Data Processing Agreement

1. Scope and Parties

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Alfred Commerce (“Alfred,” “we,” or “us”) and the merchant that installs an Alfred app (“Merchant” or “you”). It applies when an Alfred app processes personal data about your customers on your behalf (“Customer Personal Data”).

Today one Alfred app does this: Alfred Order Edits (listed on the Shopify App Store as “Alfred Order Edit & Cancel”). Alfred Purchase Orders and Alfred Launch Scheduler do not process Customer Personal Data. If another Alfred app starts to, we will add it to this DPA before it does.

For Customer Personal Data, you are the controller and Alfred is your processor. Where this DPA and the Terms conflict on the processing of Customer Personal Data, this DPA governs. Our Privacy Policy describes the data we process as a controller about you, the merchant.

2. Details of the Processing

2.1 Subject matter and purpose

Providing Alfred Order Edits to you: letting your customers, your staff, and the support agents you connect see which changes an order still allows and make them; making those changes, refunds, payment requests, and fulfillment holds in your Shopify store; emailing your customers their edit links and the confirmations Shopify does not send; checking new shipping addresses that customers type; counting edits for billing; and, where you connect them, sending order edit events to the email or marketing platforms you choose.

2.2 Data subjects

Your customers who place orders in your Shopify store, and anyone who looks up orders by email on your store's Change my order page.

2.3 Categories of personal data

• Name, email address, phone number, and shipping address on an order, and the Shopify customer ID
• Order contents and history: items, prices, discounts, taxes, shipping, payment status, refunds, and the changes made to the order
• Addresses a customer types when changing their shipping address
• The IP address of a visitor to the edit pages, used only as a short-lived rate-limit key, and one-way hashes of email addresses

Alfred Order Edits does not process billing addresses, payment card details, or special categories of personal data.

2.4 Duration

For as long as Alfred Order Edits is installed on your store, and until the data is deleted under Section 8.

3. Our Obligations

We will:

• Process Customer Personal Data only on your documented instructions, which are these Terms, this DPA, and the settings, rules, and actions you take in the app, unless the law requires otherwise (in which case we will tell you first, unless the law prohibits it)
• Not sell Customer Personal Data, use it for our own purposes, market to your customers, or combine it with data from other stores or other Alfred apps
• Make sure that anyone we authorize to access Customer Personal Data is bound by confidentiality
• Keep the security measures in Annex 2 in place
• Tell you if we believe an instruction breaks data protection law

4. Your Obligations

You are responsible for having a lawful basis to let Alfred Order Edits process Customer Personal Data, for telling your customers about it in your own privacy notice, for the accuracy of the data in your store, and for the instructions you give through your settings and rules.

When you connect Klaviyo, Omnisend, or your own webhook URL, you instruct us to send that platform order edit events, including your customers' email addresses and edit links. Those platforms are your recipients, not our subprocessors, and your agreement with each governs what it does with the data.

5. Subprocessors

You authorize us to use the subprocessors listed in Annex 1. We impose data protection terms on each subprocessor that protect Customer Personal Data at least as well as this DPA, and we remain responsible for their performance. We will update Annex 1 before we add or replace a subprocessor and notify you through the app or by email. If you object on reasonable data protection grounds, please contact us at alfredcommerceapps@gmail.com so we can address the objection; if we cannot, you may stop using Alfred Order Edits by uninstalling it.

6. Requests from Your Customers

If one of your customers contacts us directly about their data, we will refer them to you and will not respond to the request ourselves unless you ask us to. We support Shopify's privacy requests:

• customers/data_request: we find the records we hold for that customer and their orders and provide them to you, so you can respond within the 30 days Shopify allows
• customers/redact: we delete or clear every stored record about that customer and the orders named
• shop/redact: we delete all of your store's Alfred Order Edits data, unless the app has been reinstalled in the meantime

We will also give you reasonable help with data protection impact assessments and consultations with supervisory authorities about Alfred Order Edits.

7. Personal Data Breaches

If we become aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data, we will notify you without undue delay, and in any case within 72 hours of confirming it, by email to your store's contact address. We will tell you what we know about the nature of the breach, the data and customers affected, its likely consequences, and what we are doing about it, and we will update you as we learn more.

8. Retention and Deletion

Alfred Order Edits reads most customer details from Shopify when it needs them. What it stores is deleted on a fixed schedule:

• Requested changes and previews: 1 hour after an abandoned preview expires, or 30 days after the change is made
• The before and after of address changes (edit history): 90 days after the order was placed
• Email recipients and contents: 30 days after sending
• Order webhooks from Shopify: 7 days
• Events sent to platforms you connect: 7 days after delivery
• Address validation results: 30 days at most (Google's limit), address only
• Any stored customer detail, whatever its state: 90 days after it was created at most, except a privacy request from Shopify that hasn't been carried out yet, which is kept until it has

After you uninstall, we delete all of your store's data when Shopify sends its shop/redact request, 48 hours after uninstall. Deleted data can remain in our encrypted database backups for up to 30 days until those backups expire. Shopify holds the original order data, so we do not return a copy.

9. Audits

We will make available the information reasonably needed to show that we meet this DPA, including by answering your written security and privacy questions.

10. International Transfers

We and our subprocessors process Customer Personal Data in the United States. Where the law requires a transfer mechanism for Customer Personal Data leaving the European Economic Area, the United Kingdom, or Switzerland, we will put appropriate safeguards in place, such as the Standard Contractual Clauses approved by the European Commission.

11. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service.

12. Changes

We may update this DPA, for example to add an app or a subprocessor, by publishing a new version on this page and updating its Effective Date. We will not reduce the protection it gives Customer Personal Data without notifying you first.

Annex 1: Subprocessors (Alfred Order Edits)

How Sentry and PostHog stay free of Customer Personal Data: error reports are rebuilt from an allowlist of store IDs, order IDs and error codes before they leave our servers, and the SDK's own collection of headers, cookies, request bodies, query strings and variables is switched off, so Sentry does not receive Customer Personal Data. PostHog events from the pages your customers use and from support agent calls are sent from our servers keyed by store and order IDs only, with no cookies, so PostHog does not receive Customer Personal Data either. UptimeRobot checks that our endpoints are up and receives no data.

Annex 2: Security Measures

• Data is encrypted in transit (TLS) and at rest (Google Cloud's default encryption)
• Secrets and API keys are kept in Google Secret Manager, never in source code
• Every change goes through one edit engine that checks the merchant's rules, previews the change, and only then commits it
• A customer can change an order only through a signed link emailed to the order's address, or as the signed-in customer account that owns the order
• Support agents use API keys stored only as hashes, limited to reading and requesting links that go to the order's own email, with per-key rate limits and a log of every call
• Shopify webhooks are verified by signature, and internal job endpoints by Google-signed tokens
• Customer names, email addresses, addresses and phone numbers are kept out of logs, error reports and analytics
• Stored customer details are deleted on the schedule in Section 8, by a nightly job
• Access to production systems is limited to authorized staff (today, Alfred's owner), each with a unique password and two-factor authentication. The app runs under its own service accounts, limited to the database and the secrets it needs
• Administrative actions and access to the database are logged (Cloud Audit Logs, including Data Access logs for Cloud SQL)
• Daily backups (the last 30 kept) and 7 days of point-in-time recovery, restored to a new instance first so a bad restore can't overwrite live data
• Security incidents are handled under a written response policy, with merchants notified as set out in Section 7