AppVerixData Processing Addendum
Last updated: 15 October 2026
This Data Processing Addendum ("DPA") is part of the Terms of Service for every AppVerix app: AppVerix Invoices, Size Charts, Quantity Breaks, Gift Options, Restock and Returns (each "the app"). It applies when AppVerix ("we", "us") processes personal data on your behalf as a Shopify merchant ("you"). By installing an app you agree to this DPA. If this DPA conflicts with the Terms of Service about the handling of personal data, this DPA applies.
1. Roles
For the personal data of your customers and staff that an app receives from your Shopify store, you are the controller and we are the processor. We process it only to provide the app to you. For the data we need to run our own business (your shop domain, your contact email, billing status), we are an independent controller, as described in each app's Privacy Policy.
2. What we process, and why
| Item | Details |
|---|---|
| Purpose | Providing the app you installed: for example making and emailing invoices, handling return requests, showing gift options, or sending you stock alerts. Nothing else. We do not sell personal data, use it for advertising, or use it to build profiles. |
| People concerned | Your customers (including shoppers who submit a request through an app) and your staff who use the app. |
| Types of data | Depends on the app. It can include a customer's name, email address, order number and the items on the order, and, for AppVerix Returns, the return reason, an optional note and up to three photos the shopper uploads. We do not collect payment card numbers. Each app's Privacy Policy lists exactly what that app stores. |
| Duration | While the app is installed, then deletion as set out in section 7. |
3. Our commitments
- We process personal data only on your documented instructions, which are your use of the app's features and this DPA. If we think an instruction breaks the law, we will tell you.
- Everyone at AppVerix who can reach personal data is bound to keep it confidential, and access is limited to what is needed (see the Security page).
- We apply the security measures in section 5.
- We help you answer requests from your customers (access, correction, deletion) and respond to Shopify's customer data requests and erasure requests. Shoppers should send requests to the merchant; if one reaches us we pass it to you.
- We help you meet your own obligations on security, breach notification and impact assessments, to the extent it relates to our processing and the information we hold.
4. Subprocessors
You authorise us to use these subprocessors. Shopify itself is the platform you chose and is not our subprocessor.
| Subprocessor | What for | Data involved |
|---|---|---|
| Cloudflare, Inc. | Hosting (Workers) and database storage (D1) for all apps, plus request delivery to the apps | All data the app stores |
| Resend, Inc. | Delivery of emails the app sends (for example an invoice or a return status update), in the apps that send email | Recipient email address, email content and attachments |
We will update this list before adding a subprocessor that handles personal data, and tell you at support@appverix.com on request. If you object on reasonable data-protection grounds, you can uninstall the app, which ends the processing. We remain responsible for our subprocessors. Where personal data leaves the EEA or the UK, we rely on the provider's Standard Contractual Clauses or another approved transfer mechanism.
5. Security measures
- Data is encrypted in transit with TLS, and stored in Cloudflare D1, which encrypts all stored data at rest (AES-256).
- Database backups use D1 Time Travel, which allows restoring to any minute in the last 30 days.
- Credentials and API keys are kept as Worker secrets, not in source code. Customer personal data is not written to application logs or source control.
- Each store's data is separated by shop in every query, and the apps authenticate every admin request with Shopify session tokens.
- Access to our accounts uses unique logins, a password manager and two-step verification. Details, and our incident response plan, are on the Security page.
6. Personal data breaches
If we become aware of a breach of personal data that we process for you, we will tell you without undue delay, and within 72 hours of becoming aware, by email to the address Shopify gives us for your shop. The notice will describe what happened, what data and roughly how many people are affected if known, the likely consequences, and what we have done and recommend. We will keep you informed as we learn more.
7. Deletion and return of data
- Uninstall: we delete the app's login session for your store immediately.
- Store erasure: when Shopify sends the shop erasure request (usually within 48 hours after uninstall), we delete all of the store's data held by the app. The one exception is the access audit log in AppVerix Returns (see our security page): it holds only the shop domain, the kind of action, a record ID and the time, no personal data, and is removed after 12 months.
- Customer erasure: when Shopify sends a customer erasure request, the apps that hold data about that customer delete it. For a customer data request, the apps that hold data about the customer collect it so you can provide it.
- Backups: deleted data can remain in database backup history (D1 Time Travel) for up to 30 days, then it is gone.
- We keep a minimal record that a Shopify privacy request was received and handled (shop, request type, time and Shopify's customer ID or order numbers, with no names or email addresses). The one exception is the export AppVerix Returns prepares for a customer data request, which is cleared after 30 days.
You can also ask us to delete or export your data at any time at support@appverix.com.
8. Audits and information
On reasonable request we will give you the information needed to show we follow this DPA, such as our security and incident response policy, and we will answer your questionnaires in writing. We handle audits this way so that other merchants' data is not exposed.
9. Changes and contact
We may update this DPA and will change the date above when we do. Questions or requests: support@appverix.com.