SalesJuice Data Processing Agreement
Last updated 19 October 2026
1. Parties and how this agreement applies
1.1 This agreement is between:
- the merchant: the business that installed SalesJuice on its Shopify store and accepted the SalesJuice Terms of Service (“you”); and
- SalesJuice: AIOOM SOLUTIONS LLC, a limited liability company, 228 Park Ave S, #897446, New York, NY 10003, United States (“we”, “us”).
1.2 It forms part of the Terms of Service, published at www.salesjuice.app/terms. This agreement is published at www.salesjuice.app/dpa. The Privacy Policy, at www.salesjuice.app/app-privacy, describes the same processing for shoppers and merchants. This agreement applies whenever we process personal data for you in providing the app.
1.3 You accept it when you accept the Terms of Service.
2. Words used in this agreement
2.1 “Personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meanings in the GDPR, and the same words have the matching meanings under the UK GDPR, Swiss data protection law and US state privacy laws.
2.2 Shopper personal data means the personal data described in Annex I that we process for you.
2.3 Sub-processor means a company we use that processes shopper personal data.
2.4 The app has the meaning in the Terms of Service.
3. Roles
3.1 For shopper personal data, you are the controller and we are your processor.
3.2 We are the controller of information about you as our customer: your store’s details and contact information, your staff’s sessions in the app, the dates the Privacy Policy §5 lists, and your messages to support. We use your store’s contact address to send you a customer data file you asked for, and to write to you about your account, this agreement and the Terms. The Privacy Policy covers that information, not this agreement.
3.3 Shopify is the platform your store runs on. It holds your store, runs checkout, runs the app’s discount functions and web pixel, and stores the metafields the app writes. You contract with Shopify directly, so Shopify is not a sub-processor we appoint.
3.4 We process shopper personal data only to provide the app to you.
3.5 Where US state privacy laws apply, we are your service provider. We do not sell or share shopper personal data as those laws define those terms; we do not retain, use or disclose it for any purpose other than providing the app to you, or outside our direct business relationship with you; and we do not combine it with personal data from another source, except as those laws allow.
4. Subject matter, duration, nature and purpose
4.1 Subject matter. Providing the app to your store: promotions that depend on who the customer is, usage limits, the storefront display, analytics and, if you switch it on, the measurement.
4.2 Duration. From installation until the deletion in section 13 is complete.
4.3 Nature. We receive data from Shopify through its API and webhooks, store it, derive each customer’s eligibility profile and usage counts from it, write that profile and your promotion settings back into your store as metafields, show customer names and emails to you in the app’s customer picker, count orders for your analytics, and erase data when Shopify asks.
4.4 Purpose. Only to provide the app to you, as Annex I part G sets out. We do not use shopper personal data for advertising, sell it, share it, use it for any store but yours, or use it to train AI models.
4.5 Annex I gives the full detail.
5. Your instructions
5.1 We process shopper personal data only on your documented instructions. Your instructions are:
- the Terms of Service and this agreement;
- the settings you choose in the app: your promotions and their conditions, whether the storefront display is on, and whether the measurement runs;
- the requests Shopify passes to us for you: data requests and erasure requests.
5.2 We may also process it where the law requires. If so, we tell you first, unless the law forbids it.
5.3 If we think an instruction breaks data protection law, we tell you, and we do not follow it until you confirm or change it.
6. Your obligations
6.1 You have a lawful basis for the processing you instruct.
6.2 Your privacy notice tells shoppers how their data is used, including by the app. Annex I and the Privacy Policy give the detail you need.
6.3 You run the consent banner for the regions you sell to. The app’s web pixel follows the consent choices Shopify records for your store. While the measurement runs, a shopper is placed in a group only when Shopify reports that they allow analytics; the other shoppers are not grouped or counted, and a shopper who withdraws consent has the group removed from their cart.
6.4 Do not put special-category data, or anything you would not want the customer to see, in customer tags or promotion names. Of a signed-in customer’s tags, only those your live promotions use appear on their page, but the customer can read their own full eligibility profile, tags included, through Shopify.
6.5 The metafields the app writes stay in your store after you uninstall, under your control. If you want them removed, write to us before you uninstall, while the app can still reach them, and we will remove them.
7. Confidentiality
7.1 Only people who need shopper personal data to provide or support the app may access it.
7.2 SalesJuice is run by one person. Only the owner can use the credentials that reach production shopper personal data. One other person can read the app’s code and, kept with it, the automated alerts, their logs and the data-request tickets, which carry store domains and shop, customer and order ids, never names or contact details. That person has no access to the production database or to those credentials, and is bound to keep confidential anything they see. Anyone we give access to in future is bound the same way first.
8. Security
8.1 We take the technical and organisational measures in Annex II.
8.2 Annex II says which measures are in place and which depend on Gadget, our hosting provider.
8.3 We may change the measures, but not so that they protect shopper personal data less.
9. Sub-processors
9.1 You authorise the sub-processors in Annex III.
9.2 Each sub-processor processes shopper personal data under its own written data protection terms with us, which limit its use to providing its service to us and require it to keep the data secure and confidential. Annex III names them.
9.3 Gadget, our main sub-processor, offers one standard agreement, which its terms incorporate on a paid plan. We take it as it is. Where it differs from this agreement, Annex III says how: for example, Gadget tells us of a breach within 48 hours, offers audit reports only “(if any)”, and commits to encryption “as appropriate”.
9.4 Before we add or replace a sub-processor, we tell you by email to your store’s contact address at least 30 days before the change. Gadget gives us 30 days’ notice of its own new sub-processors, so our notice of those can only follow Gadget’s.
9.5 You may object on reasonable data protection grounds. If we cannot meet the objection, you may uninstall the app.
9.6 We remain responsible to you for our sub-processors’ processing of shopper personal data.
10. Data subjects’ requests
10.1 Shoppers make requests to you. You pass them to us through Shopify, which sends the app one of its mandatory compliance webhooks. A request with an invalid Shopify signature is refused and nothing is recorded.
10.2 Access. For a customers/data_request:
- the app records the request and logs its ids, never contact details, and opens a ticket for us within a day, with a reminder on day 21 while it is still open;
- we assemble a data package for that customer. It holds the customer’s eligibility profile, any profile changes still waiting, the order-history notes that name them, and the customer tags stored on their orders. If any part cannot be read, no package is produced;
- the package goes to you, not to the shopper, to your store’s contact address, by an encrypted attachment or an expiring download link, with any password sent separately;
- we answer within 30 days of receiving the request.
The package does not include the app’s copies of the customer’s name, email and tags, or the copies of their orders, because you hold the originals in Shopify.
10.3 Erasure. For a customers/redact, the app:
- deletes the customer’s eligibility profile from your store and from our database;
- deletes the customer’s profile changes still waiting;
- removes the customer from every promotion limited to customers you named, including the settings checkout reads;
- clears the customer’s name, email and tags from our copy of the customer;
- clears the order-history notes that name the customer, and removes their tags from the analytics notes on their orders. Order totals do not change: they stay in your sales figures;
- removes the customer’s email and phone from the stored request once it is handled.
It keeps the copies of the customer’s orders, which are your trading history. They hold no address, email, phone, IP address or browser details.
After you uninstall, the app can still erase what we hold on a customers/redact, but it can no longer reach your
store, so it cannot delete the customer’s profile saved there.
10.4 Correction. The app copies customer data from Shopify. Correct it in Shopify and the app follows.
10.5 Other requests (restriction, objection, portability). The app has no separate tool for these. Write to us at support@salesjuice.app and we help within the same 30 days.
10.6 If a shopper writes to us directly, we tell them to contact you, and we do not answer the request ourselves unless you ask us to.
11. Other assistance
11.1 We help you with data protection impact assessments and consultations with a supervisory authority, by giving you this agreement’s annexes and answering reasonable questions about the processing.
11.2 We help you meet your security obligations through the measures in Annex II.
11.3 Annex I is our record of the processing we carry out for you.
12. Personal data breaches
12.1 A breach means any event that exposes, or may have exposed, shopper personal data, or a credential that can read it.
12.2 To you. We tell you without undue delay after we become aware of a breach that affects your store’s data. Our target is within 24 hours of confirming that your store’s data is involved. We write to your store’s contact address.
12.3 We tell you what we know, and more as we learn it:
- what happened, and when;
- what data, and roughly how many shoppers (by count, never by name);
- the likely consequences;
- what we have done and what we will do;
- what you may need to do;
- who to contact.
12.4 To Shopify. Shopify’s API Terms require us to tell Shopify of any actual or suspected breach of merchant data within 24 hours of becoming aware of it, through Shopify Support. We do.
12.5 From Gadget. Gadget’s agreement requires it to tell us of a breach within 48 hours of becoming aware of it. Our clock, and Shopify’s 24 hours, start when we become aware, which may be when Gadget tells us.
12.6 We do not notify shoppers or a supervisory authority about shopper personal data ourselves, unless you ask us to or the law requires it. That is your decision as controller.
12.7 Our incident response policy sets out how we detect, contain, assess, notify and record a breach.
13. Deletion and return at the end
13.1 When you uninstall. Shopify removes the app’s access at once. Two days later, Shopify asks us to erase your store’s data, and the app erases everything it holds for your store, shopper personal data included: the copies of your customers, orders, line items and shipping lines, the eligibility profiles, the order notes, the waiting changes, the analytics totals, your promotions and campaigns, and staff sessions. The app refuses to erase a store that has installed it again, retries a part that fails, and alerts us. Each day the app also lists stores uninstalled more than two days earlier whose erasure has not run, and we erase those by hand.
13.2 What remains after the erasure.
| What remains | For how long |
|---|---|
| Records of the data and erasure requests Shopify sent for your store: topic, ids and dates. Email and phone are removed once each is handled. | Kept as evidence that we handled your store’s data and its privacy requests as required |
| A short record of your store: its name, its domains and the dates in the Privacy Policy §5. Its contact details are cleared. | As above |
| Our hosting provider’s logs, including its record of each notification Shopify sent the app, which can include a customer’s name and email | 14 days |
| Database backups | 7 days |
| Logs of our automated failure alert at GitHub: ids and counts only | 90 days |
| Our incident records: shop and customer ids, never names | 36 months |
The salesjuice metafields in your Shopify store: promotion settings, and each customer’s eligibility profile |
Under your control; the app cannot reach them after uninstall. If you reinstall, the app rewrites its promotion settings to match what it then holds. |
13.3 Return. The originals of your shopper data are in your Shopify store. The app offers no export of shopper personal data. The Analytics screens export their figures as CSV files. We therefore delete rather than return.
13.4 On request, we confirm the erasure in writing, with the date the app recorded for it.
14. Audits and information
14.1 We make available the information you need to show that we meet Article 28 of the GDPR: this agreement and its annexes, and on request the policies behind Annex II.
14.2 We answer a reasonable written security questionnaire once a year.
14.3 If the law or a supervisory authority requires more, we allow an audit by you or an independent auditor bound by confidentiality, at most once a year, at your cost, with 30 days’ written notice. An audit may not give access to other merchants’ data.
14.4 We cannot give audit or inspection rights over Gadget or Google Cloud. Gadget’s agreement offers audit reports only “(if any)”. We pass on what Gadget gives us.
15. International transfers
15.1 Shopper personal data is stored and processed in the United States, on Google Cloud through Gadget. Gadget, a Canadian company, may access it to support its service. Information saved in your Shopify store stays with Shopify.
15.2 SalesJuice is established in the United States, not in Europe.
15.3 Where the GDPR, the UK GDPR or Swiss law requires a safeguard for a transfer from you to us, the European Commission’s Standard Contractual Clauses (Module 2, controller to processor) apply and are incorporated by reference, with the UK Addendum and the Swiss amendments where needed. For the Clauses: clause 7 (docking) is not used; under clause 9, option 2 (general written authorisation) applies, with the notice in §9.4; the option in clause 11 is not used; the supervisory authority under clause 13 is the one clause 13 names for your establishment; and under clauses 17 and 18 the Clauses are governed by the law of Ireland and disputes go to the courts of Ireland. Annex I and Annex II of this agreement serve as the Clauses’ Annexes I and II, and Annex III as their list of sub-processors.
15.4 For our transfer to Gadget, Gadget’s agreement includes the European Commission’s Standard Contractual Clauses, Modules 2 and 3.
15.5 We do not rely on the EU–US Data Privacy Framework.
16. Liability
16.1 Each party’s liability under this agreement is subject to the limits in the Terms of Service, except where the law or the Standard Contractual Clauses do not allow it to be limited.
17. Term, changes, precedence and law
17.1 This agreement lasts as long as we process shopper personal data for you, and ends when the deletion in section 13 is complete.
17.2 We change this agreement only as the Terms of Service allow for changes: at least 30 days’ notice by email to your store’s contact address, and never to protect shopper personal data less.
17.3 If this agreement conflicts with the Terms of Service on personal data, this agreement wins. If the Standard Contractual Clauses apply and conflict with either, the Clauses win.
17.4 This agreement is governed by the law that governs the Terms of Service, except that the Standard Contractual Clauses are governed as §15.3 says.
Annex I — Processing details
A. The parties
| Controller | Processor | |
|---|---|---|
| Who | The merchant: the store that installed the app | AIOOM SOLUTIONS LLC (“SalesJuice”) |
| Address | The store’s address in Shopify | 228 Park Ave S, #897446, New York, NY 10003, United States |
| Contact | The store’s contact address in Shopify | support@salesjuice.app |
| Role | Controller | Processor (and, under US state privacy laws, service provider) |
B. Categories of data subjects
- Customers of the merchant’s store who have a customer record in Shopify, whether they sign in or not.
- Guest shoppers who buy without a customer record. Their orders are copied; nothing names them.
- Storefront visitors who allow analytics, while the merchant runs the measurement. They are counted, not identified. Their cart carries a group mark.
- The merchant’s staff who use the app. The app keeps a session for each: the shop, Shopify’s session id and the role. No name or email.
C. Categories of personal data
The app does not store 26 fields about a shopper that nothing reads, and an automated check fails if any is copied again: among them the order’s billing and shipping address, email, phone, browser IP address and browser details, and the customer’s phone.
C1. In the app’s database (Gadget, United States)
| Data | Data subjects | Why |
|---|---|---|
| Customer record: first name, last name, email, customer tags, currency, a link to the last order, and Shopify’s created and updated dates | 1 | Name and email: shown to the merchant in the customer picker, to choose customers for a “specific customers” condition. Tags: tag conditions. |
| The customer’s eligibility profile (the app’s copy of C2) | 1 | Kept in step with the store |
| Orders: order id, order number; created, processed, closed and cancelled dates; cancellation reason; currency; subtotals, totals, taxes, duties, tips, shipping and discount totals; discount applications and codes used; financial and fulfilment status; payment method names; source; test flag; the cart token; the cart attributes, all of them as Shopify sends them (the app reads only its own, but an attribute the theme or another app writes is stored too, whatever it holds); and the link to the customer | 1, 2 | Count how often a promotion was used; build each customer’s order history; the merchant’s analytics |
| Order line items: product, variant, title, SKU, vendor, quantity, price, discounts, tax lines and fulfilment details | 1, 2 | Promotion use and analytics |
| Shipping lines: title, code, carrier, price, discounts, tax lines | 1, 2 | Shipping promotions and analytics |
| Order-history note per order: order id, customer id, date, total | 1 | Take an order back out of a customer’s history exactly, on a refund or cancellation |
| Analytics note per order: totals, rule ids, product ids, the customer’s tags, measurement group | 1, 2 | Keep analytics exact when an order changes |
| Promotion settings: for a promotion limited to customers the merchant names, those customers’ Shopify ids | 1 | Checkout decides whether a customer is on the list |
| Profile changes waiting to be written: customer id, segment and tag changes, orders to add or remove | 1 | A queue, emptied within minutes |
| Deleted-order marker: order id, date | 1, 2 | Stop a late update from bringing a deleted order back |
| Data and erasure requests from Shopify: topic, shop, customer id, order ids; the customer’s email and phone until the request is handled | 1 | Record the request and act on it |
| Staff session: shop, Shopify session id, role | 4 | Keep a staff member signed in |
The analytics totals hold counts and sums only: no customer id, cart, page or session identifier.
C2. Written by the app into the merchant’s Shopify store
| Data | Where | Who can read it |
|---|---|---|
| The eligibility profile: customer id, segment ids, tags, completed orders for the last 400 days (id, date, total; older orders only as a count, a total and the newest date), uses of each promotion | Customer metafield salesjuice.customer_profile |
The merchant; the app; the app’s discount functions, which Shopify runs at checkout; and the signed-in customer, who can read their own full profile through Shopify. On the storefront, the customer’s page carries only the tags the store’s live promotions use, and only each order’s date and total, and those only when a live promotion looks at past orders. |
| Promotion settings, including, for a promotion limited to named customers, those customers’ Shopify ids | Metafields on the store, its products, variants and collections | The merchant, the app and the discount functions. The settings the storefront prints carry only a code for a list, never who is on it. |
Some customers may still carry an older salesjuice.customer_tags metafield from an earlier version of the app;
the app no longer writes it. A discount code limited to particular customers is never published in these
metafields; the app gives it only to a signed-in customer who qualifies, through a request Shopify signs.
C3. In the shopper’s browser and cart
The session-storage and local-storage items and the cart attributes listed in the Privacy Policy §6.3. None is a cookie: the app’s storefront code sets no cookies. The measurement’s group and its marks are written only for a shopper who allows analytics. The group is worked out from the signed-in customer’s id, or from the cart for a guest, by a request Shopify signs; that request stores nothing.
C4. Sent by the web pixel, only for shoppers whose consent allows analytics:
- “An offer was shown”: at most once per browser per day, when the storefront showed one of the merchant’s offers. It carries the store’s domain, a per-store token and the event name. Only the first and the most recent day are recorded for the store.
- Only while the measurement runs: session started, page viewed, cart viewed, checkout started and checkout completed, each with the shopper’s group and a cart or order value; for a cart view, which promotions the cart was close to, as a promotion id and a distance band. Only daily totals are stored.
The pixel never sends a customer id, name, email, order id, list of items, page address, session identifier or Shopify’s visitor id. The receiving route drops any other field.
C5. In logs
| Log | Holds | Kept |
|---|---|---|
| The app’s own log lines | Ids (shop, customer, order) and counts. Never names, emails or addresses; an automated check enforces this on every change. | 14 days |
| Gadget’s record of each notification Shopify sends the app | The notification as Shopify sent it, which can include a customer’s name and email | 14 days |
| GitHub’s log of the failure alert job | The app’s own telemetry lines only: ids and counts | 90 days |
D. Data the app does not hold
Payment card details. In its database, no shopper address, phone number, IP address or browser details (see C5 for logs).
E. Sensitive data
None is intended. Customer tags are free text written by the merchant, and a signed-in customer can read their own tags. A merchant who writes special-category data into a tag exposes it to that customer.
F. Nature and frequency
Continuous while the app is installed. The app receives data through Shopify’s API and webhooks, stores it, derives profiles and counts, writes profiles and promotion settings back into the store, shows names and emails in the customer picker, totals orders for analytics, assembles a data package on request, and erases on request.
G. Purposes
- Decide, at checkout and on the storefront, whether a customer qualifies for a promotion.
- Count uses and enforce usage limits.
- Let the merchant find and name specific customers in a condition.
- The merchant’s Analytics screens, and the measurement if the merchant switches it on.
- Run, secure and support the app: logs and failure alerts.
- Answer data requests and erasure requests.
H. Retention
| Data | How long |
|---|---|
| The merchant’s promotions and settings; the store, catalogue, customer and order information from Shopify; analytics totals | While the app is installed. Erased after uninstall (§13). |
| Order detail inside a customer’s eligibility profile | 400 days. Older orders are kept only as a count, a total and the date of the most recent one. |
| Changes waiting to be applied to a profile or a usage count | Until applied, usually within minutes |
| A note that an order was deleted, so a late update cannot bring it back | 30 days |
| Records of privacy requests from Shopify | The shopper’s email and phone are removed as soon as the request is handled. The rest as §13.2 says. |
| The app’s log lines; Gadget’s record of each notification | 14 days |
| Database backups | 7 days |
| Logs of the failure alert at GitHub | 90 days |
| A customer data file prepared for an access request | Deleted once delivered to the merchant, and never kept past the 30-day deadline |
| Support emails | Up to 24 months after the last message in the conversation |
I. Automated decisions
A promotion decides automatically which price a customer is offered, by the conditions the merchant sets: tags, segments, order history, spend. A promotion is the merchant’s pricing choice. A discount is an extra benefit and never raises a price, so it has no legal or similarly significant effect on the shopper (Privacy Policy §8).
While the measurement runs, a shopper who allows analytics is placed in one of two groups. About one in five sees no storefront display of the app’s offers. They still receive every discount they qualify for at checkout; a discount code shown only in the storefront display is not shown to them.
Annex II — Technical and organisational measures
| # | Measure | Status | Detail |
|---|---|---|---|
| 1 | Encryption in transit | In place | Every connection to the app uses HTTPS. The app talks to Shopify over HTTPS. |
| 2 | Encryption at rest | Gadget’s | Gadget states that data is encrypted in transit and at rest; its agreement commits to encryption “as appropriate”. |
| 3 | Backups | Gadget’s | 7 days, with point-in-time recovery. |
| 4 | Holding less | In place | Among Shopify’s protected fields, only name and email are requested, not phone or address. The 26 unread shopper fields are not stored, and an automated check keeps them out. Analytics totals hold counts and sums only. The pixel sends no customer id, email, order id or page address. The profile is bounded (400 days). Exception: an order’s cart attributes are stored as Shopify sends them (Annex I C1). |
| 5 | Each store’s data kept apart | In place | Every row is keyed by store. Cross-store requests are refused, and automated checks guard it on every change. |
| 6 | Requests from Shopify checked | In place | A compliance webhook with an invalid signature is refused and nothing is recorded. The storefront requests that decide a group or reveal a code are accepted only when Shopify signs them. Staff sign in through Shopify’s session tokens. |
| 7 | Fewest Shopify permissions | In place | 11 access scopes, each measured as needed. The app writes no theme file. |
| 8 | No personal data in the app’s logs | In place | The app’s log lines carry ids and counts; an automated check enforces it. |
| 9 | Personal data in the platform’s logs | Gadget’s | Gadget keeps a record of each notification Shopify sends the app, which can include a customer’s name and email, for 14 days. |
| 10 | Test and production kept apart | In place | Two environments, each with its own database, and two Shopify apps. No script copies production data into development. |
| 11 | Credentials kept narrow | In place | Automated jobs hold narrow roles. The one production key the pipeline uses cannot read shop data, and the owner’s reporting key can run two reports and read no record. A data request uses a key created for that request and deleted at hand-over. |
| 12 | Secrets kept out of code | In place | Secret scanning with push protection. The pipeline’s production secrets live in its production environment, and the owner’s reporting key on the owner’s computer only. Data files prepared for a request are kept out of the code repository. |
| 13 | Vulnerable dependencies | In place | A blocking audit of the runtime dependencies on every change, and dependency and code-scanning alerts. |
| 14 | Staff access limited | In place | Production customer data, and the credentials that reach it, are the owner’s alone. The one other person with access to the code also sees the ids in the alerts and data-request tickets kept with it (§7.2). |
| 15 | Strong passwords and two-step sign-in | In place | Generated, unique passwords; two-step sign-in on every account that reaches customer data, and on the email and password manager behind them; full-disk encryption on every computer used. |
| 16 | Access log | Partly in place | Each run of the data-request tool logs its start and end, with ids only, and refuses to read production data without that log. |
| 17 | Incident response | In place | A written incident response policy: grading, containment by kind, Shopify within 24 hours, merchants without undue delay, and a record of each incident. Rehearsed on paper. |
| 18 | Detection | In place | An automated failure alert reads production logs and opens an issue for us, including for a failed erasure. Secret scanning, dependency and code-scanning alerts. |
| 19 | Customer erasure | In place | §10.3. |
| 20 | Store erasure | In place | §13.1. Seen working on a real erasure request from Shopify. |
| 21 | Contact details removed from request records | In place | Email and phone are removed once a request is handled. |
| 22 | Retention limits | In place | Annex I H. |
| 23 | Recovery from a bad release | In place | A rollback procedure, rehearsed on production. |
| 24 | The owner’s computer | In place | Full-disk encryption, screen lock, automatic updates. A data file prepared for a request is kept outside the code repository and deleted after hand-over. |
| 25 | Confidentiality of people with access | In place | §7.2. |
Annex III — Sub-processors
| Sub-processor | Location | What it does | Shopper data it can reach |
|---|---|---|---|
| Gadget Software Inc. | Canada (company); data stored on Google Cloud in the United States | Hosts the app’s servers, database, background jobs and logs, under Gadget’s Data Processing Addendum. Differences from this agreement: breach notice within 48 hours; 30 days’ notice of new sub-processors with a right to object; return or destruction within 90 days of the end of Gadget’s service; audit reports “(if any)”; encryption “as appropriate”; transfers under the Standard Contractual Clauses, Modules 2 and 3. | Everything in Annex I C1 and C5 |
| Google Cloud, through Gadget | United States | Gadget’s infrastructure | Everything Gadget holds, under Gadget’s agreement |
| GitHub, Inc. | United States | Hosts the code, and runs the automated failure alert, which reads recent production log lines and keeps only the app’s own failure lines | Kept: shop, customer and order ids (Annex I C5) |
| Microsoft Corporation (Microsoft 365) | United States | Our email, including support@salesjuice.app | Only what a merchant chooses to send us. We never need shopper data to help, and we ask merchants not to send it. |
Gadget’s own sub-processors, by reference: Gadget lists them in its privacy policy, and its agreement points to that list as current.
Not a sub-processor. Shopify, the merchant’s own platform (§3.3).
No analytics, advertising, email-marketing or tracking provider receives shopper data, and no AI provider does.