Data Processing Agreement

These are the processor terms required by Article 28(3) GDPR. They form part of the Terms of Service and take effect when you install the app — you do not need to sign or return anything. If your organisation requires a countersigned copy, email gimbernat13@gmail.com and we will provide one.

1. The parties

Controller: you, the merchant that installed the app.
Processor: Capyo, operated by an individual developer.

This split covers the data listed in section 3. For Capyo's own account, plan, billing and support correspondence with you, Capyo is an independent controller rather than your processor; the Privacy Policy, section 1, describes that side.

Operator legal name and address: see the Privacy Policy.

Shopify is a separate processor for you, under Shopify's own data processing addendum, which governs the Shopify-to-merchant relationship and is unaffected by this document. Store data we process reaches us through Shopify; a product image whose alt text is being written is sent to OpenAI, and a free-tool lead is held by Cloudflare, as described in section 8.

2. Subject matter, duration, nature and purpose

• Subject matter: providing the Capyo: Accessibility WCAG EAA Shopify app — the page set, the axe-core scans, the findings list, the catalog of code-level fixes with preview and revert, the AI alt-text queue, the Prüfbericht and the generated accessibility statement, the storefront widget, the regression alerts, and the free public check.
• Duration: from installation until the app is uninstalled and the deletion in section 11 completes.
• Nature of processing: collection from Shopify's Admin API and from the pages in your page set, storage, structured retrieval, transmission of a product image to OpenAI, generating a PDF and a statement, writing accepted alt text through Shopify's Files API, and erasure.
• Purpose: solely to deliver the app to you and keep it secure. Never for our own marketing, never for profiling, never for training models, never for sale.

3. Types of personal data

Most of what the app stores is store configuration, page-set and scan data, findings, fix states, alt-text job data and generated documents rather than personal data about an identifiable person. Where personal data is processed, it is one of these kinds:

• Business-contact and account data about you and your staff: the shop's .myshopify.com domain, storefront domains, the Shopify OAuth access token, plan and locale, contact email, install and uninstall timestamps, and the session fields Shopify supplies — staff user id, first and last name, email address, locale, account-owner or collaborator flags, and token expiry and refresh data.
• Shop configuration and scan data: the page set you scan, per-scan and per-page status and counters, findings (rule id, impact, WCAG criterion, selector and a snippet of at most 400 characters), fix states, preview tokens, reports and statement fields. This describes your store and your scans, not your customers.
• Alt-text job data: the image's Shopify file id and URL, the previous alt text, the generated text and any edit you made. The image itself lives in your own Shopify Files; the app stores ids and URLs.
• Product images sent to OpenAI: the image and the app's prompt are transmitted to OpenAI so it can return a generated alt string. Product images only — no merchant personal data and no customer personal data.
• Optional storefront password: if you enter one so a password-protected store can be scanned, it is stored in the database, never logged, and used only to reach your own storefront.
• Operational error traces: the identifiers a job needs (shop domain, scan id, error text) in the container's rotating log buffer. No access logs are kept and no IP address or user agent is written to the database.

Excluded by design: customer name, email address, postal address, phone number or customer id; order, checkout and payment data; shopper IP addresses, user agents or per-shopper widget usage; the full HTML of your pages or your theme code; screenshots; and merchant AI-provider keys — the app asks you for none. The OpenAI key is the operator's.

4. Categories of data subjects

The merchant and the merchant's staff and collaborators who use the app. Your storefront visitors do not appear in the app at all: the storefront embed is anonymous, the widget keeps a shopper's adjustments in that browser's localStorage only, and the app holds no shopper identifier. The free public check processes a URL and, only if you submit an email to unlock a result, an email hash and the checked domain — that is covered by the Privacy Policy, section 6.

5. Your instructions

We process personal data only on your documented instructions. Installing the app, building and editing the page set, enabling a fix, generating and accepting alt text, creating a report and publishing or unpublishing the statement are those instructions; the Privacy Policy describes their scope. Sending a product image to OpenAI is carried out to write the alt text you asked for, with the operator's key. Further or different instructions can be sent to gimbernat13@gmail.com; if one would require disproportionate effort or a change to the service, we will say so rather than silently not do it.

If EU or member-state law obliges us to process beyond your instructions, we will tell you before doing so, unless that law forbids telling you. If we believe an instruction infringes the GDPR, we will inform you.

6. Confidentiality

Access is limited to the operator, who is bound by a duty of confidentiality that survives the end of this agreement. There are no other staff. Should that change, anyone given access will be bound by an equivalent written obligation before receiving it.

7. Security measures (Art. 32)

• TLS on every connection to the app and to this website; no plaintext endpoint exists.
• The database is closed to the public internet: it accepts PostgreSQL connections only from the application server's IP address, over an encrypted connection with password authentication.
• Shopify access tokens and any storefront password are stored only in that database and are never logged or displayed.
• Administrative access to server and database is limited to the operator, over SSH with key authentication.
• Shopify webhooks are verified by HMAC signature before any action is taken; app-proxy requests are verified by Shopify's proxy signature; embedded routes verify the session token.
• Every gated action is checked on the server, not only in the UI — a risky fix cannot reach live without passing through preview.
• Minimum scopes: read_products, write_products, write_files, read_themes, read_content. No read_orders, no read_customers and no protected customer data.
• The OpenAI key is held as a server environment secret, belongs to the operator, and is never requested from or shown to merchants.
• No page body, screenshot, token or storefront password is written to a log line; no IP address or user agent is written to the database.

We claim no formal security standard (no ISO 27001, no SOC 2) and do not claim application-level encryption at rest beyond what the hosting providers apply to their own storage.

8. Sub-processors and the providers

You give general authorisation for the sub-processors below.

OpenAI receives a product image and the app's prompt because you asked the app to write alt text; the app always calls it with the operator's own key, never with an account or credential of yours. Every provider lives behind one adapter, and a provider that is not configured is never called. We remain fully liable to you for the performance of the sub-processors listed above that we do engage directly.

Changes. Before a new sub-processor starts processing, a listed one is replaced, or a hosting location moves, we update this table with a new date at the top of the page. You may object on reasonable data-protection grounds by writing to gimbernat13@gmail.com; if we cannot accommodate the objection, you may uninstall the app and stop paying, with a pro-rata refund of any prepaid period through Shopify.

9. International transfers (GDPR Chapter V)

Merchant data processed through the app is stored on servers located in the United States: the application server in Boston, Massachusetts and the PostgreSQL database in Manassas, Virginia. The companies operating them are European (Hostinger International Ltd, Cyprus; netcup GmbH, Germany), but the processing takes place outside the EEA.

Those transfers rely on the Standard Contractual Clauses included in the providers' data processing terms, together with the providers' technical and organisational security commitments and the measures in section 7. The product images sent to OpenAI, and the free-tool lead held by Cloudflare, likewise involve processing in the United States.

The app stores no end-customer personal data, so nothing about your shoppers crosses a border. The transferred data is the store configuration, page set, scan and finding data, fix states, alt-text job data, reports, statement fields and access token described in section 3, plus the product images described there.

Hosting locations may change, including a move to an EU region. Any such change is announced on this page before it takes effect, under the notice rule in section 8. Shopify's own transfers are governed by its DPA and transfer mechanisms.

10. Assistance to you

• Data-subject requests. If a data subject contacts us directly about data we process for you, we forward it and do not answer on your behalf. We help you respond, taking into account the nature of the processing and the information available to us.
• Security incidents. We notify you without undue delay after becoming aware of a personal-data breach affecting your data, with what we know: what happened, which categories of data, likely consequences, and the measures taken.
• DPIAs and prior consultation. We provide the information you reasonably need for an assessment under Art. 35 or a consultation under Art. 36.

11. Deletion at the end of the agreement

Sessions and queued jobs are deleted immediately on the app/uninstalled webhook, the statement URL returns 404 within one request, and scheduled jobs for your shop are cancelled. All remaining data about your shop is deleted when Shopify sends the shop/redact webhook, 48 hours after uninstall, which deletes every row for the shop in every table, or earlier if you ask us in writing. A reinstall inside those 48 hours cancels the scheduled deletion and keeps the page set, fixes, reports and statement. Scans, scan pages, findings and usage events age out on the retention in the Privacy Policy, section 9. Alt text already written to your product media stays in your own Shopify data. Database backups are taken daily and rotated after 14 days, so a deleted row can remain inside a backup until that rotation passes; backups are used only for disaster recovery and are never used to restore a deleted shop's data on request.

12. Audit

On written request we provide the information needed to demonstrate compliance with Article 28 — the current sub-processor list, the security measures in section 7, the data model, and answers to a reasonable security questionnaire — once per twelve months, or more often after a breach affecting your data or where a supervisory authority requires it. Because the service is small and single-tenant per shop, we do not host on-site audits; where a controller's law requires an inspection, we will agree a proportionate remote alternative in good faith.

13. Order of precedence

Where this document conflicts with the Terms of Service on a matter of personal-data processing, this document wins. The GDPR wins over both.

14. Contact

gimbernat13@gmail.com. See also the Privacy Policy and the Terms of Service.