Legal

Privacy policy

Last updated: October 7, 2026

holdmark checks facts about online stores with data from carriers and payment gateways. It is designed to process the least data possible: we do not store buyers’ names or addresses, and we use no tracking cookies on holdmark.org. If a store asks for the post-purchase questions, we read that buyer’s email address in order to write to them once, and we do not store it (see 2.4).

1. Who the controller is

Operator: Aletheia Software, S.L.
Tax ID (NIF): B05672654
Address: Urbanización Cantera Blanca 13, 41900 Camas (Seville), Spain
Contact: equipo@holdmark.org

2. What data we process and what for

2.1 Stores that install the app

When a store installs holdmark on Shopify, we read the following from its account, with read-only permissions:

From the store: its domain, its Shopify domain and the plan it is on.
From each order: identifier, dates, payment status, whether it is a test order or cancelled, the payment processor, the shipments with their carrier and tracking number, and the destination country. We do not read the buyer’s name, phone number or address, and the email address is read only in the case of section 2.4. Nor do we read the order’s attributes, where the store can keep whatever it likes.
From refunds and bank disputes: dates, status and reason, in order to work out whether the store refunds money.
From the theme: which templates the badge is placed in, so we can show the store in the app.

With the tracking numbers we ask the carrier for the status of the shipment (dates and statuses such as "delivered").

What for: to work out the store's facts under public rules, publish them in its record and show them to the store in the app. Legal basis: performance of the contract with the store (the terms of service).

2.2 The public record

Every registered store has a record on holdmark.org with aggregated facts: percentages rounded against the store, volume bands ("50,000+ orders") and delivery times only for the country of whoever is looking. Exact sales figures, countries sold to and any buyer data are never published.

Legal basis: performance of the contract with the store and the legitimate interest of buyers in checking a store before they buy.

2.3 Visitors to stores that display the badge

Count of badge openings: only if the visitor accepted analytics in the store’s own privacy notice. One number is stored per day and per store. The badge stores no cookies and uses no identifier of the visitor.

For this data, holdmark acts as the store's data processor for the store, which is the one that decides to display the badge and collects its visitors’ consent.

2.4 Questions after the purchase

If a store asks us to —it is off unless the store requests it—, we write to its buyers whose orders are recorded as delivered by the carrier. The email carries two questions and a link to answer them. We send it, not the store, and only once per order: there is no reminder and no second email.

The email address is read from Shopify at the moment of sending, is used for that email and is not stored. It is not left in our database, nor in backups, nor in the service logs, which note at most the domain and the first letter.
Of the question we store the order number, how many parcels it had, the delivery date, the link’s random identifier and the time it was first opened. That last one tells us whether the form is understood or abandoned, and it is stored only once: it is not a log of visits. It over-counts, because some email antivirus systems open links on their own to check them.
Of the answer we store what was answered and the date. We do not store the name, the email address or the IP address of whoever answers, nor any free text: the form accepts only fixed options and has no box to write in.

Answers are published only in aggregate —percentages over that store’s buyers as a whole—and never one by one. The link is a single-use random identifier: no order can be deduced from it, and whoever holds it can see nothing but their own two questions.

Legal basis: the legitimate interest of someone about to buy from a store in being able to check how it went for those who already bought there, together with the performance of the contract with the store that requests it. Simply not answering leaves no data at all. If you ask us not to write to you again, we store an irreversible fingerprint of your address —computed with a secret key, from which the address cannot be recovered— and we use it only to recognise it and skip you.

2.5 Visits to holdmark.org

We count how many people view each record and what kind of site they come from (search engine, AI assistant, the store itself, direct…). So as not to count the same person twice in one day, we compute a fingerprint from their browser and from the network portion of their IP (never the full address) using a random key that changes every day. The fingerprint and its key are kept only until the day rolls over, so that a restart of our service does not count again someone who had already visited; when the day changes, both are replaced entirely. A fingerprint cannot be turned back into an IP address, nor can it link visits from different days, because the key it was computed with no longer exists. Of the visit itself, only the daily total is stored.

Our server keeps no access logs containing IP addresses. holdmark.org uses no cookies and no third-party analytics tools, and the typeface is served from our own server.

Legal basis: legitimate interest in knowing how the registry is used, with data that identifies no one.

2.6 Emails you send us

If you write to us, we use your address and your message only to reply or, if you ask us to, to let you know when holdmark reaches your platform. Legal basis: your consent, which you may withdraw at any time.

2.7 App waiting list

While the app is not yet published on the Shopify App Store, the install button opens a form where you can leave us your store address and your email. That is all we keep, on our own server, and we use it for a single notification: the day the app can be installed. We ask for no payment details, we take no deposit, there is no newsletter and it is shared with nobody.

Legal basis: your consent, which you withdraw by writing to us: we delete your entry and we do not write to you. Retention: until we send that notification or you ask us to delete it, and in no case longer than 12 months from the day you sign up.

3. How long we keep it

Store data: for as long as the app is installed. On uninstall, Shopify asks us to delete it (normally after 48 hours) and we delete the downloaded orders, the tracking data and the public record.
Questions after the purchase: the email address is not kept: it is read for the sending and discarded. The link expires after 30 days and the question stays with the store for as long as the app is installed, with no data about whoever answered. Answers already counted are aggregate numbers and cannot be undone, because nothing relates them to a person. The fingerprint of whoever asks us not to write to them is kept indefinitely: it is what keeps the request in force, and deleting it would mean writing to them again.
Visit counts: they are aggregated numbers with no personal data.
Emails: until your query is resolved or you withdraw consent.
App waiting list: until we send the notice that it can be installed, or until you ask us to delete it; at most 12 months.

4. Who we share it with

We do not sell or transfer data. We use these providers, which process data on our behalf:

Amazon Web Services (servers in Ireland, European Union): hosting.
Shopify: app installation and plan billing.
Carriers: they receive the tracking number and return the shipment status to us.
Domain and mailbox provider: GoDaddy (domain and DNS) and Microsoft 365 (the equipo@holdmark.org mailbox).
Email delivery provider (only for the questions after the purchase): . It receives the buyer’s address in order to deliver that single email.

What is published in the record is public by design: anyone, and any AI assistant, can read it.

5. Your rights

You can request access, rectification, erasure, objection, restriction and portability by writing to equipo@holdmark.org. If you bought from a store that uses holdmark, go to the store first: we do not have your name or your email address. If we wrote to you with the two questions and you do not want us to do it again, reply to that email: we will record an irreversible fingerprint of your address, in order to recognise it and not write to you again, without storing the address. Since we do not store it, we also cannot tell you what you answered or link you to any answer already counted. If you are not satisfied, you may complain to the Spanish Data Protection Agency (aepd.es).

6. Changes and languages

If we change this policy, we will publish the new version here with its date and, if the change is significant, we will notify stores in the app.

This policy is published in Spanish, English, German, French, Italian and Portuguese. The translations are provided so that it can be understood; in the event of any discrepancy between versions, the Spanish one prevails, as it is the version drafted under the applicable law.