← OrderPeek

OrderPeek Data Processing Agreement (DPA)

Last updated: 24 October 2026

This DPA forms part of the OrderPeek Terms of Service between Sudarshan Hosalli (sole proprietor) ("OrderPeek", "we") and the merchant using OrderPeek ("Merchant", "you"). If it conflicts with the Terms on data protection, this DPA prevails.

1. Definitions

"Applicable Data Protection Law" means laws on personal data that apply to either party's processing under this DPA, including, where applicable, the EU GDPR, the UK GDPR, and US state privacy laws such as the CCPA/CPRA. "Personal Data", "process", "controller", "processor", "sub-processor", "data subject" and "personal data breach" have the meanings those laws give them. "Customer Data" means Personal Data of the Merchant's customers that the Merchant makes available to OrderPeek through Shopify (for example names, email addresses, shipping addresses, order details, tracking information, notes and tags). "Service" is defined in the Terms.

2. Roles, and what OrderPeek does and does not process

2.1 How the Service handles Customer Data. Customer Data is requested from Shopify directly by the OrderPeek software running inside the Merchant's own browser (the admin page inside the Shopify admin, or the optional Chrome extension), using access the Merchant granted to the OrderPeek Shopify app. It is shown to the Merchant and kept only in the browser's temporary memory: in the admin page while it is open, and in the Chrome extension for up to 5 minutes (browser session storage, cleared when the browser closes). It is not sent to, stored on or passed through OrderPeek's servers. OrderPeek's own staff cannot see it.

2.2 Roles.

2.3 No sale, no secondary use. OrderPeek does not sell Customer Data, share it for advertising, combine it with other data, or use it to train AI models. It does not retain it in the first place.

3. Instructions

OrderPeek will process Personal Data on the Merchant's behalf only on the Merchant's documented instructions, which are: these Terms, this DPA, the Merchant's configuration of the Service (for example which stores are connected), and the Merchant's use of its features. If we believe an instruction breaches Applicable Data Protection Law we will say so promptly. We may stop the processing in question until it is resolved.

4. Merchant's responsibilities

The Merchant confirms that it: has a lawful basis for processing Customer Data and for using it to answer customers' support requests; has given customers the notices the law requires; will connect only stores it is entitled to access; and will use the Service lawfully. Merchants who offer their own privacy notices should mention that they use service providers such as OrderPeek.

5. Purpose, nature and duration (Annex 1 summary)

See Annex 1. Processing lasts for as long as the Merchant uses the Service (the store stays connected). Because OrderPeek does not hold Customer Data, nothing needs to be returned or deleted when the Service ends (§12).

6. Confidentiality

OrderPeek ensures that anyone authorised to handle credentials or Personal Data in connection with the Service is bound by confidentiality duties, limits that access to what is necessary, and does not look at Customer Data in the Merchant's browser.

7. Security

OrderPeek implements and maintains appropriate technical and organisational measures to protect Personal Data and credentials, taking into account the state of the art, costs, and the risks. The measures at the date above are in Annex 2. We may update them provided the overall level of protection does not fall.

8. Sub-processors and recipients

8.1 General authorisation. The Merchant authorises the sub-processors and third-party recipients listed in Annex 3.

8.2 Changes. We will tell Merchants (in the extension, on our website or by email) at least 30 days before adding or replacing a sub-processor that would process Personal Data. The Merchant may object on reasonable data protection grounds within that period; if we cannot resolve it, the Merchant may stop using the Service and cancel without penalty.

8.3 Flow-down. We will bind sub-processors to data protection duties no less protective than those in this DPA, and remain responsible for them to the extent the law requires.

8.4 Shopify and Google. Shopify (the source of Customer Data and the billing platform) and Google (Gmail and the Chrome browser) act under their own terms with the Merchant and are not OrderPeek's sub-processors for Customer Data.

9. Data subject requests

Customer Data stays in the Merchant's systems (Shopify, Gmail, its own browser). Requests from customers (access, correction, deletion, objection and so on) should be handled by the Merchant in Shopify and its other systems. If OrderPeek receives such a request, it will pass it to the Merchant without undue delay where it can identify the Merchant, and will not respond to the data subject itself unless the law requires it.

OrderPeek has set up the Shopify mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact). They verify Shopify's signature and are acknowledged. Because OrderPeek holds no Customer Data or shop data, there is nothing to export or delete when they fire.

10. Personal data breaches

If OrderPeek becomes aware of a personal data breach affecting Personal Data or credentials it handles for the Merchant, it will notify the Merchant without undue delay and within 72 hours, by email to the address associated with the Merchant's store or support contact. The notice will include, as far as known: what happened and when; the categories and approximate volume of data and people affected; likely consequences; what OrderPeek has done and will do (including rotating secrets and invalidating tokens); and a contact for follow-up. We will cooperate reasonably with the Merchant's own notification duties.

11. Assistance, audits and records

On reasonable request, and taking into account the nature of the processing and the information we hold, OrderPeek will help the Merchant with data protection impact assessments and with consultations with regulators. We will give the Merchant the information reasonably needed to show our compliance with this DPA (including written answers to security questionnaires), and allow for audits by the Merchant or its auditor no more than once a year, with reasonable notice, during business hours and subject to confidentiality, to the extent the information cannot be provided by other means. Each party bears its own costs unless the audit finds a material breach by us.

12. Return and deletion

When the Merchant disconnects the store, uninstalls the Shopify app or stops using the Service: the access tokens in the Merchant's browser stop working once the app is uninstalled and are deleted when the Merchant removes the store in settings or the extension; temporary browser memory is cleared when the browser is closed; OrderPeek holds no Customer Data or tokens to return or delete. Records of billing and legal requirements that we must keep (for example invoices held by Shopify) are kept as the law requires.

13. International transfers

OrderPeek's service runs on Cloudflare's global network, so credentials in transit may be handled in a country other than the Merchant's. Where Applicable Data Protection Law requires a transfer mechanism for Personal Data that OrderPeek transfers, the parties rely on the EU Standard Contractual Clauses (Module 2: controller to processor / Module 3 where relevant), and for UK transfers the UK Addendum, incorporated by reference with the details in Annexes 1 to 3. Our hosting provider relies on its own transfer mechanisms.

14. Liability

Each party's liability under this DPA is subject to the limits and exclusions in the Terms, except where the law does not allow them.

15. Term, changes and governing law

This DPA lasts as long as OrderPeek processes Personal Data for the Merchant. We may update it to reflect legal or service changes, using the same notice process as the Terms (§16 of the Terms); material changes will not take effect for existing Merchants until 30 days after notice. It is governed by the law that governs the Terms, except where Applicable Data Protection Law (or the Standard Contractual Clauses) require otherwise.

16. Acceptance

The Merchant accepts this DPA by installing the Service or connecting a store, as part of the Terms. A signed copy is available on request at sudarshanhosalli90956@gmail.com.

Annex 1: Details of processing

Annex 2: Technical and organisational measures

Architecture and data minimisation

• Customer Data goes Shopify → the Merchant's browser. It is not sent to, stored on, or logged by OrderPeek's servers.
• Read-only Shopify access (read_customers, read_orders). No write scopes.
• Only the data fields the Service displays are requested; customer phone numbers are not requested.
• The admin page keeps what it loads only in the page's memory. The Chrome extension's browser caching of lookups is held in chrome.storage.session (memory, up to 5 minutes), not on disk.
• Reply templates, late limits and the sign-off are saved in an app-owned metafield in the Merchant's own Shopify store; they are not customer data.
• Connection tokens are kept in the extension's private storage, which web pages (including Gmail) cannot read; the Gmail-side code asks a background component for data and never receives tokens.

Sign-in, tokens and service security

• The admin page runs inside the Shopify admin using App Bridge; before issuing a short-lived connection code (shop domain only, no token) our service verifies Shopify's session token (signature, audience, expiry and shop). The page is served with a strict content security policy.
• Shopify OAuth (Chrome extension) with a signed, expiring state and a browser-bound nonce; the sign-in callback verifies Shopify's HMAC (constant-time comparison) and the shop's domain format; results are returned to the extension in the URL fragment, which is never sent to a server.
• Short-lived access tokens (about 1 hour) and rotating refresh tokens; refreshes are serialised so the chain cannot be broken by concurrent use.
• CORS on the service is limited to the OrderPeek extension IDs on an allow-list; the service validates input and shop domains and rejects unknown extensions.
• Webhook requests are authenticated by verifying Shopify's HMAC signature; invalid requests receive 401.
• The service does not log request bodies, tokens or customer data (no console logging; platform request logging disabled); an automated test enforces the no-logging rule in code.
• Secrets (Shopify client secret, signing secret) are stored as encrypted secrets in the hosting platform, never in source control or configuration files; secrets are rotated after any suspected exposure.
• All traffic uses HTTPS/TLS.
• The extension requests minimal browser permissions (Gmail and *.myshopify.com hosts, storage, identity, scripting) and loads no remote code.

Organisational

• Access to the hosting, Shopify Partner, Google and code-hosting accounts is limited to named personnel. Two-step verification and strong, unique passwords (password manager) are used on all of them.
• Dependencies are reviewed and updated regularly; source code is kept in private version control.
• A security incident response procedure is documented and followed (summary available on request).
• Separate test and production data: development and tests use a Shopify development store with fictional data and mocked responses; no real customer data is used for testing.

Annex 3: Sub-processors and third-party recipients

Contact for data protection questions and notices under this DPA: sudarshanhosalli90956@gmail.com, Kusnoor, GB Jnanaganga, Kalaburagi Reshmi College, Kalaburagi, Karnataka 585106, India.