1. Parties and scope
This agreement is between you as the merchant, the controller, and [Bolagsnamn AB], company registration number [Org.nr], [Adress], the processor. It is entered into when you accept the terms of service in the app, and we record which version was accepted, when and by whom.
It covers all personal data we process for you when we provide Storeassist. Where the terms of service and this agreement differ on personal data, this agreement prevails. Terms have the meaning given in the GDPR.
2. Subject matter, duration, nature and purpose
- Subject matter: personal data in your Shopify store and in Storeassist that the features you use need.
- Duration: as long as you use Storeassist, and after that until the data is deleted under section 10.
- Nature: collection through Shopify's API and our portals, storage, reading, compilation, transfer to the accounting service you connected, sending email, and deletion.
- Purpose: invoicing and bookkeeping, B2B storefronts, customer club, purchasing and the supplier portal, stock and stocktakes, labels, reports and forecasts.
Categories of data subjects and personal data are in Annex 1.
3. Your instructions
We process the personal data only on your documented instructions. Your instructions are the terms of service, this agreement, and the settings and choices you make in Storeassist. If the law requires other processing, we tell you first unless the law forbids it.
If we believe an instruction infringes the GDPR, we tell you right away and hold that processing until you confirm or change the instruction.
4. Confidentiality
Only people who need the data to provide or maintain the service have access to it, and they have committed in writing to keep it confidential. Confidentiality continues after the agreement ends.
5. Security
We take the technical and organisational measures Article 32 requires. They are listed in Annex 2. We may improve the measures but never lower the overall level of protection.
6. Sub-processors
You give us general prior authorisation to engage sub-processors. The ones we use today are in Annex 3 and on the Sub-processors page.
- Before we add or replace a sub-processor, we email the store owner at least 30 days in advance and update the page.
- You may object on reasonable grounds before the change takes effect. If we can't resolve the objection, you may end the agreement before the change takes effect.
- Each sub-processor is bound by a written agreement with the same obligations as this one.
- We remain liable to you for a sub-processor's processing as for our own.
7. Transfers to third countries
We process and store the personal data inside the EU/EEA. If a sub-processor is based outside the EU/EEA, a transfer happens only with safeguards under Chapter V of the GDPR, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
8. Assistance
We help you meet your obligations to data subjects and under Articles 32–36:
- Erasure: when Shopify sends customers/redact, Storeassist automatically deletes the customer's invoice log for the listed orders, the link to their customer number in your accounting, and their customer club data.
- Access: customer data is shown per order, customer and member in the app. On request we produce an export in a machine-readable format within 10 business days.
- Other erasure or correction the app can't do itself, such as a single B2B buyer, we carry out on your written request within 30 days.
- If a data subject contacts us directly, we forward the request to you within 5 business days and do not answer it ourselves.
- We provide the information you need for a data protection impact assessment or a prior consultation with the Swedish Authority for Privacy Protection (IMY).
9. Personal data breaches
We notify you without undue delay and at the latest 48 hours after becoming aware of a personal data breach affecting your data. The notice goes to the store owner by email. You then have 72 hours to report the breach to IMY, if it must be reported.
The notice includes, as far as known:
- what happened, when, and how we found out,
- which categories of data subjects and data are affected, and roughly how many,
- the likely consequences,
- what we have done and propose to limit the harm,
- a contact person at Storeassist.
Anything not yet known we provide as soon as we know it. We document every breach and help you notify data subjects.
10. Deletion and return
When you uninstall Storeassist, we immediately delete Shopify sessions, accounting access keys and queued jobs, and suspend staff access. Shopify sends shop/redact 48 hours after the uninstall, and we then delete all personal data we process for you. Deleted data leaves the backups within 14 days.
If you want the data back, email us before you uninstall and we provide an export in a machine-readable format. We keep no copies unless the law requires it.
11. Audits
We give you the information needed to show that we comply with Article 28, primarily as written answers and documentation. If that is not enough, you, or an independent auditor bound by confidentiality, may audit us once a year with 30 days' notice, at your cost and without exposing other customers' data. After a breach or at an authority's request, you may audit more often.
We keep a record of processing under Article 30(2).
12. Term and liability
This agreement applies for as long as we process personal data for you. Liability between the parties follows Article 82 GDPR and the limitation of liability in the terms of service, as far as mandatory law allows. Swedish law applies.
Questions about this agreement: [kontakt@storeassist.io].
Annex 1. Processing details
| Data subjects | Personal data |
|---|---|
| Your customers | Name, email, phone, billing and shipping address, company name, registration number (for sole traders this can be a personal identity number), orders, payments, returns, refunds, Shopify customer ID and customer number in your accounting. |
| Customer club members | Customer ID, member number, points and points history, total spend, birthday if given, marketing consent and where the customer joined. |
| B2B buyers and their contact people | Company, name, email, delivery addresses with the contact person's name, phone and email, orders, hashed sign-in codes and sessions. |
| Suppliers' contact people | Name, email, phone, notes, and replies and uploaded files through the supplier portal. |
| Your staff | Name and email from the Shopify session, the name of who performed an action, and email for invitations. |
Special categories of personal data (Article 9) are not needed for the service. Do not enter such data in free-text fields such as notes.
Retention periods per data type are in the privacy policy.
Annex 2. Technical and organisational measures
Hosting and network
- The server runs in UpCloud's Stockholm data centre with physical security and access control.
- Two firewalls: UpCloud's firewall lets in only web traffic (HTTP and HTTPS), and SSH only from one approved address. The host's own firewall limits SSH attempts per source.
- SSH with keys only; root login and passwords are disabled. fail2ban blocks repeated attempts.
- Security updates install automatically every night.
- The database is reachable only from the server's internal network and is not exposed to the internet.
- Containers run without privilege escalation (no-new-privileges).
Encryption
- All traffic uses TLS. app.storeassist.io sends HSTS and cannot be framed by other sites.
- The server's disks and all backups are encrypted. The off-site copy is encrypted before it leaves the server, and the storage provider does not hold the key.
- Uploaded files, bookkeeping evidence and B2B storefront images are stored in Cloudflare R2 in the EU. Cloudflare encrypts them at rest, but not with our own key. Private files are served only through the app after an access check; B2B storefront images are public to anyone with the link.
- Access keys for Fortnox and Visma eEkonomi and two-step verification keys are also encrypted in the database with AES-256-GCM.
- Passwords are hashed with argon2id. Session tokens, sign-in codes and link tokens are 256-bit random values stored only as SHA-256 hashes.
Access in the app
- Accounts are created only by linking from Shopify or by invitation, never by open sign-up.
- Three roles: staff, admin and owner. Staff never see customers' email, phone or addresses; the server removes them before the response is sent.
- Two-step verification is required for owners and admins. New devices are confirmed with a one-time code.
- Web sessions end after 12 hours idle and 30 days at most; mobile sessions after 30 days unused and 90 days at most. Every session can be seen and ended, all at once if needed.
- Connecting or disconnecting accounting requires the owner role and a fresh sign-in within the last 5 minutes.
- Every form on app.storeassist.io checks origin and a CSRF token. Sign-in and the API are rate limited.
Separation and data minimisation
- Every database query is scoped to the signed-in store, and automated tests show that another store's ID returns "not found".
- Storeassist reads customer data from Shopify when needed and stores only what a feature requires.
- Automatic cleanup removes expired sessions, codes, invitations, old jobs and email according to the retention periods.
Logging and monitoring
- An audit log records who read or changed customer data, when, which record and which fields, but never the data itself.
- The application logs record no passwords, codes, keys, visitor IP addresses or customer data. Link tokens are removed from logged addresses.
- The app's health is checked every 15 seconds. A new version that does not become healthy is rolled back automatically.
Backups and restore
- An encrypted backup of the whole database every night, kept for 14 days on the server and as an encrypted off-site copy in Cloudflare R2 in the EU.
- Stored files are not part of the backups. Each file has a SHA-256 checksum in the database that is checked on every read, so a changed or lost file is detected.
- Restore is tested every quarter by loading a backup into a separate database and checking it.
Organisation
- Only people who need it have access to the server and production data, and access is reviewed every quarter.
- Written procedures for incident response, backups and data loss, retention and access control.
- Everyone with access is bound by written confidentiality.
- Computers used for operations have encrypted disks, screen lock and an updated operating system, and production data is not stored on them.
- Every change is tested automatically before it is deployed.
Annex 3. Sub-processors
The current list, with its change log, is on the Sub-processors page.
| Sub-processor | Task | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| UpCloud Ltd (Finland) | Server, database and nightly backups on encrypted disks in UpCloud's Stockholm data centre. | Everything Storeassist stores. | Sweden (EU) | Processed inside the EU/EEA. |
| Cloudflare, Inc. (USA) | R2 storage for uploaded files (supplier portal, imports), bookkeeping documents and B2B storefront images, and for an off-site copy of the nightly backups. Cloudflare also runs DNS for storeassist.io, but no traffic passes through Cloudflare. | The files can contain suppliers' contact details, customer data in bookkeeping documents and proformas, and payout files. Cloudflare encrypts them at rest, but not with our own key. Backups are encrypted on our server before they leave it, and Cloudflare does not hold the key. DNS handles no personal data. | EU (R2 storage) | EU Standard Contractual Clauses and the EU–US Data Privacy Framework. |
| Resend (Plus Five Five, Inc., USA) | Sends Storeassist's email: sign-in codes, invitations, notices and B2B email. No open or click tracking. | The recipient's email address and the message's subject and body. | Ireland (EU) | EU Standard Contractual Clauses. |