+1 929-264-76 02
  • Free consultation

    • Privacy Policy – Solution25 for Shopware

    Version: November 2026

    This policy explains how solution25 GmbH (“Solution25”, “we”) processes personal data when you use Solution25 for Shopware: the connector that lets AI clients such as Claude, ChatGPT and Gemini work with a Shopware shop.

    1. Who we are

    solution25 GmbH Marcusallee 16, 28359 Bremen, Germany Email: info@solution25.com

    Data protection officer: bits + bites it-solutions GmbH & Co. KG, Krombacher Straße 24, 57223 Kreuztal, Germany, datenschutz@bits-bytes.de

    2. What this policy covers

    The connector has two parts:

    • The connector server, run by Solution25. AI clients sign in to it, and it reaches the shops their users connected.
    • The Shopware plugin “Solution25 MCP Workflows”, which the shop operator installs in their own shop. It creates the access the connector server uses and stores its own data in the shop’s database.

    This policy does not cover how the AI client providers (Anthropic, OpenAI, Google) process your conversations. Their own privacy policies apply to that (see section 6).

    3. Our role

    • For the data we need to run your connection (sections 4.1 and 4.2) and for our technical logs (section 4.4), Solution25 is the controller.
    • When an AI client reads or changes data in a shop through the connector (section 4.3), the shop operator decides what is shared and why. For that shop data, Solution25 acts on the shop operator’s behalf as a processor. Shop operators can request our data processing agreement (Art. 28 GDPR) at info@solution25.com.

    4. What we process, why, and for how long

    4.1 Connection data

    When a shop operator connects their shop, we store:

    Data Why How long
    Shop address and name, Shopware and plugin version To reach the shop and show it to the AI client Until the shop is disconnected
    The permissions the shop operator granted (for example “Products: View”) To offer only the tools that are allowed Until the shop is disconnected or the permissions are changed
    Access keys of the Shopware integration the plugin created To call the shop on the user’s behalf Until the shop is disconnected. Stored encrypted (AES-256-GCM)
    A one-way hash of the connection secret the plugin holds So that only the plugin can change or end the connection Until the shop is disconnected

    When the last shop of a sign-in is disconnected, the sign-in and all its tokens are deleted as well.

    Legal basis: performance of the contract for using the connector (Art. 6(1)(b) GDPR).

    4.2 Sign-in data

    Data How long
    Registration of the AI client: its name, its return addresses and, where used, a client secret (stored encrypted) Deleted after one day if no sign-in uses it; otherwise as long as a sign-in uses it
    The sign-in page: the one-time connection code (stored only as a keyed hash, never readable) and the permissions ticked on the page 30 minutes
    Authorization codes (stored only as a hash) 5 minutes
    Access tokens (stored only as a hash) 1 hour
    Refresh tokens (stored only as a hash) Up to 30 days; a sign-in lasts at most 90 days
    A record of used refresh tokens (hash only), to detect stolen tokens Until the token would have expired
    A record of ended sign-ins 90 days
    One-time links for connecting another shop (hash only) Until the link expires, at most 60 minutes

    Expired entries are deleted automatically every 5 minutes. Codes, tokens and secrets are never stored in readable form.

    Legal basis: Art. 6(1)(b) GDPR, and our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).

    4.3 Shop data processed on request

    When you ask your AI client something, it calls a tool of the connector. The connector then reads or changes data in the connected shop, but only within the permissions the shop operator granted. Depending on those permissions, this can include products, categories, manufacturers, media, reviews, orders and customers. Customer and order data can contain personal data, such as names, email addresses, billing cities and order histories.

    • We pass the result to your AI client and do not store it.
    • A change is always previewed first. To confirm exactly the previewed change, the preview and a one-time confirmation token are kept in memory for at most 15 minutes, and never written to a database.
    • The shop itself records every tool call in its audit log (section 4.5).

    4.4 Technical logs

    • Our server logs operational events: start and stop, errors, which tool was called, for which shop, how many records and how long it took, and shortened internal IDs. When an AI client’s registration is refused, we log the requested return addresses (at most once a minute per IP address). We never log tokens, codes, secrets or passwords.
    • Our hosting provider’s web server logs each request: the full IP address, time, requested address including its parameters, and browser or client identification.
    • Retention: 30 days. After that, the logs are deleted.

    Legal basis: our legitimate interest in running the service securely and fixing errors (Art. 6(1)(f) GDPR).

    4.5 Data the plugin stores in the shop

    The plugin stores in the shop’s own database, under the shop operator’s control:

    • the Shopware integration and role created for each connection;
    • the connection details it needs to change or end the connection;
    • an audit log with one entry per tool call.

    The plugin’s optional AI search and storefront chat send questions directly from the shop to the AI provider the shop operator configured, with the shop operator’s own key. They do not go through our server, and this policy does not cover them.

    4.6 What we do not do

    • We do not sell data or use it for advertising.
    • The connector’s own pages (sign-in and connection pages) set no cookies and use no tracking or analytics.
    • We do not read your AI conversations; we only receive the tool calls your AI client sends.

    5. Security

    • All connections use HTTPS.
    • Access keys and client secrets are encrypted.
    • Codes and tokens are stored only as hashes.
    • Every connection is limited to the permissions the shop operator granted, and checked both on our server and by Shopware’s own access control.
    • Every change needs a preview and a one-time confirmation.
    • Requests are rate-limited, and a sign-in ends at the latest after 90 days.

    6. Recipients

    • Hosting: Profihost AG, Expo Plaza 1, 30539 Hannover, Germany, which runs our server in Germany under a data processing agreement.
    • Your AI client provider: the results of the tools you use are sent to the AI client you chose. That provider processes them under its own policy. These providers may process data outside the EU.
    • The connected shop: your requests are carried out in the shop operator’s Shopware shop.

    We do not pass data to anyone else, unless the law requires it.

    7. Your rights

    Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). To use them, write to info@solution25.com or to our data protection officer at datenschutz@bits-bytes.de. You can also complain to a data protection supervisory authority, for example the one responsible for us: the data protection authority of the Free Hanseatic City of Bremen (https://www.datenschutz.bremen.de).

    You can end the connection at any time:

    • in Shopware under Settings > System > MCP connector > Disconnect, which deletes the connection on our server;
    • or by removing the connector in your AI client.

    If you are a customer of a connected shop, please contact that shop: it decides what is shared with AI clients.

    8. Changes

    We update this policy when the connector changes. The current version is always at this address, with its version date at the top.

    9. Contact

    solution25 GmbH, Marcusallee 16, 28359 Bremen, Germany, info@solution25.com