Data processing agreement

This agreement is between the business that uses Freebies Engine by Log Studio Lab or Experiment Engine by Log Studio Lab (“Customer”, the merchant) and Log Studio Lab (operated by its founders as individuals, not a registered company, from Buenos Aires, Argentina, “we”). It forms part of our terms of service and applies from the day Customer installs a product, for as long as we process Customer Personal Data. If this agreement and the terms conflict about personal data, this agreement controls.

“Customer Personal Data” means personal data of Customer's shoppers and other individuals that we process for Customer through the products. Terms such as controller, processor, personal data, personal data breach and processing have the meaning given in the GDPR and equivalent laws, and “business” and “service provider” the meaning in US state privacy laws.

For Customer Personal Data Customer is the controller (or business) and we are the processor (or service provider). For the account details of Customer's team and for our own website and billing records we are an independent controller, as described in our privacy policy, and this agreement does not apply to that data.

• Subject matter and purpose: providing the products: publishing offers and discounts, showing widgets, applying gifts and bundles, measuring performance, and running experiments, together with support and security.
• Duration: while the product is installed, plus the retention periods in the privacy policy. Customer Personal Data is erased as set out below.
• Individuals: shoppers on Customer's Shopify store, and customers named in its orders.
• Data types: random session and visitor ids, cart token, page paths, offer and experiment events, Shopify customer id (only when Shopify supplies one), order ids and names, order amounts and currency, refund and cancellation status, which offers a customer has used. We do not process payment cards, and we do not store shopper names, emails or postal addresses.
• Special categories: none, and Customer must not send any through the products.
• Nature: collection from the store, storage, aggregation, analysis, display to Customer and deletion.

• Process Customer Personal Data only on Customer's documented instructions, which are these terms, Customer's use and configuration of the products, and written instructions that are consistent with them. We will tell Customer if we believe an instruction breaks the law.
• Ensure everyone with access is bound by confidentiality and has access only as needed.
• Not sell Customer Personal Data, not share it for cross-context behavioral advertising, not retain, use or disclose it outside the direct business relationship or for any purpose other than the one in this agreement, and not combine it with personal data from other sources, except as the law permits. We certify that we understand these limits.
• Give Customer the information needed to show compliance, and assist with data protection impact assessments and prior consultation, taking account of the nature of the processing.

We apply the measures below and keep them in line with our security page:

• Store access tokens are encrypted before they are saved, and are overwritten when the app is uninstalled.
• Every query is restricted to a single store, and tests check that data of one store cannot be returned for another.
• Calls from Shopify, including its webhooks, are verified by signature before we act on them. Calls from a storefront are verified with Shopify's app-proxy signature.
• Data is encrypted in transit between the browser, our servers and our subprocessors, and database storage is encrypted at rest by our database provider.
• Staff access to a merchant's store is limited to named staff with a second factor, and every access is recorded in an audit log.
• Application rate limits, input validation at every boundary, and a content security policy on the website.
• Error telemetry has request bodies and customer identifiers removed before it leaves our systems.
• A nightly encrypted database backup, kept for 14 days, and a documented procedure for rotating secrets and switching features off.
• Retention limits enforced by scheduled jobs, listed in the privacy policy.

Customer gives general written authorization for the subprocessors on our subprocessors page. We bind each in writing to data protection terms that are no less protective than these, and we remain responsible for them. We give at least 30 days' notice before adding or replacing one. Customer may object on reasonable data protection grounds within that period; if we cannot resolve it, Customer may stop using the product and cancel without penalty.

We help Customer respond to requests from individuals to exercise their rights. Requests that arrive through Shopify (customer data request and customer redact) are processed automatically: we prepare an export of what we hold for the customer, available to Customer for 30 days, or delete the customer's data. If an individual contacts us directly, we refer them to Customer and do not answer on the substance unless the law requires.

We notify Customer without undue delay, and in any case within 72 hours after we become aware of a personal data breach affecting Customer Personal Data. The notice goes to the account owner's email and gives, as far as we know, the nature of the breach, the data and number of individuals concerned, likely consequences and the steps taken. We take steps to contain it and help Customer with its own notifications.

• Customer can remove what a product created in the store with Reset app data, and export reports from the app before uninstalling.
• When Customer uninstalls, we stop all processing for that store, revoke the stored access token, archive its offers and pause its running tests. About 48 hours later Shopify sends the erase instruction and we delete the store's data and everything linked to it. If the store reinstalls first, nothing is erased.
• A customer-level erase request deletes that customer's rows and the used-offers metafield we wrote for them. For Experiment Engine by Log Studio Lab it deletes the order facts of the named orders and detaches those orders from the funnel events.
• Experiment Engine by Log Studio Lab deletes the raw visitor rows and order facts of a test 90 days after the test ends. Daily summaries have no personal data and stay.
• Backups expire on their own schedule (our encrypted backup after 14 days; our database provider's window). We keep nothing else after erasure except the trial record, which has no personal data, and the staff audit entries with their input removed, unless the law requires otherwise.

On request, once a year or after a breach, we answer a reasonable security questionnaire and give summaries of our measures. If that is not enough for a regulator or the law, Customer may audit us with 30 days' notice, during business hours, at its own cost, under confidentiality, and without access to other customers' data.

We process Customer Personal Data in the United States. For personal data protected by the GDPR, the UK GDPR or the Swiss data protection act that is transferred to us in a country without an adequacy decision, the following apply and are incorporated into this agreement:

• The Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), and Module Three where Customer is itself a processor. Clause 7 (docking) applies; in Clause 9 Option 2 applies with the 30-day notice above; the optional language in Clause 11 does not apply; in Clauses 17 and 18 the law and courts are those of Ireland. Customer is the data exporter and we are the data importer. Annex I is the description of processing above, Annex II is the security measures above, and Annex III is the subprocessors page.
• For the United Kingdom, the International Data Transfer Addendum issued by the Information Commissioner, version B1.0, in force 21 March 2022, with its tables completed by this agreement. For Switzerland, the clauses apply with references to the GDPR read as references to the Swiss act and the Federal Data Protection and Information Commissioner as supervisory authority.
• If the clauses and this agreement conflict, the clauses win.

The liability rules in the terms of service apply to this agreement, except that nothing limits a party's liability to data subjects under the Standard Contractual Clauses. This agreement ends when we no longer process Customer Personal Data. Its governing law is that of the terms of service, except where the Standard Contractual Clauses require otherwise.

Data protection questions and notices: support@marginlabs.app.