Legal
Privacy Policy: Buinbu and Buinbu XML Feed
Version 1.0 · Effective: October 29, 2026 · Last reviewed: October 29, 2026
1. Who we are
Buinbu XML Feed and buinbu.com are operated by Buinbu (“Buinbu”, “we”, “us”), an independent software studio based in Türkiye. For the data described in this policy we are the data controller under the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK). Where we process personal data contained in your store data on your behalf, we act as your processor under the Data Processing Addendum.
Contact for anything privacy-related: support@buinbu.com (subject “Privacy”). We have not appointed a data protection officer or an EU representative.
2. Data we collect
| Category | What | Why | Legal basis |
|---|---|---|---|
| Store account | Store name, myshopify domain, store e-mail, owner name, country, currency, languages, plan | Running your account, billing status, service e-mails | Contract |
| Staff sign-in | Name, e-mail and locale of the staff member who opens the app, Shopify access tokens (encrypted) | Signing in through Shopify, acting on the store’s behalf | Contract |
| Catalog | Products, variants, prices, inventory, images, collections, tags, markets, metafields you select | Building feeds and importing products (the service itself) | Contract |
| Feed and import settings | Feed rules, field templates, supplier file URLs and their contents, run history | Generating feeds and imports | Contract |
| E-mails we send | Template, language, delivery status; the recipient address is stored only as a hash | Proof of delivery, avoiding duplicates | Legitimate interest |
| Technical | Request and error logs, audit log of changes | Security, debugging | Legitimate interest |
| Support | Your name, e-mail, store domain and message when you write to us or use the contact form | Answering you | Contract / legitimate interest |
We do not request access to orders or to your customers’ personal data: the app’s Shopify permissions cover products, inventory, locations, markets, languages and publications only. Payment card data never reaches us; Shopify handles all billing.
3. How data reaches channels
A feed is a file at a private, hard-to-guess URL that you give to channels such as Google Merchant Center, Meta, TikTok, Akakçe or Cimri. It contains the product data you chose to include. Anyone who has the URL can read the file, so share it only with the channels you use. Each channel processes the feed under its own terms and privacy policy.
4. Shopify privacy webhooks and uninstalling
- When the app is uninstalled, we delete Shopify sessions and access tokens and stop all scheduled jobs at once. Your settings are kept for 48 hours so a reinstall restores them.
- Shopify sends
shop/redact48 hours after uninstall; we then delete all data of that store, including feed files. customers/data_requestandcustomers/redact: the app stores no customer data, so these requests are recorded and answered as having no data.
5. Retention
| Data | Kept for |
|---|---|
| Store, catalog copy, settings, feed files | While the app is installed; deleted on shop/redact |
| Feed and import run history | 7 days (Free), 30 days (Starter), 90 days (Growth), 365 days (Scale) |
| Copies of failed feed files | 2 days |
| Database backups | 14 days |
| Server logs | Up to 30 days |
| Support e-mails | 2 years after the last contact |
| Contact form messages | Not stored on our servers; they exist only as e-mail |
6. Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Shopify | App platform, sign-in, billing | Canada, Ireland, global |
| netcup GmbH | Application server, database, feed files, backups | Germany (EU) |
| Cloudflare, Inc. | buinbu.com hosting, DNS, security, bot protection (Turnstile), e-mail forwarding | Global network |
| Mailgun Technologies, Inc. | Sending service e-mails and contact form messages (EU region) | EU |
| Google LLC | Support mailbox | Global |
We announce new sub-processors on this page at least 30 days before they start processing personal data.
7. International transfers
Our application data is stored in the EU (Germany). Some providers above process data in other countries, including the United States. These transfers rely on the safeguards of GDPR Chapter V (adequacy decisions, including the EU-US Data Privacy Framework, or Standard Contractual Clauses) and of KVKK Article 9.
8. Your rights
Under the GDPR and KVKK (Article 11) you may ask whether we process your data and request access, correction, deletion, restriction, portability or a copy; object to processing; withdraw consent; and ask about third parties who received your data. Write to support@buinbu.com; we reply within 30 days. You can also complain to your supervisory authority, in Türkiye the Personal Data Protection Authority (KVKK).
9. Security
TLS on every connection, Shopify access tokens encrypted at rest (AES-256-GCM), data separated per store, a firewalled EU server with key-only administrative access and automatic security updates, daily backups and an audit log. If a personal data breach affects you, we notify the competent authority within 72 hours and affected merchants without undue delay.
10. Children
The service is for businesses and is not directed to anyone under 18.
11. Changes
We post changes on this page with a new version date. Material changes are announced by e-mail or in the app at least 30 days before they apply.
12. Contact
support@buinbu.com · hello@buinbu.com · buinbu.com