Data Processing Agreement (DPA)

Version: 2026-10-04

1. Parties and Roles

Shopivibe acts as the data controller for all personal data of registered users — the merchants who signed up.

Once you connect a store, Shopivibe acts as your data processor for that store's customer data. Shopify sends us the store's events and we keep what your rules need in order to act on them: orders, customers, products and inventory levels, which can include a customer's name, email address and delivery address; each customer's email marketing choice as Shopify holds it; the messages your rules queued and the messages actually sent, including the recipient; and what we wrote back into the store on your behalf. You are the controller for all of it. We process it on your instruction, for as long as Shopivibe is installed, and for no other purpose. A request the engine cannot build is read by a member of our staff in order to build it; where it names one of your customers, that is processing on your instruction under this agreement.

What “wrote back into the store” covers, in full: a tag added or removed on a customer, product or order; a stored fact (a metafield) on a customer, product or order; an inventory level; an item's unit cost; the price something sells for, together with the was-price shown beside it; a draft order, which carries a customer's email address; a URL redirect; capturing or voiding a payment on an order; a money-off code for one named customer, which only that customer can use and only once, and which carries that customer's identifier in the store; a discount applied at the checkout, which lowers what a shopper pays for the basket in front of them; and a block on the checkout, which stops a shopper completing a purchase. Tags, stored facts, draft orders, URL redirects and unit costs are written automatically when a rule fires. Anything that touches a payment goes to the 24-hour lane, where a member of our team does it by hand. A rule that changes an inventory level, or a price a shopper pays, or that gives a customer a money-off code, is built like any other but cannot start until the merchant has been shown exactly what it would do and has published it themselves.

The last two act at the checkout rather than on stored data. They are the only two entries on that list that process no personal data at all: the discount changes a total, the block stops a purchase and shows the reason the merchant's rule gives, and neither reports back who saw either one. The money-off code above them is the third entry an end customer meets directly, and it is not in that class: it is sent to them, and the customer it belongs to is named on the discount record held in the store, which is both personal data and the control that stops anybody else using the code. Neither of the two checkout acts is performed in a store until the controller has published that behaviour and the store has granted the permission it needs. They are listed so the controller knows the full scope of the processing before it begins.

If you also use the app builder, the same split applies to any end-customer data an app you built processes through Shopivibe.

2. Sub-processors

We engage the following sub-processors to provide the Shopivibe service. Last updated: 2026-10-04.

We will notify customers of material sub-processor changes with at least 14 days' notice via email to the registered account address before the change takes effect.

3. International Data Transfers

Transfers of personal data outside the EU/EEA are safeguarded by:

• EU–U.S. Data Privacy Framework (DPF) where applicable
• EU Standard Contractual Clauses (SCC) with sub-processors not covered by DPF
• Sub-processors' own binding corporate rules or equivalent mechanisms

4. Security Measures

• All data in transit is encrypted via TLS 1.2 or higher (HTTPS)
• Database access is restricted to authorised application processes only
• Session tokens are signed JWT cookies (HttpOnly, SameSite=Lax)
• No passwords stored — sign-in is a six-digit code sent to your email address, valid for ten minutes, or sign-in with Google
• Store access tokens are stored encrypted, with application-level access control
• Role-based access control (RBAC) enforces resource ownership at the API layer
• Administrative actions that touch a customer's account or their data are logged in a persistent audit log. Internal tuning of the service — adjusting the hints the AI is given, for instance — is not, because it reaches no customer record.
• Protected store customer data opened on a merchant-facing page — the Shopivibe page in the Shopify admin, or the Shopivibe card on an order or a customer — is recorded separately: who, what kind of data, which store and how many records. Those entries never contain a customer's name, address or email.
• The limit of that record, stated rather than implied: whoever holds the database credentials can query the database directly, and no log in the application sees it. That access is controlled by who holds the credentials, and any use of it during an incident is written into the incident record by hand.

5. Data Retention

Merchant data

• Personal data is retained while the Shopivibe account is active
• On account deletion, personal data is removed from primary storage immediately, with one exception: the audit and access log below, and it is deliberate. A record of a request that was held or refused before it reached a store carries the merchant's own wording and has no cascading link to the account row, so it used to outlive the deletion. It no longer does — those rows are deleted explicitly, by account, in the same transaction as the account itself, and they are erased with the store's data on uninstall as well.
• Backup retention: data leaves our hosting provider's backups within 30 days
• Audit and access log: retained for at most 365 days. This table is deliberately outside every erasure path — an instruction that could delete the record of who read the data would make the access log worthless — so it holds the account email address and IP address for that period. Clearing it is a manual job today, not an automated one.

Store customer data

Retention is bound to the installation, not to a clock. A store's customer data is kept while Shopivibe is installed on that store and erased when it is not. There is no fixed period, because there is no purpose served by holding it after the merchant has gone.

6. Shopify Compliance Requests

Shopify sends three mandatory requests on a merchant's behalf. What each one does here:

• Erase one customer (customers/redact) — Records that are that person are deleted. Records that are evidence of something the store did — a message that was sent, a write back into the store — are kept with the person blanked out, so the merchant can still show what their store said. A request naming nobody is refused rather than guessed at.
• Erase the store (shop/redact) — Sent by Shopify 48 hours after uninstall. The workspace, the connection, the access token, the queued and sent messages, the receipts and the merchant's own requests are all deleted.
• What do you hold about me (customers/data_request) — The request is recorded with counts of what the workspace still holds, and the data itself is emailed to the merchant as a file, at the verified address on their Shopivibe account — one file per account where a store has been linked to more than one, each holding only that account's rows. It is an attachment and no page in the service displays it. The merchant answers the data subject, inside the 30 days Shopify allows for the reply.

7. Data Subject Rights

Under GDPR, data subjects may exercise the following rights by contacting [email protected]:

• Right of access (Art. 15) — ask for a copy of your data under Support in Shopivibe or at the address above; the file we send covers the store-connected side as well and counts your own customers' records rather than listing them
• Right to erasure (Art. 17) — ask us to delete your account and its data at any time, under Support in Shopivibe or at the address above; we do it without undue delay. Section 5 names the one exception, says why it is deliberate, and gives the period it is kept for.
• Right to portability (Art. 20) — ask for your data under Support in Shopivibe and we send it in JSON format. That file covers the account, billing and credit history, support messages, referrals, app builder projects, and the store-connected side — the rules written, what they did, the messages they sent, and every request made, including the ones held before a workspace existed. The store's own customer records are counted rather than listed, and the rows themselves are supplied on request to the address above.
• Right to rectification (Art. 16) — to change your name or email address, contact us under Support in Shopivibe or at the address above
• Right to object (Art. 21) — contact us at the address above

These are the merchant's own rights. A request from one of your store's customers is answered through you, the controller — send it through Shopify and section 6 says what we do with it.

8. Breach Notification

In the event of a personal data breach, we will notify affected users within 72 hours of becoming aware of the breach, in accordance with GDPR Art. 33–34. Notification will be sent to the registered account email address.

9. Contact

For DPA-related enquiries:
Iisivuokra Oy
[email protected]