TreStack Checkout data processing agreement

Roles

TreStack Checkout keeps survey answers and upsell order records and receives analytics events from your checkout, so it processes some personal data about your store's customers. For that data you are the controller and TreStack is the processor, and we process it only to run the app you installed, only on your instruction, and never for our own purposes. For our own account and billing records about your store, we are the controller, and the Checkout privacy policy covers those.

This agreement forms part of the TreStack Checkout terms and conditions. Installing the app accepts it. If your organisation needs it as a countersigned document, write to us and we will sign one.

Scope and duration of processing

Processing lasts for as long as the app is installed, and ends when Shopify's shop redaction, sent 48 hours after uninstall, deletes your store's data.

Subject matter

Running TreStack Checkout on your Shopify store: showing your blocks, upsells, gifts, post-purchase offers, and surveys, running your payment, shipping, and validation rules, counting upsell results for your analytics, keeping the survey answers you asked for, and billing your plan through Shopify.

Categories of data

Survey answers, with the order id and number, and the order's email address only if you turn on Keep buyers' email addresses with survey answers. For orders with upsells or post-purchase offers, the order id and number and the products, quantities, and revenue of those offers. Web pixel events (upsell seen, added, or bought) with upsell, product, and order ids, product title, price, currency, and a timestamp. A signed-in customer's tags, read only to decide whether a custom input shows, and not stored. Your store's contact email and name, the reply email you may give with feedback, and what you write in the live chat in the app admin, with your store's myshopify domain and plan.

Data subjects

Your buyers who answer a survey, buy an upsell or post-purchase offer, or whose browsers send pixel events, and you and your staff who use the app admin, send feedback, or use the live chat.

Not processed

Payment data. Buyer names, phone numbers, and addresses are not stored: rules and blocks use them only to decide whether they apply, inside Shopify's Functions or the buyer's browser, and order webhooks carry only the order id. What buyers type into checkout inputs is saved in your own Shopify order data, not by the app. The pixel runs only for buyers who allowed analytics.

Special categories

None are needed. What a survey asks is up to you, so do not ask for sensitive personal data.

Sub processors

You authorise the sub processors below. The Checkout privacy policy carries the same list and is the live copy. We remain responsible for their performance. If we add or replace one, we will date the change in the privacy policy and announce it inside the app before it goes live, which gives you the chance to object by uninstalling.

Shopify

The platform the app runs on. It sends the store and order data described above, runs the app's Functions and checkout extensions, and bills your plan.

Onidel Cloud

Hosts the server the app, its database, and its cache run on, in the United States, operated by the studio.

Cloudflare

Sits in front of cplus.trestack.app and passes requests to that server. Its R2 storage holds the backups, which are encrypted before upload, so Cloudflare cannot read them.

Chaport

Runs the live chat inside the app admin, never in your checkout. It receives your store's myshopify domain and plan, and the messages you and your staff write in the chat.

Transfers

We operate the app from Vietnam, and data is hosted in the United States, on the server named in the privacy policy. Where personal data from the European Economic Area, the United Kingdom, or Switzerland reaches it, the transfer relies on the European Commission's Standard Contractual Clauses or another lawful mechanism.

Security measures

The measures below are the ones we actually run. We hold no security certification and do not claim one.

• Every connection uses HTTPS, with Cloudflare in Full strict mode
• The access tokens Shopify issues are encrypted by the app before they are stored, and deleted when you uninstall
• The database itself is not yet encrypted at rest: encrypting the server volume it lives on is planned and not in place today
• No customer fields are requested from Shopify's order webhook, only the order id
• Every request from Shopify is checked against Shopify's signature, and every request from a checkout block against Shopify's session token
• Server logins by SSH key only, and two-factor authentication on every account with access to production or merchant data
• Logs never carry access tokens, session tokens, or buyers' emails, and the request log never holds request bodies or query strings
• Nightly database backups, encrypted on our server before upload to Cloudflare R2, kept for 30 days, and restored as a test every month. There is no continuous transaction log backup yet, so up to a day of data can be lost

Assistance, audits, and breach notification

We handle Shopify's privacy webhooks: a customer data request is shown to you in the app with the customer's orders that have survey answers, so you can export them and answer the customer; a customer redaction deletes that customer's survey answers, by their orders and by their email address; and a shop redaction deletes all of your store's data. We will help by hand where your case falls outside those, and we will answer reasonable written security questionnaires. We do not offer on site audits.

If we become aware of a personal data breach affecting your store's customers, we will tell you without undue delay and within 72 hours, with what we know, what we are doing, and what you may need to tell your own customers.

Deletion and return

While the app is installed, raw analytics events are deleted after 90 days; daily statistics and upsell order records are kept until uninstall; survey answers are kept until you delete the survey or a redaction request removes them. On uninstall the access token is deleted at once, and the app's blocks, rules, and offers stop, because nothing was added to your theme. The shop redaction Shopify sends 48 hours later deletes all of your store's data. Backups roll off within 30 days of that. Before you uninstall, you can export survey answers with Export CSV, or write to us to ask for deletion sooner.