Data Processing Agreement (DPA)

1. 1.This Agreement governs the handling of personal data in connection with the provision of the Shopify app "SellRules" (the "App") between the merchant who installs the App (the "Merchant") and JizaiDev, the provider of the App ("we", "us").
2. 2.The Merchant is the controller of buyers' personal data (the business handling personal information under Japan's Act on the Protection of Personal Information), and we are the processor that processes it on the Merchant's instructions.
3. 3.Our contact: [email protected]

We process personal data only for the following purposes.

1. 1.Applying per-product selling rules (pre-order, made-to-order, stock-out behavior, purchase limits, deposit/balance payments) to the storefront, checkout and order processing
2. 2.Sending notification emails to buyers (pre-order confirmation, delay, shipping, back-in-stock, balance payment requests)
3. 3.Managing the progress of pre-order and made-to-order orders, and printing packing slips
4. 4.Evaluating purchase limits (per-order and per-customer limits, eligibility by customer tag)
5. 5.Responding to Shopify customer data requests and deletion requests (customers/data_request, customers/redact, shop/redact)
6. 6.Handling incidents with the App and preventing misuse

The Merchant agrees that we use the following sub-processors.

1. 1.Encryption in transit: The App accepts HTTPS connections only. Communications with Shopify and Resend are also encrypted with TLS.
2. 2.Encryption at rest: The database is kept on an encrypted Fly.io volume, and automatic snapshots are encrypted as well. Authorization data for external AI integrations is additionally encrypted with AES-GCM.
3. 3.Minimal storage: Shipping addresses and phone numbers are not stored. Order webhooks are reduced to the fields used for processing, stored temporarily, and deleted after processing.
4. 4.Access restriction: Administrative access to the production environment is limited to our operators. The admin screens are available only to staff authenticated by Shopify.
5. 5.Access logging: Views of packing slips (showing addresses and phone numbers) and downloads of customer data exports are recorded with staff ID, count and time, and kept for 365 days (the personal data itself is not recorded).
6. 6.Separation of production and test data: Testing is done in a separate hosting environment, a separate database, and a separate Shopify app with development stores; production data is not used for testing.
7. 7.Authentication: Operator accounts use strong passwords and have two-step authentication enabled.

1. 1.We treat the App's settings and the Merchant's actions through Shopify as instructions for processing.
2. 2.When a buyer requests access, correction or deletion, we respond through Shopify's customers/data_request and customers/redact. Disclosed data can be downloaded for 7 days from "Customer data requests" in the admin screens.

1. 1.When we become aware of a personal data breach or a suspected breach, we will notify Shopify within 24 hours.
2. 2.We will notify affected Merchants without undue delay and no later than 72 hours after becoming aware, with the following to the extent known: when and what happened, the data affected and the estimated number of records, the measures taken, actions the Merchant needs to take, and our contact. Follow-up information will be sent as it becomes available.
3. 3.Notifications will be sent to the email address registered for the Merchant's Shopify store.
4. 4.We contain, investigate, recover from and prevent recurrence of incidents according to our internal incident response procedure, and keep records of them.

1. 1.When the Merchant uninstalls the App, we delete that store's data upon receipt of the event. The same applies when we receive shop/redact.
2. 2.Copies remaining in automatic snapshots are removed within 5 days at most. In all cases, all copies are erased within 30 days of uninstallation.
3. 3.We may retain anonymous aggregates that contain no personal data and do not identify the store.

1. 1.At the Merchant's request, we will provide information demonstrating compliance with this Agreement (this Agreement, retention periods, a description of security measures, and the number of access records).
2. 2.On-site audits are subject to prior written agreement, 30 days' notice, and a reasonable scope and frequency (at most once a year), at the Merchant's expense.