Data Processing Addendum

Souvely: Commerce Intelligence · Version ci-dpa-v1.0-2026-10-21 · Last updated: October 21, 2026

This DPA is for Commerce Intelligence only. The Returns & Exchanges DPA is a separate document.

1. Scope and order of precedence

This Data Processing Addendum (“DPA”) forms part of the Merchant Terms for Souvely: Commerce Intelligence (the “App”) between the merchant (“Controller”, “you”) and Souvely (“Processor”, “we”). It applies when we process personal data on your behalf in providing the App. The Privacy Policy describes processing more generally. If this DPA conflicts with the Merchant Terms on processor topics, this DPA controls.

2. Roles

You determine the purposes and means of processing store data through the App (controller). We process that data on your documented instructions as processor, except where law requires otherwise or where we act as an independent controller for App security, shop-level billing records, and Shopify compliance obligations.

3. Instructions

You instruct us to process data solely to provide, maintain, secure, and support the App features you use: syncing order economics, storing costs you enter, showing estimates and alerts, storing recommendation and experiment-plan drafts, answering advisor questions from shop data, and handling Shopify compliance webhooks. We will not process that data for unrelated advertising, and we will not use it to change Shopify discounts. If an instruction appears unlawful, we may refuse and notify you.

4. Confidentiality

We ensure personnel authorized to process personal data are bound by confidentiality obligations and access data only as needed to operate the App.

5. Security

We implement reasonable measures appropriate to the risk, including:

TLS/HTTPS for App traffic in transit
Merchant admin authentication through Shopify
Read-only Shopify scopes for products, orders, discounts, and inventory, and no read_customers scope
Application and database hosting on Heroku with Heroku Postgres
Access limited to operators who need it to run the App

We do not claim a SOC 2 or ISO certification, or a specific encryption-at-rest product, in this DPA. Measures may change. A material reduction will not be made without considering the effect on security.

6. Subprocessors

You authorize these subprocessors for the App:

Shopify Inc. and affiliates — Admin API reads for products, orders, discounts, and inventory
Heroku (Salesforce) — application hosting
Heroku Postgres — application database
An OpenAI-compatible chat provider — only if Souvely has explicitly enabled and approved paid advisor API calls for that deployment. Those calls are off by default. When they are on, a merchant question and the shop evidence used to answer it may be sent to that provider.

We will impose data-protection obligations on subprocessors that are, in substance, no weaker than this DPA, and we remain responsible for their processing for the App. A material addition will be reflected by updating this DPA’s version.

7. Assistance with data subject rights

We will assist with reasonable requests to fulfill data subject rights by cooperating with Shopify’s customers/data_request, customers/redact, and shop/redact webhooks. Store customers should contact you first. You remain responsible for verifying identity and deciding the response. A data request for this App reports order-economic records and states that customer contact fields are not stored.

8. Personal data breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting App personal data we process for you, and provide information reasonably available to help you meet your own notification duties. This DPA does not promise a fixed number of hours unless the law requires one.

9. International transfers

Personal data may be processed in the United States and other countries where we or our subprocessors operate, including the regions used for the Heroku database. Where a transfer tool is required, the parties will use an appropriate mechanism. Pending verification: signed Standard Contractual Clauses are not attached to this page. They can be executed separately once Souvely’s legal entity details are confirmed.

10. Deletion and return

On uninstall or Shopify shop/redact, we delete shop-owned ledger, cost, alert, recommendation, advisor-log, experiment-draft, billing, and session records, as implemented in the App’s cleanup, except where retention is required by law, dispute, or security. On customers/redact, we delete economic records for the orders listed in the webhook. We do not promise a calendar-day deletion SLA beyond that implementation and Shopify’s webhook timing. “Return” of data means a reasonable export or a description of what is held, not a separate archive service.

11. Audits

Upon reasonable written request no more than once per year, unless an authority requires more, we will provide information reasonably necessary to demonstrate compliance with this DPA, including this schedule. Routine on-site audits are not offered for this multi-tenant app. Where the law requires another form of evidence, we will discuss it in good faith.

12. Liability

Liability under this DPA is subject to the limitations in the Merchant Terms, except where data-protection law does not allow that limit.

13. Term

This DPA lasts while we process personal data for the App on your behalf. Confidentiality, deletion, and liability provisions survive termination.

Schedule A — Processing details (Commerce Intelligence)

This schedule matches the App as of the version date. It does not add fields the product does not store.

A.1 Subject matter and duration

Operation of Souvely: Commerce Intelligence for the merchant’s Shopify store, for as long as the App is installed and until deletion as described above.

A.2 Nature and purpose of processing

Sync order, line, discount, and refund economics into a contribution ledger
Store unit cost from Shopify inventory when present, and costs the merchant enters
Show product views, alerts, recommendations, and a simulator
Store experiment plans as drafts, without creating Shopify discounts
Log advisor questions and answers
Send a question and shop evidence to a model provider only if paid advisor calls are explicitly enabled
Handle Shopify compliance webhooks and uninstall cleanup

A.3 Types of personal data

Shop domain and merchant admin session context
Order identifiers, order name, currency, money totals, financial status, and processed or cancelled times
Line-item product and variant identifiers, SKU, title, quantities, and allocated discounts
Discount application type, title, code, and allocation
Refund and adjustment totals linked to an order
Inventory unit cost, when Shopify provides it, and merchant cost entries
Alert rules, recommendation records, experiment plan drafts, and advisor question logs
Customer name, email, phone, and street address: not requested and not stored for this App

A.4 Categories of data subjects

Merchant staff who use the Shopify admin
Store customers only insofar as an order’s economic record can be tied back to an order in Shopify. The App does not keep a customer contact profile.

A.5 Retention

Records are kept while the merchant uses the App. Customer redact deletes the listed orders’ economic rows. Shop redact and uninstall delete shop-owned App data. There is no separate “delete after N days of inactivity” job beyond those events.

A.6 Contact for processor

support@souvely.com. Legal entity name and registered address are not published on this site.