Data processing addendum
This addendum is part of our terms of service. It covers the personal data of your shoppers that Super Useful handles for your store. Questions: support@superuseful.io.
Roles
You, the merchant, are the controller of your shoppers' personal data. We are your processor: we handle it only for you. Where this addendum and the terms differ about personal data, this addendum applies.
What we process
Only the data of the tools that you turn on, for example your shoppers' names, emails, orders, reviews and points. Our privacy policy lists it for each tool, and says how long we keep it.
Your instructions
We process the data only to run the tools that you turn on, as you set them up. These are your instructions. We never sell the data, and never use it for our own purposes. If an instruction seems to break the law, we tell you. If the law makes us use the data in another way, we tell you first, unless the law forbids it.
Confidentiality
Only the two owners of Super Useful can access the data, and they keep it confidential.
Security
- Data is encrypted in transit and at rest. Backups are encrypted, and only the owners hold the key.
- Access needs strong passwords and two-factor sign-in.
- Our systems log who accesses them, and get security updates every day.
- We keep only the data that a tool needs, and delete it on time.
Service providers
We use service providers (sub-processors) for:
- Hosting and backups.
- Email delivery, for the emails that the app sends to your shoppers.
- File storage, for review photos.
- Fonts, which your shoppers' browsers load.
- AI, for text and image tasks. It gets only store content, such as product images, never shopper data.
Each provider gets only the data that its task needs, under data protection terms like these. We tell you before we add a new kind of provider. If you object, write to us. If we cannot solve it, you can uninstall the app.
Ad platforms
When you connect Meta, Google Ads or TikTok in Ad tracking, the app sends your store's purchases to them on your instruction. They are not our providers: your own terms with each platform apply. The app does not send a purchase when the shopper declined tracking or opted out of the sale of their data.
Your shoppers' requests
Shopify sends us the requests that your shoppers make to your store. When Shopify asks us to delete a shopper's data, the app deletes it. When Shopify asks for a copy, we send you what we hold about the shopper. If a shopper writes to us, we tell you. We help with other requests where we can.
Breaches
If we learn of a breach that affects your shoppers' data, we tell you without undue delay, and within 72 hours. We say what happened, which data it affects and what we do about it, and we help you with the notices that you must give.
Where the data is
Our server is in the US. Some providers may process data in other countries. Where the law needs safeguards for this, such as standard contractual clauses, we use them.
Checks
We answer your reasonable questions about how we protect the data, so you can check that we keep this addendum, and we help with the assessments that the law asks of you.
At the end
48 hours after you uninstall the app, Shopify asks us to delete your store's data. The app then deletes it, with your shoppers' data. Backups are deleted after 31 days.