Data Processing Agreement

These are the processor terms required by Article 28(3) GDPR. They form part of the Terms of Service and take effect when you install the app — you do not need to sign or return anything. If your organisation requires a countersigned copy, email gimbernat13@gmail.com and we will provide one.

1. The parties

Controller: you, the merchant that installed the app.
Processor: Capyo, operated by an individual developer.

This split covers the data listed in section 3. For Capyo's own account, plan, billing and support correspondence with you, Capyo is an independent controller rather than your processor; the Privacy Policy, section 1, describes that side.

Operator legal name and address: see the Privacy Policy.

Shopify is a separate processor for you, under Shopify's own data processing addendum, which governs the Shopify-to-merchant relationship and is unaffected by this document. Store data we process reaches us through Shopify; when the optional semantic matcher is configured, product titles are sent to OpenAI, as described in section 8.

2. Subject matter, duration, nature and purpose

• Subject matter: providing the Capyo: Dynamic Pricing Shopify app — the catalog mirror, the rival shops and their public-page fetching, product matching with the confirm queue, the daily and 6-hourly checks, the comparison dashboard, rules with a margin floor, alerts, and the apply-and-undo price history.
• Duration: from installation until the app is uninstalled and the deletion in section 11 completes.
• Nature of processing: collection from Shopify's Admin API and from the publicly reachable pages of the rival shops you add, storage, structured retrieval, matching and comparison, price writes to Shopify when a rule says so, alert generation, and erasure.
• Purpose: solely to deliver the app to you and keep it secure. Never for our own marketing, never for profiling, never for sale.

3. Types of personal data

Most of what the app stores is catalog, rival, matching and pricing data rather than personal data about an identifiable person: product and variant fields, rival domains and fetched prices, matches and confidence scores, rules, price observations, alerts and price changes, and job/fetch telemetry. Where personal data is processed, it is one of these kinds:

• Business-contact and account data about you and your staff: the shop's .myshopify.com domain, primary domain and store name, the Shopify OAuth access token, the merchant email address used for alerts (if any), plan and locale, install and uninstall timestamps, and the session fields Shopify supplies — staff user id, first and last name, email address, locale, account-owner/collaborator flags, and token expiry and refresh data.
• Shop configuration data: rival shops you added, products and variants mirrored from your catalog (including SKU, barcode, price, compare-at price and inventory unit cost), rules you created, and the priority flags you set. This describes your business and your prices, not your customers.
• Operational error traces: the identifiers a job needs (shop domain, job id, error text) in the container's rotating log buffer. No IP address or user agent is written to the database, and the web server keeps no access logs.

Excluded by design: customer name, email address, postal address, phone number or customer id; order, checkout and payment data; the content of a rival's pages beyond the extracted product fields; your theme code; IP addresses and user agents; and merchant API keys — the app asks you for none. The optional embeddings provider key is the operator's, not yours.

4. Categories of data subjects

The merchant and the merchant's staff and collaborators who use the app. Your storefront visitors do not appear at all: the app has no storefront component, no web pixel and no shopper-facing code. Rival product data relates to the rival shops, not to individuals.

5. Your instructions

We process personal data only on your documented instructions. Installing the app, adding the rival shops and product URLs to watch, marking priority products, and creating rules — in approve-first or automatic mode — are those instructions; the Privacy Policy describes their scope. Applying a price is carried out only under a rule you set or an approval you gave. Further or different instructions can be sent to gimbernat13@gmail.com; if one would require disproportionate effort or a change to the service, we will say so rather than silently not do it.

If EU or member-state law obliges us to process beyond your instructions, we will tell you before doing so, unless that law forbids telling you. If we believe an instruction infringes the GDPR, we will inform you.

6. Confidentiality

Access is limited to the operator, who is bound by a duty of confidentiality that survives the end of this agreement. There are no other staff. Should that change, anyone given access will be bound by an equivalent written obligation before receiving it.

7. Security measures (Art. 32)

• TLS on every connection to the app and to this website; no plaintext endpoint exists.
• The database is closed to the public internet: it accepts PostgreSQL connections only from the application server's IP address, over an encrypted connection with password authentication.
• Shopify access tokens are stored only in that database and are never logged or displayed.
• Administrative access to server and database is limited to the operator, over SSH with key authentication.
• Shopify webhooks are verified by HMAC signature before any action is taken.
• Minimum scopes: read_products, write_products, read_inventory. No read_orders, no read_customers and no protected customer data.
• Rival fetches use an identifying user agent, respect robots.txt, and are limited to one request per domain every 2 seconds and 20 concurrent requests overall.
• The web server keeps no access logs; no IP address or user agent is written to the database.

We hold no ISO 27001 or SOC 2 certification and do not claim application-level encryption at rest beyond what the hosting providers apply to their own storage.

8. Sub-processors and the embeddings relay

You give general authorisation for the sub-processors below.

OpenAI receives product titles because the optional matcher asks for embeddings; that call is part of the matching feature you use, and the app asks with its own provider key, never with an account or credential of yours. Without that key the matcher falls back to lexical scores and OpenAI receives nothing. An optional second scoring model (TypeSafe's Jev) is not active and will be added to this table before it processes anything. We remain fully liable to you for the performance of the sub-processors listed above that we do engage directly.

Changes. Before a new sub-processor starts processing, a listed one is replaced, or a hosting location moves — including embeddings or email alerts being switched on — we update this table with a new date at the top of the page. You may object on reasonable data-protection grounds by writing to gimbernat13@gmail.com; if we cannot accommodate the objection, you may uninstall the app and stop paying, with a pro-rata refund of any prepaid period through Shopify.

9. International transfers (GDPR Chapter V)

Merchant data processed through the app is stored on servers located in the United States: the application server in Boston, Massachusetts and the PostgreSQL database in Manassas, Virginia. The companies operating them are European (Hostinger International Ltd, Cyprus; netcup GmbH, Germany), but the processing takes place outside the EEA.

Those transfers rely on the Standard Contractual Clauses included in the providers' data processing terms, together with the providers' technical and organisational security commitments and the measures in section 7. The optional embeddings calls to OpenAI, and any future alert email through Resend, likewise involve processing in the United States.

The app stores no end-customer personal data, so nothing about your shoppers crosses a border. The transferred data is the store configuration, catalog mirror, rival and match data, price observations and price changes, alerts, job telemetry and access token described in section 3.

Hosting locations may change. Any such change, or a new sub-processor, is announced on this page before it takes effect, under the notice rule in section 8. Shopify's own transfers are governed by its DPA and transfer mechanisms.

10. Assistance to you

• Data-subject requests. If a data subject contacts us directly about data we process for you, we forward it and do not answer on your behalf. We help you respond, taking into account the nature of the processing and the information available to us.
• Security incidents. We notify you without undue delay after becoming aware of a personal-data breach affecting your data, with what we know: what happened, which categories of data, likely consequences, and the measures taken.
• DPIAs and prior consultation. We provide the information you reasonably need for an assessment under Art. 35 or a consultation under Art. 36.

11. Deletion at the end of the agreement

Sessions are deleted immediately on the app/uninstalled webhook, and scheduled checks for your shop are cancelled. All remaining data about your shop is deleted when Shopify sends the shop/redact webhook, 48 hours after uninstall, which deletes every row for the shop in every table, or earlier if you ask us in writing. A reinstall inside those 48 hours cancels the scheduled deletion. Database backups are taken daily and rotated after 14 days, so a deleted row can remain inside a backup until that rotation passes; backups are used only for disaster recovery and are never used to restore a deleted shop's data on request. While the app is installed, rival price observations older than 12 months and fetch errors older than 30 days are pruned daily.

12. Audit

On written request we provide the information needed to demonstrate compliance with Article 28 — the current sub-processor list, the security measures in section 7, the data model, and answers to a reasonable security questionnaire — once per twelve months, or more often after a breach affecting your data or where a supervisory authority requires it. Because the service is small and single-tenant per shop, we do not host on-site audits; where a controller's law requires an inspection, we will agree a proportionate remote alternative in good faith.

13. Order of precedence

Where this document conflicts with the Terms of Service on a matter of personal-data processing, this document wins. The GDPR wins over both.

14. Contact

gimbernat13@gmail.com. See also the Privacy Policy and the Terms of Service.