Who operates Floormode
Floormode is operated by P&H Cloud Solutions UG (haftungsbeschränkt), Julius-Hatry-Straße 1, C311, 68163 Mannheim-Lindenhof, Germany (commercial register HRB38151P, Amtsgericht Potsdam). For privacy questions or requests, email support@p-h.solutions.
This notice covers the Floormode Shopify and standalone applications, APIs, the order and returns pages Floormode shows inside a merchant's own online store (under /apps/floormode-tracking), the Floormode block on Shopify's order status page in the customer account, the shipping and return emails Floormode sends for a merchant, and the Floormode documentation site (docs.floormode.app). It does not cover other P&H products or replace the privacy notice of the merchant whose store you use.
Merchants decide which orders to manage and which operational features and connections to enable. For customer, order and warehouse data processed on their instructions, the merchant is the controller and P&H acts as processor (or subprocessor where the merchant acts for another controller). P&H is controller for its own account administration, business correspondence, service security and legal obligations. Contact the merchant first about its use of your order data; you may also contact us for help directing your request.
Information we process
Merchant and staff information includes shop identifiers and domains; installation, plan and settings information; account identifiers, names and email addresses; organisation memberships, roles, invitations, warehouse assignments and records of staff actions.
Order and customer information includes customer and order identifiers, names, email addresses, delivery addresses and telephone numbers; purchased products, quantities, prices, tax and refund amounts; fulfillment details, shipping documents and tracking references. The available fields depend on the merchant, Shopify and the access Shopify permits.
Warehouse records include products, stock levels and movements, warehouse locations, scans, picking and packing activity, parcel and customs information, shipment status and associated staff actions.
Returns and communications can include order lookup details, return reasons, customer notes, contact email, evidence images, return-label references, refund or exchange information, and notification recipients, message content and delivery status.
Images can include photos a customer adds to a return request (up to four, JPEG, PNG or WebP, up to 5 MB each), photos of a parcel's contents taken at the packing station where the merchant turns this step on, and photos taken when goods are received. Please avoid showing people or address labels in photos where that is not needed.
Technical information includes authentication and session data, encrypted connection credentials, request and error information, service logs, operation identifiers and IP addresses used to protect public pages. Map features process delivery address components and resulting coordinates.
We receive information from merchants and their staff, Shopify, users of tracking and returns pages, and connected services such as carriers. Please avoid unnecessary personal or sensitive information in notes and images. Order IDs, tracking references and other operational records can still be personal data when linked to an individual.
Purposes and legal bases
On merchant instructions, Floormode authenticates users, imports and manages orders, organises warehouse work, maintains inventory, creates shipping documents, tracks deliveries, handles returns and related refunds or exchanges, sends configured service messages, and provides operational reports and privacy-request tools. The merchant is responsible for the legal basis for this processing and for informing its customers and staff.
For P&H’s own processing under the GDPR, we use account and contact information to enter into and perform a contract with an individual merchant (Article 6(1)(b)). Where a person acts for a business, we rely on our legitimate interest in administering that business relationship and supporting its authorised users (Article 6(1)(f)).
We handle support and business correspondence to respond to enquiries and operate customer relationships. Depending on the relationship, the basis is contractual necessity or our legitimate interest in providing effective support (Articles 6(1)(b) and 6(1)(f)). We use technical and access records to investigate faults, prevent abuse and protect the service, relying on our legitimate interest in service reliability and security (Article 6(1)(f)). Processing necessary to meet applicable legal duties relies on Article 6(1)(c).
Account and operational information needed for a requested feature must be supplied for that feature to work. Optional connections can remain disabled. Installing the app does not constitute blanket consent for unrelated processing.
Merchants can configure rules that automate operational actions, including order routing and shipping-service selection. These rules follow the merchant’s configuration. Questions about a merchant’s decisions, including any consequences for a customer or employee, should be directed to that merchant.
Services and recipients
Cloudflare provides hosting, the application databases (Durable Objects), object storage (R2, EU jurisdiction), key-value storage, queues and workflows, caching, technical logging and usage metrics, and AI model hosting (Workers AI through Cloudflare AI Gateway). Shopify supplies store and order data and receives authorised updates, including the events Floormode sends to Shopify Flow. WorkOS supports standalone sign-in, organisation and team management, and API authorisation.
Floormode's AI features run on Cloudflare Workers AI, and only when they are used: the two assists when you ask them for a suggestion, and every other AI feature only after the merchant turns it on in Settings. When an import file has columns Floormode cannot match by name, the import dialog sends the unmatched column headings and up to three short sample values per column (at most 120 characters each) to suggest a mapping. "Describe a view" sends the description you type to build a list filter. Every other AI feature sends only the photo or text it needs for its suggestion, such as a photo of a product label. Cloudflare does not keep these inputs or outputs after processing the request and does not use them to train models. Floormode does not store the model's input; it records operational details of each request, such as the feature, the time, the amount processed and pseudonymous account and user identifiers. The results are suggestions you confirm. Avoid customer data in import samples and view descriptions. This processing is international and covered by Cloudflare's data processing terms.
When a merchant uses Floormode's Shopify Flow triggers, Floormode sends Shopify the facts the trigger names, such as the order reference, the parcel, shipment or count reference, the warehouse, the carrier and the tracking number.
When a merchant connects and uses shipping services, those services receive the sender and recipient, address, parcel or freight, customs and reference information needed for the requested operation. Supported integrations include Sendcloud, EasyPost, ShipEngine, DHL Paket (Germany), DPD Germany, UPS, Hermes Germany, Freightview and Uber Freight. An aggregator may pass information to the selected carrier. The actual services used depend on the merchant’s connections and the requested operation.
PrintNode, when connected and used, receives selected document contents and printer/job information to print labels and other documents.
A merchant can choose Floormode, instead of Shopify, to send its shipping emails: the shipment confirmation, parcel updates (for example out for delivery or delivered), optional notices when an order is held, backordered or partly shipped, and the return-label email. Shopify stays the default. Floormode sends them through Resend, from the merchant's own verified email domain, or otherwise from Floormode's sending domain under the store's name. Resend receives the sender and recipient addresses, the subject and the message content. Floormode turns off open and click tracking for the sending domains it registers. Resend keeps email and log data for 30 days while the account is active, stored in the United States.
Geoapify, when configured and used for order maps, receives address components for geocoding and coordinates for a static map. Floormode stores the resulting coordinates with the order. Without a configured geocoding provider, this feature does not send addresses to another geocoder.
Optional Zonos landed-cost calculations use origin and destination countries, currency, customs item details and shipping amounts. The calculation request does not include the customer’s name, email or street address.
Enabled P&H integrations and merchant-authorised API clients receive the operational information needed for the integration or requested operation. Clients can retain information they retrieve under their own arrangements. Support enquiries include information you choose to send to our support service.
Providers acting on our behalf process information to deliver their services. A carrier or service contracted directly by a merchant may have a separate role and its own terms; it is not automatically our subprocessor. Information may also be disclosed when required by law or to handle legal claims. Contact us for the provider and processing details applicable to your Floormode use.
Order pages in the merchant's store
A merchant can show its customers an order page and a returns page inside its own online store. Shopify forwards these requests to Floormode through its app proxy and signs them; Floormode checks the signature. A customer opens the page from a link in an email, the packing slip's QR code or Shopify's order status page, or finds an order with the order number and the email address or postal code. Floormode checks these details and does not store what was typed.
The order page shows the order number and day, the destination city and country, the items, the parcels with carrier and tracking number, the progress of the order and any return. It never shows the customer's name, street, postal code, email address, phone number or any amounts. A page stops working 90 days after the last delivery or the end of the last return, 30 days after a cancellation and 7 days after a test order; Floormode then deletes it.
On the returns page a customer chooses items and a reason, can add a note and up to four photos, and can receive a return label. In the customer account, Floormode's block on Shopify's order status page shows the same order progress and a link to the order page; it uses the customer's Shopify session.
Processing locations and transfers
Floormode keeps its stored files in one Cloudflare R2 bucket in Cloudflare's EU jurisdiction: shipping documents and labels, photos, brand images, the order history archive, the customer order pages, imports and exports. The bucket has no public access; every file is read through Floormode. Each merchant account's application database runs in a Cloudflare Durable Object, which Cloudflare places in its network and which is not restricted to the EU. AI assists run on Cloudflare Workers AI. Resend sends Floormode's emails from its Ireland region, but stores account data, email metadata, logs and API records in the United States. Other providers operate internationally; Floormode processing is therefore not limited to Europe.
Cloudflare’s standard self-service terms incorporate its data processing addendum; WorkOS and Resend also incorporate their processing addenda into their subscription or service agreements. These addenda provide standard contractual clauses for covered transfers outside the EEA where applicable. The linked provider documents explain these safeguards. Contact support@p-h.solutions for a copy of the relevant transfer documentation and information about the arrangements applying to your use. Merchant-contracted services provide details of their own transfers under their terms.
Retention and deletion
A fulfilled or cancelled order leaves Floormode's working database 400 days after its last change. Open orders never leave because of their age. For larger accounts this working period can be shorter (180, 90, 45 or 30 days); the total periods below stay the same.
When it leaves, the order moves into Floormode's history archive in the EU storage: its operational facts (items, quantities, parcels, warehouse steps) are kept for ten years, and a separate customer part (name, contact and address) for six years, each counted from the order's close. Both are written once and never changed. The archive lets a merchant meet record-keeping duties, look up and restore an old order, and answer access requests. A customer erasure deletes the archived customer parts of that customer's orders; deleting an order in Shopify deletes every part. Stock and business ledgers ("books") are kept for ten years from the end of their year.
Shipping labels and label files are deleted 37 days after creation; other carrier documents (such as bills of lading and manifests) after 407 days. Import files and export lists are deleted after seven days.
Photos: parcel photos from the packing station are deleted after the period the merchant chose for that warehouse (30, 90, 180 or 365 days; 90 by default). Photos taken when goods are received are deleted 90 days after upload. Return photos are kept as long as their order is kept in the working database, at most 400 days after the order's last change, and are deleted with the order or by a customer erasure.
Scheduled cleanup makes eligible successful delivery and ingest records, and eligible webhook receipts, removable after generally 30 days; specified failed records after 90 days. Applied integration receipts are eligible after 90 days. Event history is eligible after 365 days. Eligibility is measured from the relevant receipt, event or settlement time; unresolved work can defer removal.
The record of a sent customer email is removed seven days after sending; for terminal notifications, the recipient, subject and body are eligible for removal after 90 days from creation, while delivery status records may remain. Stored email-effect request content is eligible for removal after one day; settled effect-claim records after 180 days. Completed or redacted privacy-request records are eligible after 90 days from completion or redaction. Cleanup runs in batches, so these are eligibility thresholds rather than exact deletion deadlines.
Customer erasure clears specified customer and contact fields and related message contents and removes linked return evidence. Some financial, operational, tracking and audit records remain. We do not describe all remaining identifiers as anonymous. Notes, shared documents, historical records and copies held by other services may need separate review and deletion handling.
To help prevent delayed imports or repeated order updates from restoring erased contact information, erasure handling may retain a separate, minimal set of replay-protection records. These contain hashes of customer identifiers, normalised email addresses and order keys; the original order identifier where needed to process pending work; the erasure cutoff; and technical record identifiers and timestamps. The markers do not store the original customer name, email address, phone number or delivery address. They are pseudonymous, not anonymous, and are retained for this protection until the tenant database is destroyed rather than expiring with the privacy-request record. Order markers protect the specific erased orders. Customer and email markers use the erasure cutoff to distinguish historical orders from independent new purchases created afterward, which can be processed normally.
Uninstalling the last active channel initiates application-database cleanup after required connected-workflow cleanup. Shop redaction additionally removes linked return evidence and relevant registry/account links. A shared WorkOS user account is not automatically deleted when one shop is removed. Uninstalling the last active channel also deletes the account's stored files in every class, including the archive, and removes its email sending domains from Resend.
Several Shopify stores of one business can share one Floormode account. They share one stock, one warehouse and one team: the account's team members with access to orders see the orders and customer details of every store in the account. When a store uninstalls Floormode, its open orders and their customer data are kept for up to 14 days so paid goods can still ship, unless the merchant chose to release them at once. An order whose shipment or stock is still being confirmed stays until that is answered, then leaves the same way. Then Floormode erases that store's orders, customers, returns, photos, documents and archived orders, and the team members who used only that store. Stock movements, valuation and warehouse history stay, without personal details.
Business correspondence and account-administration records are retained according to the ongoing relationship, outstanding enquiries, legal duties and the need to establish or defend legal claims. Provider logs, backups and provider-held copies follow their applicable retention and deletion arrangements. App cleanup does not itself delete merchant downloads or every provider copy. Contact us for record-specific retention information or a deletion request.
Documentation site and affiliate links
The Floormode documentation at docs.floormode.app is a static website hosted by Cloudflare. It sets no cookies of its own and uses no analytics or tracking tools. Cloudflare processes the technical request data needed to deliver and protect the pages, such as the IP address, browser information and the requested page, as described above.
The documentation's Compatible hardware page contains affiliate links to Amazon. P&H Cloud Solutions takes part in the Amazon EU Associates Programme (Amazon PartnerNet): as an Amazon Associate, P&H earns from qualifying purchases. The links do not change the price you pay, and every device on the page can be bought without them.
Nothing is sent to Amazon when you view the page. If you follow an affiliate link, your browser opens Amazon, which records that you arrived through our link, using cookies and similar technologies on its own websites. It can then attribute a qualifying purchase to our partner account. P&H receives only aggregated reports of clicks and sales from Amazon, never your name, contact details or order contents. Amazon (Amazon Europe Core S.à r.l. and its affiliates) processes this information as an independent controller under its own privacy notice. Our legal basis for including the links is our legitimate interest in financing the documentation (Article 6(1)(f)).
Your rights and contact
Depending on the applicable law and circumstances, you can request access, correction, erasure, restriction or portability of your personal data. You can object to processing based on legitimate interests, and withdraw consent where processing relies on consent; withdrawal does not affect prior lawful processing.
For a store’s order data, contact the merchant or ask us to help direct the request. Authorised merchants can use Floormode’s privacy-request queue and export tools, review additional records and evidence, and deliver the response securely. Downloading an export does not automatically send it to the customer. We may need information to verify your identity and identify the relevant account or merchant.
For P&H’s own processing, contact support@p-h.solutions or write to the address above. You can also complain to a competent data protection authority, including the authority where you live or work. P&H’s local authority is the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.
We update this notice when the described processing changes. The version date identifies the text you are reading.