Data Processing Agreement

Version 2026-10-26. This agreement forms part of the Terms of Service and applies where we process personal data on your behalf under the GDPR.

1. Roles

You are the controller of your customers’ personal data. We are the processor, acting only on your documented instructions — installing the app, accepting these terms and configuring the app in the dashboard are those instructions.

2. What we process

• Order data: order number, value, payment method, status, tracking number, courier.
• Customer contact data: name, phone number, email address, delivery address (city, ZIP, street) — used to contact the customer about that order.
• Call data: recordings, transcripts and outcomes of the calls we place for you.
• Risk data: a one-way SHA-256 hash of the phone number and the resulting risk events.

3. How we protect it

• Phone numbers are stored as a hash for matching and encrypted (Fernet) when stored for audit; they are never kept in plain text.
• Street addresses are read at send time and not stored. City and ZIP code are kept only with a courier follow-up record when a parcel is stuck.
• Documents you upload are stored encrypted, are not public, and are deleted after two years.
• Access is limited to staff who need it, with two-factor authentication; every view of customer data in the dashboard is logged (kept 12 months). All transfers use TLS.
• Backups: point-in-time recovery (35 days), encrypted. Test environments use separate data.

4. Sub-processors

We use: Amazon Web Services (hosting, EU), Retell AI and ElevenLabs (voice), DIDWW (telephony), Infobip (SMS/Viber), Resend (email), Stripe (billing), Vercel (dashboard), and the tracking platform used by your fulfilment partner. We will tell you before adding a sub-processor that processes customer contact data, so you can object.

5. Shared bad-payer registry

When a parcel is returned uncollected we may add a hashed phone number and a counter to a shared cash-on-delivery registry used by participating merchants. No names, addresses, order contents or reasons are shared. You instruct us to do this; you can switch it off in settings.

6. Data subject rights

If a customer asks for access, correction or deletion, tell us and we will delete or return the data within 30 days. Shopify’s mandatory privacy webhooks (customer data request, customer redact, shop redact) are implemented and honoured automatically.

7. Retention and deletion

Order data, courier follow-ups and risk events are deleted automatically 24 months after their last activity. Call recordings and transcripts are deleted after 90 days. When you uninstall the app, all of your store’s data is deleted 48 hours later (Shopify’s shop redact request); a single customer’s data is deleted when Shopify sends a customer redact request or when you ask us.

8. Breach

We will notify you without undue delay, and in any case within 72 hours, of a personal data breach affecting your customers, with the information you need for your own notifications. Our procedure is summarised on the Security page.

9. Transfers and audits

Data is processed in the EU. Where a sub-processor transfers data outside the EEA, Standard Contractual Clauses apply. On reasonable notice we will provide the information needed to demonstrate compliance.