1 · Roles
For personal data relating to your customers, you are the controller and we are your processor. You determine why and how that data is processed; we act on your instructions.
For your own merchant account data — your contact address, plan, billing status — we are the controller, and the privacy policy governs it rather than this addendum.
2 · Scope of processing
We process the categories of data set out in the annex, for the single purpose of providing the discount engine: evaluating campaigns against carts, applying discounts at checkout, and attributing resulting orders to campaigns.
We do not read or store customer names, email addresses, phone numbers, postal addresses or payment instruments. Where a campaign depends on customer attributes, we hold the Shopify customer identifier and the tag or segment membership only.
3 · Instructions
Your configuration in the app, plus this addendum and the terms, constitute your processing instructions. We will not process the data for any other purpose — in particular, not to train models, not to build products, and not to derive aggregated insights we sell or publish.
If an instruction from you would put us in breach of applicable data protection law, we'll tell you rather than carry it out.
4 · Security measures
We may change these measures, but not in a way that materially reduces the level of protection.
5 · Sub-processors
You authorise the sub-processors listed on the sub-processors page. Each is bound by data protection obligations no less protective than these, and we remain responsible for their performance.
We'll update that page at least 30 days before a new sub-processor starts processing, and notify the address on your account. If you reasonably object on data protection grounds, tell us within those 30 days and we'll either work around it or you may terminate the affected service without penalty and receive a prorated refund.
6 · International transfers
All data at rest is held in Toronto, Canada. Canada benefits from a European Commission adequacy decision, so transfers from the EEA and UK to us require no Standard Contractual Clauses.
The one onward transfer is to our AI provider in the United States, and only when you use the assistant. That transfer is covered by the EU Standard Contractual Clauses (Module 3, processor to processor) with the UK Addendum where relevant. If you never use the assistant, no data leaves Canada.
7 · Data subject requests
If one of your customers contacts us about their data, we'll forward the request to you within two business days and won't act on it ourselves — you're the controller.
Where you need our help to answer an access, correction or deletion request, email [email protected]. We'll respond within five business days at no charge. Shopify's mandatory customer redaction webhooks are honoured automatically.
8 · Breach notification
If we become aware of a personal data breach affecting data we process for you, we'll notify you without undue delay and in any case within 48 hours of confirming it — with what we know at that point, rather than waiting for a complete picture.
The notification will describe the nature of the breach, the categories and approximate volume of data involved, the likely consequences, and the measures taken. We'll assist with any notification you're required to make to a supervisory authority or to affected individuals.
9 · Audits
We'll answer reasonable security questionnaires and provide the documentation we hold. We are a two-person company and do not currently hold SOC 2 or ISO 27001 certification; we'd rather say so plainly than imply otherwise.
Where your own regulatory obligations require an on-site or third-party audit, we'll cooperate in good faith, once per year, at your cost, with 30 days' notice and under confidentiality.
10 · Return and deletion
On termination we delete the data we process for you after a 30-day grace period, including from backups as they age out of the 35-day rolling window. Billing records are retained for seven years as Canadian tax law requires.
Ask within the grace period and we'll provide a machine-readable export first, or delete immediately instead of waiting out the 30 days — whichever you prefer.