Data Processing Addendum for SwiftFlow

Effective: October 18, 2026

This Data Processing Addendum ("DPA") applies between SwiftFlow ("we", "us") and each merchant ("you") that installs the SwiftFlow: Local Delivery application (the "App") on a Shopify store. It forms part of the terms under which you use the App, and it takes effect when you install the App. Our Privacy Policy describes the same processing in more detail.

1. Roles

For personal data about your customers, prospective customers and store visitors ("Customer Personal Data"), you are the controller and we are your processor. We process Customer Personal Data only to provide the App to you, on your documented instructions. Your instructions are the App's features as you configure them, and the data and deletion requests Shopify sends us on your behalf.

2. Details of Processing

• Purpose: checking whether an address or postcode is inside your delivery zone and showing the delivery day; sending the one waitlist email and the abandoned-checkout reminders you switch on; tagging orders with their promised delivery day; and showing you reports and measurements.
• Data subjects: shoppers who check delivery, join your delivery waitlist, start a checkout or place an order.
• Personal data: email address, Shopify customer ID, marketing consent given at checkout, shipping address and its coordinates, cart contents and totals, checkout link, order IDs, amounts and statuses, the delivery day, time window, delivery method (local delivery or store pickup), pickup location, pickup day and pickup time window chosen for a cart or order, and its test group, and the postcode district of waitlist entries. IP addresses are used only as keyed codes for rate limiting. We do not process payment details, phone numbers, billing addresses or special categories of personal data.
• Duration: while the App is installed, and until the data is deleted as described in section 8.

3. Our Obligations

• We do not sell Customer Personal Data or use it for any purpose other than providing the App to you.
• Only personnel who need access to run and support the App can access Customer Personal Data, and they are bound by confidentiality.
• We help you answer your customers' requests. When Shopify sends a customer data request, we prepare an export you can download in the App for 30 days. When Shopify sends a customer or store deletion request, we delete the data.
• On request, we give you the information you reasonably need for a data protection impact assessment or a regulator's enquiry about the App.

4. Security

• All traffic to the App is encrypted with HTTPS.
• The database runs on encrypted storage and is reached only over our hosting provider's private network.
• Requests from Shopify are verified as coming from Shopify before they are processed.
• IP addresses, postcode cache keys, cart identifiers used for measurement and email addresses that must not be emailed again are stored only as keyed codes.
• Our logs record event types and record IDs, not email addresses or the data Shopify sends us.
• Each time your staff view or download Customer Personal Data in the App, we record the staff member's Shopify user ID, the page, the time and how many records were shown. These records are kept for 12 months, and you can see them in the App under Access log.
• Staff accounts with access to production systems use strong, unique passwords and multi-factor authentication.

5. Sub-processors

You authorise us to use these sub-processors:

• Fly.io: hosts the App and its database, in the United States.
• Google Maps Platform (Geocoding API): converts addresses and postcodes to map coordinates.
• Resend: sends waitlist, reminder and report emails.
• OpenAI: on the Pro plan, drafts reminder text from product titles and your reminder message. It does not receive the shopper's email, name or address.
• Tigris: stores our encrypted daily database backups, in the United States. The backups are encrypted before they leave our database server, and Tigris cannot read them.

Each sub-processor is bound by data protection terms that protect Customer Personal Data at least as well as this DPA. We will update this page at least 30 days before adding or replacing a sub-processor. If you object, you may uninstall the App, and your store's data will be deleted as described in section 8.

6. International Transfers

Customer Personal Data is stored in the United States. Where data protection law requires it for personal data from the European Economic Area, the United Kingdom or Switzerland, transfers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), including in our terms with sub-processors.

7. Personal Data Breaches

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data, we will notify you without undue delay and no later than 72 hours after becoming aware of it. We will tell you what happened, the data affected, and the steps we have taken, and we will notify Shopify where Shopify's terms require it.

8. Retention and Deletion

We keep Customer Personal Data only for the periods in section 4 of our Privacy Policy: for example, abandoned checkout details are removed 90 days after the checkout's last activity, and delivery waitlist entries after 12 months or 30 days after their one email is sent. When you uninstall the App and Shopify then asks us to erase your store's data, we delete it, keeping only the keyed codes the Privacy Policy lists. Encrypted database backups are kept for 30 days, so deleted data can remain in a backup until it expires; if we restore one, we repeat every deletion made since it was taken before the App uses the data again.

9. Audits

On written request, we will provide the information reasonably necessary to show that we meet this DPA. We do not currently hold a third-party security certification.

10. Precedence and Changes

If this DPA conflicts with other terms between us about the processing of Customer Personal Data, this DPA prevails. We may update this DPA to reflect changes in the App or in law; the effective date above shows the current version.

11. Contact

For questions about this DPA, or to report a security concern, email hello@logiclooms.io.