Data Processing Addendum
Version 1.0, 2026-10-18. This addendum forms part of the terms for every Small Gears app a merchant installs.
1. Parties and roles
The merchant installing the app is the controller. Small Gears, operated by Raul Tuozzo (NIF 04791273M), Calle del Marqués de Viana 82, 28039 Madrid, Spain, is the processor. We process personal data only on the merchant's documented instructions, which are: to provide the app as described in its listing and settings.
2. Details of processing (GDPR art. 28(3))
| Subject matter | Providing the installed app. |
|---|---|
| Duration | While the app is installed, plus up to 48 hours after uninstall until Shopify's deletion request. |
| Nature and purpose | Reading store configuration through the Shopify Admin API, analysing it with deterministic code, storing results to show the merchant. No automated decisions about individuals. |
| Data subjects | Incidentally, the merchant and its staff where store, location or product names contain personal data. Shipping Gap Audit processes no customer data. |
| Categories of data | Store identifiers; shipping, market, product, variant and collection configuration. No special categories. |
3. Sub-processors
| Sub-processor | Service | Location and transfer basis |
|---|---|---|
| Cloudflare, Inc. | Hosting and database (Workers, D1) | Database in Western Europe; requests served on the global network; EU Standard Contractual Clauses and EU–US Data Privacy Framework, under Cloudflare's DPA |
No AI or large-language-model provider processes merchant data. The apps run deterministic code only. We will give at least 30 days' notice by email or in the app before adding or replacing a sub-processor, and the merchant may object by uninstalling.
4. Security measures
- Least privilege: read-only Admin API scopes limited to what each app uses.
- TLS for all traffic; Shopify webhooks verified by HMAC; App Bridge session tokens verified on every request.
- Access tokens encrypted at rest with AES-256-GCM; secrets kept in the host's secret store, never in source code.
- Data separated per store; no store's data is used for another.
- Access to production limited to the operator; changes are reviewed and tested before release.
5. Confidentiality
Anyone authorised to process the data is bound by confidentiality.
6. Assistance and data subject requests
We help the merchant answer data subject requests. Shopify's customer data and redaction requests are handled automatically; for Shipping Gap Audit they are closed at once because no customer data is held.
7. Personal data breaches
We notify the merchant without undue delay, and where feasible within 48 hours of becoming aware of a breach affecting its data, with the information required by GDPR art. 33(3) as it becomes available.
8. Deletion and return
On uninstall, access tokens are deleted at once and all other data within 48 hours of uninstall, when Shopify sends its shop deletion request. While installed, merchants can export findings (paid plans) and request deletion at any time through support.
9. Audits
We make available the information needed to demonstrate compliance with this addendum, on reasonable written request and no more than once a year unless required by a supervisory authority.
10. Governing law
As in the terms.