Privacy policy

Last updated: August 21, 2026

This Privacy Policy explains how we collect, use and disclose your personal data when you visit this online shop (the "Shop"), place an order, or otherwise communicate with us. It applies to all processing of personal data carried out by us as a controller within the meaning of the EU General Data Protection Regulation (GDPR).

1. Controller

The controller responsible for the processing of your personal data is:

index commerce GmbH Leopoldstraße 2-8 32051 Herford Germany

Represented by the managing directors: Adina Goerres and Stefan Faistenauer Register Court: Amtsgericht München, Register Number: HRB 303221 VAT ID: DE455153676

Email: security@superglue.ai

2. Data Protection Officer

We have not appointed a data protection officer, as we are not required to do so under Art. 37 GDPR and § 38 BDSG. For all questions regarding data protection, please contact us using the details in section 1.

3. Categories of Personal Data We Process

Depending on how you use the Shop, we process the following categories of personal data:

  • Contact details: name, billing address, shipping address, email address and, where provided, phone number.
  • Order and transaction data: the products you view, add to your cart or purchase, order number, order date, order value, returns and cancellations.
  • Payment data: payment method, payment status and payment confirmation. Card numbers and bank details are entered directly with the respective payment service provider and are not stored by us.
  • Account data: where you create a customer account, your login details and saved preferences.
  • Communication data: the content of your enquiries and our correspondence with you.
  • Technical data: IP address, browser type and version, operating system, referring website, date and time of access, and similar log data.
  • Usage data: information about how you navigate and interact with the Shop.

Providing the data marked as required in the ordering process is necessary for the conclusion and performance of the purchase contract. Without this data we cannot process your order.

4. Purposes and Legal Bases

Purpose Legal basis
Providing the Shop, delivering the website, ensuring stability and security Art. 6(1)(f) GDPR — our legitimate interest in a functioning and secure website
Processing orders, payment, delivery, returns and warranty claims Art. 6(1)(b) GDPR — performance of a contract
Managing your customer account Art. 6(1)(b) GDPR
Responding to your enquiries Art. 6(1)(b) GDPR where related to a contract, otherwise Art. 6(1)(f) GDPR
Fraud prevention and IT security Art. 6(1)(f) GDPR — our legitimate interest in preventing misuse
Retention of invoices and order records Art. 6(1)(c) GDPR — compliance with commercial and tax law obligations
Cookies and similar technologies that are not strictly necessary Art. 6(1)(a) GDPR and § 25(1) TDDDG — your consent

5. Cookies and Similar Technologies

We use cookies and comparable technologies in the Shop. Cookies that are strictly necessary for the operation of the Shop — for example to store the contents of your shopping cart, to keep you logged in and to ensure security — are used on the basis of § 25(2) TDDDG and Art. 6(1)(f) GDPR and do not require your consent.

All other cookies, in particular those used for analytics, personalisation and advertising purposes — including those set by Shopify and its partners — are only used if you have given your consent via our cookie banner. You can withdraw your consent at any time with effect for the future via the cookie settings in the Shop or by deleting the cookies in your browser.

The following providers are currently used in the Shop:

  • Shopify International Ltd., Victoria Buildings, 1-2 Haddington Road, Dublin 4, Ireland — shop system, hosting and shop analytics. Shopify sets cookies that are necessary for the operation of the Shop (e.g. shopping cart, session, security) as well as cookies for analytics and, subject to your consent, for personalisation and advertising. Storage periods vary by cookie and range from the duration of your session up to two years.
  • Shopify Translate & Adapt — an application provided by Shopify used to display the Shop in different languages. It stores your language preference.

We do not currently use any third-party analytics or advertising services such as Google Analytics or the Meta Pixel. Should we introduce such services in the future, we will update this Privacy Policy accordingly and obtain your consent beforehand.

6. Recipients of Personal Data

We only disclose your personal data where this is necessary, based on your consent, or where we are legally required to do so. Recipients include:

  • Shopify International Ltd. as the provider of our shop system and hosting, acting as our processor under Art. 28 GDPR.
  • Payment service providers (e.g. PayPal, Shopify Payments and other providers offered at checkout), which process your payment data as independent controllers under their own privacy policies.
  • Shipping service providers (e.g. Deutsche Post / DHL), which receive your name and delivery address in order to deliver your order.
  • Tax advisors, auditors and authorities, where we are legally required or entitled to disclose data.

7. Shopify

The Shop is operated using the platform of Shopify. Shopify processes personal data on our behalf in order to provide and maintain the Shop, and in some cases as an independent controller for its own purposes such as platform security and service improvement. Further information on how Shopify processes personal data and on the rights you may have towards Shopify is available in Shopify's own consumer privacy policy.

8. International Transfers

Some of our service providers process personal data outside the European Economic Area, in particular in the United States and Canada. In these cases we ensure an adequate level of protection, either because the European Commission has issued an adequacy decision for the country concerned, or on the basis of the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR together with additional safeguards where required.

9. Retention Periods

We erase your personal data as soon as it is no longer required for the purposes for which it was collected, unless statutory retention obligations apply.

  • Order and invoice data are retained for the statutory retention periods of six or ten years respectively under § 257 HGB and § 147 AO.
  • Customer account data are retained until you delete your account, subject to the retention obligations above.
  • Enquiries and correspondence are erased once the matter has been fully dealt with and no retention obligations apply.
  • Server log data are erased after a short period, unless required for the investigation of a security incident.

10. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

  • Access (Art. 15 GDPR) — to obtain confirmation as to whether we process your data and to receive a copy of it.
  • Rectification (Art. 16 GDPR) — to have inaccurate data corrected.
  • Erasure (Art. 17 GDPR) — to have your data deleted, unless retention obligations apply.
  • Restriction of processing (Art. 18 GDPR).
  • Data portability (Art. 20 GDPR) — to receive your data in a structured, commonly used and machine-readable format.
  • Objection (Art. 21 GDPR) — to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. You may object to the processing of your data for direct marketing purposes at any time and without giving reasons.
  • Withdrawal of consent (Art. 7(3) GDPR) — where processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

To exercise any of these rights, please contact us using the details in section 1.

11. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 27 91522 Ansbach Germany

12. Automated Decision-Making

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR.

13. Children

The Shop is not directed at children. We do not knowingly collect personal data from persons under the age of 16. If you are a parent or guardian and believe that a child has provided us with personal data, please contact us and we will erase it.

14. Data Security

We use technical and organisational measures to protect your data against loss, manipulation and unauthorised access, including transport encryption (TLS) for data transmitted through the Shop. Our security measures are reviewed and adapted in line with technological developments. Please note that data transmission over the internet can never be completely secure.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our processing activities or to comply with legal requirements. The current version is always available in the Shop, and the "Last updated" date at the top indicates when it was last revised.