Data Processing Agreement

1. Parties, and when this applies

This Data Processing Agreement (the "DPA") is made between you, the merchant who connects a Shopify store or a Meta ad account to StoreInsights (the controller), and [legal entity — to confirm], registered at [registered address — to confirm], which operates StoreInsights (the processor, "we", "us").

It takes effect when you first connect a store or an ad account, forms part of our Terms of Service, and needs no signature: installing the app is your acceptance of it. It applies for as long as we hold personal data on your behalf.

2. Who is responsible for what

This mirrors the "Two different roles" section of our privacy policy, and the split decides which document governs which data.

• Personal data about your customers, contained in the orders we read from your Shopify store: you are the controller, we are your processor. That is what this DPA covers, and it covers nothing else.
• Personal data about you and your team — your email address, your organisation, your settings, your sign-in: we are the controller, and our privacy policy is the disclosure, not this DPA.

Your Meta advertising metrics are aggregated statistics about your campaigns. We do not consider them personal data about identifiable individuals, we run no pixel of our own, and we read no audience or targeting data — but they are described in Annex 1 for completeness.

We will never contact your customers. If one of them writes to us, we forward the request to you and act only on your instruction.

3. Subject matter, duration, nature and purpose

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1, which forms part of this DPA.

In short: we process the data to compute and show your profit, margin and cash figures back to you, for as long as your store is connected, and we delete it afterwards under clause 9.

4. Processing on your documented instructions

We process the personal data only on your documented instructions, including as regards any transfer to a third country. Your instructions are:

• this DPA and the Terms of Service;
• the access scopes you grant when you install the app, and the ad account you select;
• the actions you take in the product — connecting, syncing, exporting, disconnecting.

We do not process the data for our own purposes. We do not sell or share it, we do not use it to train machine-learning models, we do not build cross-merchant benchmarks from it, and we never use one merchant's data to serve another.

If EU or Member State law requires us to process the data otherwise, we will tell you before processing, unless that law forbids us from doing so on important grounds of public interest. And if we think an instruction of yours infringes data protection law, we will say so.

5. Confidentiality

Access to your data is limited to the people who operate the service, and only to what their work requires. Everyone with such access is bound by an obligation of confidentiality, whether by contract or by law, and that obligation survives the end of their involvement.

6. Security of processing

We implement appropriate technical and organisational measures under Article 32 of the GDPR. They are listed, factually and without embellishment, in Annex 2. We may change them as the product develops, provided the overall level of security is not reduced.

Being straight with you, exactly as the privacy policy is: we hold no SOC 2, ISO 27001 or equivalent certification, and we do not claim one. Annex 2 lists what is true today and names what we have not done. A DPA that promised more than the code does would be worth nothing to you.

7. Sub-processors

You give us a general written authorisation to engage the sub-processors listed in Annex 3, and that list is the current authorised set.

• Before we add or replace a sub-processor, we will give you at least 30 days' notice by email to the address on your account, and update Annex 3.
• You may object within those 30 days on reasonable data-protection grounds. We will work with you to find a solution; if we cannot, you may stop the processing by disconnecting your store and closing your account, at no cost and without penalty, and clause 9 then applies.
• We impose on every sub-processor, by contract, data protection obligations no less protective than those in this DPA, and we remain fully liable to you for their performance.

Shopify and Meta are not our sub-processors. They are your own accounts, and we read from them because you authorised us to. What they do with your data is governed by your agreements with them, not by this one.

8. Helping you answer your customers

Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures in fulfilling your obligation to respond to requests from your customers exercising their rights under Chapter III of the GDPR — access, rectification, erasure, restriction, portability and objection.

In practice this is largely automated through Shopify's mandatory compliance webhooks, which we implement:

• customers/data_request — we record the request and return to you what we hold that relates to it, within 30 days.
• customers/redact — we delete the records concerned and recompute the affected figures.
• shop/redact — see clause 9.

You can also simply write to [email protected] and ask. We do not charge for this. If a request from one of your customers reaches us directly, we forward it to you without undue delay and do not act on it except on your instruction — the answer to your customer comes from you, as the controller.

9. Breaches, impact assessments, and the authorities

We assist you in ensuring compliance with your obligations under Articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information available to us. That means:

• Personal data breaches. We notify you without undue delay after becoming aware of a personal data breach affecting personal data we process for you. The notification describes the nature of the breach, the categories and approximate number of records concerned, the likely consequences, and the measures taken or proposed — and where we cannot provide all of it at once, we send what we have and follow up as we learn more.
• Why there is no number of hours here. We are a very small team, and the legal standard — without undue delay — obliges us to tell you as fast as is reasonably possible. A fixed deadline we could not hold in every case would be worth less to you than that, so we have not written one. We notify you in time for you to meet your own 72-hour obligation under Article 33(1) wherever that is within our control.
• Impact assessments and prior consultation. If you carry out a data protection impact assessment (Article 35) or consult a supervisory authority (Article 36) in relation to this processing, we provide the information we hold about how the service works.

Notification of a breach is not an admission of fault by either of us.

10. Deletion or return at the end of the service

At your choice, we delete or return the personal data to you at the end of the provision of the services, and delete existing copies, unless EU or Member State law requires us to keep them.

• When you disconnect a store or uninstall the app: its access tokens are revoked immediately and the data held for it is deleted. Shopify sends shop/redact around 48 hours after uninstall; we act on it, and in any case the deletion completes within 30 days.
• When you close your account: everything associated with it is deleted within 30 days.
• Backups are deleted on their own rotation rather than individually, and are not restored to bring deleted data back.
• Return means an export of the data we hold for you, in a machine-readable format, on request before deletion.

You do not have to wait for any of that. Ask, and we delete.

11. Information and audits

We make available to you all information necessary to demonstrate compliance with the obligations in Article 28 of the GDPR, and we allow for and contribute to audits, including inspections, conducted by you or by an auditor you mandate.

How that works in practice, so that neither of us is surprised:

• Ask in writing and we answer in writing first — that resolves most requests.
• An on-site or remote inspection takes place at most once in any 12-month period, on 30 days' notice, during business hours, and without disrupting the service — unless a personal data breach or a supervisory authority requires otherwise, in which case none of those limits apply.
• An audit must not give access to another merchant's data, or to information covered by our confidentiality obligations to third parties.
• You bear the cost of an audit you initiate, unless it reveals a material failure on our part, in which case we do.

12. International transfers

The processing takes place in the European Union. The infrastructure that holds your data is in Amsterdam, the Netherlands; transactional email is sent from France. Annex 3 gives the detail.

Some of those providers are companies established outside the EEA that operate European regions — DigitalOcean, LLC is a United States company — and they in turn use providers of their own. Where a transfer of personal data outside the EEA occurs, it relies on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914 of 4 June 2021) or on an adequacy decision, as provided in that provider's own data processing agreement — see DigitalOcean's, which incorporates those clauses by name. This matches what our privacy policy says.

We will not transfer personal data processed on your behalf to a third country on any other basis without instructing you first.

13. Liability

Liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where a limitation is not permitted by data protection law. Nothing here limits either party's liability towards a data subject under Article 82 of the GDPR, or any liability that cannot lawfully be limited.

14. Term, changes and precedence

This DPA runs for as long as we process personal data on your behalf, and the clauses that by their nature should survive — confidentiality, deletion, liability — survive its end.

Where this DPA and the Terms of Service or the privacy policy disagree on a data protection matter, this DPA prevails. For everything else, the Terms of Service govern.

We will update this page as the product and the sub-processor list change. The version and date at the top always say which text is current, and we notify account holders by email before a change that materially affects them takes effect — for sub-processors, on the notice period in clause 7.

15. Governing law

This DPA is governed by [governing law — to confirm], and disputes fall to the courts of [competent courts — to confirm] — the same as the Terms of Service. Mandatory rights you have under the GDPR are unaffected by that choice, and you may always complain to the supervisory authority where you live or work.

16. Contact

Anything about this agreement, about a data subject request, or about a sub-processor: [email protected]. We have not appointed a Data Protection Officer; at our size one is not required, and requests go straight to the people running the service.

Annex 1 — Description of the processing

Subject matter and duration

Provision of the StoreInsights profit and cash-flow dashboard to you. The processing lasts for as long as a Shopify store or Meta ad account of yours is connected, plus the deletion windows in clause 10.

Nature of the processing

Read-only collection through the Shopify and Meta APIs, storage, structuring, computation of derived figures, display back to you in your own dashboard, export at your request, and deletion. We do not write to your store or your ad account.

Purpose

One purpose only: computing and showing you your own revenue, refunds, margin, product profitability, advertising return and cash position. No profiling of your customers, no automated decision-making producing legal or similarly significant effects about anyone, no advertising, no model training, no resale.

Categories of data subjects

The end customers who have placed an order in your Shopify store, as they appear on those orders — and, under the same reduced-record rule, the visitors who started a checkout in your store without completing it (abandoned checkouts). No other category.

Types of personal data

We do not copy the whole Shopify order. Per order, we keep a reduced record:

Field group	What it contains	Why
Order identifiers	Order id and order number, creation and update timestamps, financial status, fulfilment status	Ordering the history, and attaching refunds to the revenue they reverse
Monetary amounts	Total, subtotal, discounts, shipping, tax, refunded and net amounts, in both shop and presentment currency	Revenue, margin and cash figures
Line items	Product and variant identifiers, SKU, title, quantity, unit price, discounts	Product-level profitability and cost of goods
Refunds and transactions	Refund and transaction records attached to the order	Reconciling revenue with payouts
Customer identifier	The Shopify customer.id, used strictly as an opaque pseudonymous key. We never resolve it to a person.	Grouping your own repeat purchases into cohorts
Country code	The shipping country code only (countryCodeV2). Not the street, city or postal code.	Shipping-cost and VAT-rate lookups
Abandoned checkouts	Identifiers, dates, totals and line items only. Never the checkout recovery link (it carries a token), and no email, name, address or phone.	Your own recovery and conversion figures
Attribution	The UTM campaign, source and medium recorded on the order	Attributing revenue to advertising spend

What we do not process: no customer name, no postal address, no email address, no phone number, no payment card details. This is deliberate and it is what we have declared to Shopify: we hold Level 1 protected customer data access and have not requested Level 2, which is the level that covers name, address, email and phone. We never receive card numbers — payment is handled entirely by Shopify and its payment providers.

No special categories of personal data (Article 9) and no criminal conviction data (Article 10) are processed. The service is not directed at children.

Meta advertising metrics

Identifiers and names of your ad accounts, campaigns, ad sets and ads, and their daily spend, impressions, clicks and attributed conversions. These are aggregated statistics: they identify your campaigns, not the people who saw them. StoreInsights runs no tracking pixel of its own and reads no audience or targeting data.

Annex 2 — Technical and organisational measures

Everything below is either already running, fixed by the deployment configuration we hold in version control, or verifiable in a provider's own documentation with the source given. Nothing here is a plan or an intention — and the last section of this annex says plainly what we have not done.

Encryption

• In transit: all traffic is served over TLS — between your browser and us, between us and the Shopify and Meta APIs, and between the application and its database.
• At rest: the database is a DigitalOcean Managed PostgreSQL cluster. DigitalOcean's documentation states that these clusters "encrypt data at rest with LUKS (Linux Unified Key Setup) and in transit with TLS", and that "Managed PostgreSQL clusters require TLS for all connections" (DigitalOcean documentation, consulted 1 September 2026). We do not additionally claim application-level encryption of individual fields, because that is not what we do.

Hosting and location

• Application and database run on DigitalOcean App Platform and DigitalOcean Managed PostgreSQL, in the Amsterdam (AMS3) region, the Netherlands, European Union (regional availability, consulted 1 September 2026).
• The database cluster accepts connections only from the application itself ("trusted sources"), not from the open internet.
• Backups: DigitalOcean's documentation states that for a managed database "backups run automatically once per day and are retained for seven days" (DigitalOcean documentation, consulted 1 September 2026). That is what fixes the backup rotation referred to in clause 10.

Access control

• OAuth access tokens for Shopify and Meta are held server-side, used only by our sync jobs, and never saved in your browser.
• Access to production data is limited to the people who operate the service.
• Sign-in is passwordless — a single-use link sent to your email address. Email-and-password sign-in is disabled in configuration, and a test in our build pipeline fails if anyone re-enables it. Requests for a sign-in link are rate-limited per IP address.
• Session cookies are marked Secure in production, and cross-origin requests are accepted only from an explicit list of our own origins.
• Within your organisation, four roles (owner, admin, editor, viewer) decide who sees financial figures and who can change connections. Roles are enforced on the server, not in the interface.
• Our access to your store is read-only: we request no write scope on your orders.

Separation and minimisation

• Each merchant's data is scoped to that merchant's organisation. One merchant's data is never used to serve another.
• We read the fields listed in Annex 1 and no others, and we requested the lowest Shopify protected-data level that lets the product work.

Deletion

• Shopify's three mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact) are implemented; deletion on shop/redact covers orders, computed metrics, sync bookkeeping, advertising caches, cost settings, credentials and tokens.
• Each webhook is authenticated by HMAC signature; a request with an invalid signature is rejected. Replays are recognised and not processed twice, and every deletion is idempotent.

What we have not done, and do not claim

We would rather you read this from us than discover it later. We hold no SOC 2, ISO 27001 or equivalent certification. We have not commissioned an external penetration test. We do not keep a per-record access log of protected customer data — that is a Shopify Level 2 requirement, and we have not taken on Level 2. We have no formal, documented security incident response policy beyond the notification duty in clause 9. StoreInsights is a young product built by a very small team, and this annex will grow as those things get done.

Annex 3 — Sub-processors

The list is short on purpose. Clause 7 says how it can change and how you can object.

Sub-processor	What it does for us	Where	Status
DigitalOcean, LLC (United States) Data processing agreement	App Platform (hosting of the application and of this website) and Managed PostgreSQL (the database holding your order data)	Amsterdam (AMS3), Netherlands, EU	In use
OVH S.A.S. 2 rue Kellermann, 59100 Roubaix, France Data processing agreement (French entity, v7.0)	Transactional email: sign-in links and service notifications are sent from [email protected] through OVHcloud's hosted email	France, EU	In use
PostHog, Inc. Data processing agreement	Product analytics on how your team uses the dashboard. It receives no order data and no personal data about your customers.	PostHog Cloud EU — Frankfurt, Germany, EU (AWS eu-central-1)	Planned — not in use

PostHog is listed before it is used, not after. The account is not open yet and the product sends nothing while no key is configured. It appears here so that switching it on is not a surprise; when it is switched on, it will still receive only usage events about your own team, never your customers' data.

Our providers have providers of their own. That is normal and we would rather point at it than let you find it. DigitalOcean publishes its own sub-processor list at digitalocean.com/trust/subprocessors (consulted 1 September 2026); it includes Amazon Web Services for server backups. Reading that list is part of reading this annex, and it is one of the reasons clause 12 exists.

Not sub-processors under this DPA:

• Shopify and Meta — your own accounts, as clause 7 says.
• Google Fonts and Cloudflare (cdnjs) — they serve the typeface and icons of this marketing website only. They receive the IP address of whoever browses these pages, which the privacy policy discloses, and they touch no merchant or customer data.

Version

Version 0.1 — draft of 1 September 2026. Prepared to meet requirement 7 of Shopify's Level 1 protected customer data requirements ("Make privacy and data protection agreements with your merchants"). Pending legal review. The previous versions of this page, once there are any, will be available on request.