Privacy Policy for PaymentHero

Last updated: 14 October 2026

1. Who we are and what this policy covers

1.1 This policy explains how HeroSoftware GmbH processes personal data when you visit the PaymentHero website, install and use the PaymentHero Shopify app as a merchant, contact us, talk to us in a call, are contacted by us as a potential customer, visit our social media pages or apply for a job with us.

1.2 Controller:

HeroSoftware GmbH
Walramstraße 23, 65510 Idstein, Germany
Represented by the managing director: Calvin Blick
E-mail: post@hero.software

1.3 Data of your customers (buyers) is not covered by this policy. When PaymentHero processes data of buyers in a merchant's store, it does so on behalf of the merchant. The merchant is the controller and informs its buyers in its own privacy policy. Our role is governed by the Data Processing Agreement, which forms part of our Terms of Service. If you are a buyer and have questions about your data, please contact the store where you placed your order.

2. Data we process, purposes and legal bases

The legal bases in brackets refer to the GDPR and apply in the EU/EEA, correspondingly under the UK GDPR and under the Swiss FADP.

2.1 Installing and using the app

When you install PaymentHero, Shopify provides us with information about your store: shop domain, store name, store e-mail address, store owner name, country, currency, plan and the time of installation. When you or your staff use the app, we process your settings, usage of app features, the Shopify user ID and technical session data.

We use this data to provide the app, to calculate fees, to secure the app and to improve its functions (Art. 6(1)(b) GDPR, contract; Art. 6(1)(f) GDPR, our legitimate interest in a secure and functional app).

2.2 Billing

Fees are charged through Shopify's billing system. We receive information on your plan, charges and payment status, but no payment card details (Art. 6(1)(b) GDPR). We keep invoices and accounting records as required by commercial and tax law (Art. 6(1)(c) GDPR).

2.3 Support, feedback and communication

When you contact us by e-mail, via the chat or feedback widget in the app, via a shared Slack channel or by other means, we process your name, e-mail address, store, your message and the history of the conversation in order to answer your request (Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR if no contract exists yet).

The chat and feedback widget in the app is provided by Productlane. When you open it, the widget loads from Productlane's servers and Productlane receives technical connection data and the messages you send.

2.4 Customer relationship management

We record installations, contacts and the course of our business relationship with merchants in our CRM system in order to manage and develop our customer relationships (Art. 6(1)(f) GDPR). When you install the app, your store is created in the CRM automatically with the data described in Section 2.1. We may also name merchants as customers with company name and logo on our website and in presentations (Art. 6(1)(f) GDPR); you can object at any time (Terms of Service, Section 6.3).

2.5 Product news by e-mail

We send merchants who have installed the app information about our own similar apps and features (Art. 6(1)(f) GDPR; § 7(3) UWG). We inform you of this and of your right to object when you install the app (Terms of Service, Section 5.3). You can object at any time without incurring any costs other than transmission costs at basic rates, for example via the unsubscribe link in every e-mail or by writing to post@hero.software. If you have subscribed to our newsletter yourself, we send it on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

2.6 Calls and demos

If you arrange a call or demo with us, we process the information you provide (name, e-mail address, company, appointment, any notes) in order to arrange and hold the appointment (Art. 6(1)(b) GDPR, pre-contractual measures). Video calls take place via Google Meet.

2.7 Visiting our website

Hosting and server logs. Our website is hosted by Replit. When you visit it, your browser automatically transmits technical data, such as IP address, date and time, page requested, referrer, browser and operating system. This is necessary to deliver and secure the website (Art. 6(1)(f) GDPR). Replit retains these log data for 7 days; we do not combine them with other data.

No tracking. Our website does not use cookies or similar technologies for analytics or marketing. To show you the right language and country version, our server determines your country from your IP address using a local database (GeoLite2 by MaxMind); your IP address is not sent to MaxMind (Art. 6(1)(f) GDPR). Because our website does not store information on your device or access information stored there beyond what is technically necessary, no consent is required under § 25 TDDDG, and we do not show a consent banner.

Fonts are served from our own server. No data is sent to Google Fonts.

2.8 Call recordings and meeting notes

With the consent of all participants, we record calls with merchants and prospects or have them transcribed and summarised automatically, using Attio call recording and Google Meet recording and note-taking (Gemini). We ask for consent at the start of each call; if a participant does not agree, the call is not recorded. Recordings, transcripts and summaries are stored in our CRM and used to document and follow up on the conversation (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future. Recordings, transcripts and summaries are deleted after 12 months at the latest.

2.9 AI assistance in communication and CRM

We use AI features to summarise, sort and draft responses to e-mails and to analyse CRM data (Spark AI, Attio AI, Claude, ChatGPT). In doing so, the content of your communication with us and the CRM data described in Section 2.4 are processed by the respective provider. For Claude and ChatGPT we use business plans under which Anthropic and OpenAI do not use our data to train their models (Art. 6(1)(f) GDPR, our legitimate interest in efficient communication).

2.10 Contacting potential customers

We contact businesses that may be interested in our apps, in particular operators of Shopify stores. In the EU/EEA and Switzerland, we contact you by e-mail for advertising purposes only with your prior consent; in the UK, we do so without consent only to corporate subscribers where PECR permits; otherwise we contact you via LinkedIn or by telephone where permitted. For this purpose, we collect business contact data (name, role, business e-mail address, business telephone number, company, store domain and publicly available information about the store) from publicly accessible sources (e.g. store websites, LinkedIn), from store directories (e.g. Store Leads), from commercial data providers (e.g. Apollo, Clay, Lusha) and via the enrichment function of our CRM (Art. 14 GDPR). We process this data to identify suitable contacts and to approach them (Art. 6(1)(f) GDPR, our legitimate interest in acquiring customers). You can object to this at any time; we will then no longer contact you and delete your data, except for a blocking entry that ensures we do not contact you again. If no business relationship arises, we delete the data 2 years after our last contact.

2.11 Our social media pages

We maintain company pages on LinkedIn, Instagram, Facebook and YouTube. When you visit these pages, the respective platform processes your data under its own privacy policy. For the statistics that LinkedIn and Meta provide to us about visits to our pages (Page Insights), we and the platform are joint controllers (Art. 26 GDPR); the essential content of the agreements is available at https://legal.linkedin.com/pages-joint-controller-addendum and https://www.facebook.com/legal/terms/page_controller_addendum. We process messages and comments you send us there to communicate with you (Art. 6(1)(f) GDPR).

2.12 Applications

If you apply for a job with us, we process your application documents and contact details via the applicant management system JOIN in order to carry out the application process (Art. 6(1)(b) GDPR, steps prior to entering into an employment relationship). If we do not hire you, we delete your data 6 months after the end of the process, unless you have consented to a longer storage.

2.13 Records for compliance with data protection law

We keep records of requests from data subjects and how we handled them, and of consents given on our website where applicable, in order to be able to demonstrate compliance with data protection law (Art. 6(1)(f) GDPR, our legitimate interest in demonstrating compliance, Art. 5(2) and Art. 7(1) GDPR). We keep these records for 3 years.

2.14 Is providing data required?

The data described in Sections 2.1 and 2.2 is required to conclude and perform the contract; without it, you cannot use the app. Providing data in all other cases is voluntary. If you do not provide it, we may not be able to answer your request or book a demo.

3. Recipients

We do not sell personal data. We share personal data only with the following service providers, who process it on our behalf and on the basis of a data processing agreement, unless stated otherwise:

Commercial data providers and store directories from which we obtain business contact data (Section 2.10) act as independent controllers.

We also disclose personal data to authorities, courts or advisers bound to professional secrecy (e.g. tax advisers, lawyers) where we are legally obliged to do so or where this is necessary to establish, exercise or defend legal claims (Art. 6(1)(c) and (f) GDPR).

4. International transfers

Some of the recipients listed above are located in the USA or the United Kingdom, or have access to data from there.

EU/EEA: Transfers to the United Kingdom and Switzerland are based on the European Commission's adequacy decisions. Transfers to the USA are based on the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards by writing to post@hero.software.

UK: Transfers from the UK are based on UK adequacy regulations, the UK Extension to the Data Privacy Framework or the UK International Data Transfer Addendum.

Switzerland: Transfers from Switzerland are based on the Federal Council's adequacy recognition, the Swiss-U.S. Data Privacy Framework or Standard Contractual Clauses adapted for Swiss law.

5. Retention

We delete personal data as soon as it is no longer needed for the purposes described above, unless we are legally required to keep it. Retention periods for call recordings, potential customers, applications and compliance records are stated in Sections 2.8, 2.10, 2.12 and 2.13.

• Data in the app: for as long as the app is installed. After uninstallation, we keep it blocked for 30 days so that the merchant can request an export, then delete it from our active systems; backup copies expire within a further 7 days.
• Store and contact data in our CRM: 3 years after our last contact or the end of the business relationship; for potential customers see Section 2.10.
• Invoices and accounting records: 6, 8 or 10 years in accordance with § 147 AO and § 257 HGB.
• Support conversations and CRM data: 3 years after our last contact with you, unless they are part of records we must keep for longer.
• Product news by e-mail: until you object or unsubscribe.

6. Your rights

6.1 EU/EEA and UK: You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw any consent with effect for the future (Art. 7(3)).

6.2 EU/EEA and UK: Right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests, you may object at any time on grounds relating to your particular situation. You may object to the use of your data for direct marketing at any time without giving reasons.

6.3 EU/EEA: You may lodge a complaint with a supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

6.4 UK: You may complain to us at post@hero.software; we acknowledge complaints within 30 days. You may also lodge a complaint with the Information Commissioner's Office (ICO), ico.org.uk.

6.5 Switzerland: You have the rights under the Swiss FADP, in particular to information and to rectification or deletion, and may contact the Federal Data Protection and Information Commissioner (FDPIC).

6.6 To exercise your rights, write to post@hero.software. We may ask you to confirm your identity.

7. Notice for US residents

7.1 We provide this notice voluntarily; US state privacy laws may not apply to us. We collect the categories of personal information described in Section 2: identifiers and contact details (e.g. name, e-mail address, shop domain), professional information (e.g. role, company), commercial information (plan, charges), internet and network activity (website and app usage), audio and video recordings of calls (with consent), the content of your communication with us and, for applicants, employment-related information. The purposes and recipients are described in Sections 2 and 3. Retention is described in Section 5.

7.2 We do not sell or share personal information.

7.3 Depending on your state of residence, you may have the right to know, access, correct and delete your personal information and, where applicable, to opt out of selling or sharing. We will not discriminate against you for exercising these rights. To submit a request, write to post@hero.software. You may use an authorised agent.

8. Security

We protect personal data with appropriate technical and organisational measures, including encryption in transit, encryption at rest for our app data, multi-factor authentication for all employees and access by our own staff only from Germany. Service providers access data only as described in Sections 3 and 4.

9. No automated decisions

We do not make decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you (Art. 22 GDPR). Automated checks carried out by our apps in merchants' stores take place on behalf of and according to the rules of the respective merchant (Section 1.3).

10. Changes

We may update this policy when our processing changes or the law requires it. The current version is always available on this page. The date at the top shows the last change.