Data Processing Agreement

This agreement is between the merchant who installs the StoreA Pro app on a Shopify store (the merchant) and the provider of StoreA Pro: Mehdi El Marrakchi, sole proprietor (freelance), Morocco, contact support@storea-pro.com (StoreA Pro).

It forms part of our Terms of Service. By installing or using the app, the merchant accepts it.

• For the personal data of the merchant's customers, the merchant is the controller and StoreA Pro is its processor.
• StoreA Pro processes this data only to provide the app and on the merchant's documented instructions, given through the app settings and this agreement. It does not use it for its own purposes and does not sell it.
• For data about the merchant itself (store, contacts), StoreA Pro acts under its own Privacy Policy.

Abandoned checkouts (sent by Shopify when a checkout is created or updated): customer ID when the buyer is signed in, email address, cart contents and checkout link. Purpose: cart reminder notifications in the merchant's mobile app.

Orders (sent by Shopify when an order is paid or fulfilled): customer ID, first name and order details. Purpose: order notifications on the customer's devices. They are processed when received and not stored on our servers.

Customer sign-in and account deletion: the customer's Shopify sign-in token is checked by our server to give the app access to the merchant's Firebase project, and an account deletion request made in the app is sent to Shopify. The token is not stored. When a deletion cannot be completed on Shopify, the customer's email address is kept (as is or as a hash) to block the deleted account in the app.

Devices and preferences (in the merchant's own Firebase project): notification token, operating system, language, notification and marketing consent, wishlist, usage statistics and crash reports. Purpose: notifications, app features and app quality. StoreA Pro's server reads devices to send notifications, only to those whose settings allow it (marketing notifications require the customer's consent).

Store data: store domain, Shopify access tokens, app configuration, the information needed to publish the app on the Apple App Store and Google Play (contact person, trader details, reviewer demo account), and the merchant's Firebase service account key, stored encrypted.

Catalogue, cart and checkout are handled by Shopify directly between the app and the store. Payment details never reach StoreA Pro.

• Hetzner Online (Finland): server hosting and encrypted backup storage.
• Google Firebase (region chosen by the merchant): notifications, database, statistics and crash reports, in the merchant's own Firebase project.
• Shopify (Canada): the platform the store runs on; StoreA Pro accesses store data through its APIs.
• Resend (Ireland): emails sent to the merchant about the publication of its app.

StoreA Pro is operated from Morocco, from where its provider accesses the servers remotely. Before adding or replacing a sub-processor, StoreA Pro updates this page; the merchant may object by contacting support@storea-pro.com and may uninstall the app.

• Only the provider of StoreA Pro has access to the servers and the database. Any person given access in the future will be bound by confidentiality.
• Encryption in transit (HTTPS/TLS), encrypted backups, encryption of the Firebase service account keys.
• Restricted network access, key-based server access, two-factor authentication on all provider accounts, read-only database access for human access, and a database access log.
• Internal incident response and data loss prevention procedures, reviewed every year.

• Abandoned checkouts: 90 days at most, then deleted automatically.
• Notification history (no personal data): 90 days.
• Emails kept to block deleted accounts: while the app is installed on the store.
• Database access log: 90 days.
• Uninstalling the app: the store's Shopify access is removed at once, and the store's data, including its customers' data, is deleted from the app's database when Shopify sends its deletion request, about 48 hours after uninstalling.
• App store publication requests (contact person, trader details) are kept in our publication back office after uninstalling, until the merchant asks for their deletion at support@storea-pro.com.
• Encrypted backups: deleted data disappears from them within 30 days.
• Server images: 7 days; one long-term server snapshot from July 2026.
• Data in the merchant's Firebase project stays under the merchant's control.

StoreA Pro helps the merchant answer its customers' requests (access, deletion, and other rights under applicable law). Data requests and deletion requests sent by Shopify for a customer are handled automatically or within a reasonable time, and the merchant can ask for help at support@storea-pro.com.

StoreA Pro informs the merchant without undue delay after becoming aware of a personal data breach affecting its data, with the information available on the nature of the breach, the data and customers concerned and the measures taken, and then assists the merchant in its own obligations. Shopify is also informed, as its terms require.

StoreA Pro may update this agreement to reflect changes in its processing; the date above shows the current version. Questions: support@storea-pro.com.