends a shop/redact request; it is normally sent 48 hours after uninstallation. We delete the store's data normally within 48 hours after receiving that request.
  • Order records: when Shopify sends a customers/redact request, the order records identified in that request are deleted.
  • Technical webhook logs: deleted after 30 days.
  • Backups: hosting-provider backups expire according to the provider's schedule, within a maximum of 30 days.
  • Support emails and business records: retained for as long as needed to respond, manage the relationship and meet applicable record-keeping obligations.
  • Website technical logs: retained according to the hosting provider's operational and security retention practices.

9. Security

Application traffic is encrypted using TLS. Data at rest is encrypted by the hosting and database provider. Application access is controlled through roles (admin, editor and viewer), changes are logged, access tokens are stored server-side only, and Shopify webhooks are verified by signature. No online service can be guaranteed to be completely secure, but we take measures designed to protect the information we process.

10. Your rights

Depending on the circumstances and applicable law, you may have the right to request access to, correction of or deletion of your personal data, restriction of processing, objection to processing, and data portability. Where processing is based on consent, you may withdraw consent without affecting processing carried out before withdrawal.

For information we process as controller, contact us at igorkazazic1989@gmail.com. For information processed on behalf of a Shopify merchant, contact that merchant first; we will assist the merchant as required by the DPA. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.

11. Automated processing

Lexara may provide automated checks, flags and AI-generated suggestions to help merchants review product and compliance information. These are assistance outputs for the merchant to review. Lexara does not use them to make solely automated decisions about individuals that produce legal effects or similarly significant effects.

12. Changes to this policy

We may update this policy when our data practices, services or legal requirements change. The effective date and version will be shown at the top of this page. We will notify application merchants of material changes through the application where appropriate.

13. Contact

Igor Kazazic, sole trader
Kronetorpsgatan 68 B
212 27 Malmö
Sweden
Email: igorkazazic1989@gmail.com