Data processing agreement
Last updated 9 October 2026
This agreement is part of the terms between Mykyta Troiepolskyi, NIP 8993064787, Wrocław, Poland ("Kaparo", "we") and the merchant who installs Kaparo: Preorders & Deposits ("you"). It applies from the moment you install the app, with nothing to sign, for as long as Kaparo holds personal data for you.
1. Roles
You are the controller of your customers' personal data: you decide why and how it is used. Kaparo is your processor. We process that data only on your instructions, which are these terms, the settings you choose in the app, and what you ask of us in writing. If an instruction seems to us to break the law, we tell you.
2. What is processed
| Whose data | Customers who place a pre-order in your store through Kaparo. |
|---|---|
| Which data | Name and email address, and the pre-order itself: order number, lines, deposit, balance, dates and status. No addresses, phone numbers or card details, and nothing in the special categories of the GDPR. |
| What for | Recording pre-orders, charging the balance through Shopify, emailing the customer about their own order, and showing you the result. |
| How long | Until the retention periods in section 7 run out, or you uninstall the app. |
3. Confidentiality and security
Everyone with access to the data is bound to keep it confidential. Today that is one person. We encrypt names, email addresses and Shopify tokens in the app, on top of the host's encryption of the database and its backups. Data travels over HTTPS, the host and the database are behind two-factor sign-in, test and production data are kept apart, and each read of a customer's name or email by the app is logged.
4. Other processors
You agree to our using these providers, each bound by terms that protect the data at least as well as this agreement:
| Provider | What it does | Where |
|---|---|---|
| Fly.io, Inc. | Runs the app and its database | United States (Virginia) |
| Resend (Plus Five Five, Inc.) | Delivers the emails Kaparo sends and receives replies to them | United States |
| Functional Software, Inc. (Sentry) | Error reports from the app | European Union (Germany); its account records and job check-ins are kept in the United States |
| Cloudflare, Inc. | DNS for kaparo.app and forwarding of mail sent to the support address | United States and wherever its network is |
Before adding or replacing a provider we email you at least 14 days ahead. If you object and we can't find a way round it, you can stop using Kaparo and we refund what you paid for the time left. We answer for our providers' work as for our own.
5. Transfers outside Europe
The data is stored in the United States. Where it comes from the European Economic Area, the United Kingdom or Switzerland, the transfer rests on the provider's certification under the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses (Decision 2021/914), with the United Kingdom's addendum where that applies.
6. Helping you with requests
When a customer asks you to see or erase their data and you pass that on through Shopify, Kaparo acts on it automatically: it emails you what it holds on that customer, or erases their name and email and deletes their pre-orders (one that still owes its balance once it is settled, or at 90 days old). For anything Shopify doesn't cover, write to us and we help within 30 days. If a customer writes to us directly, we send them to you. We also give you what you reasonably need for a data protection impact assessment.
7. Retention and deletion
A customer's name and email are erased 90 days after their pre-order is closed, and from any pre-order nothing has touched for a year. When you uninstall Kaparo, Shopify asks us 48 hours later to erase your store's data, and we delete all of it when that request arrives. If you want a copy first, ask before you uninstall.
8. If something goes wrong
If personal data we hold for you is exposed, lost or changed without permission, we email you within 24 hours of confirming it, with what happened, whose data is affected and what we have done, and we keep you informed until it is closed.
9. Checking on us
On request we send you the information needed to show that we keep to this agreement, including our written security practices.
10. The rest
Where this agreement and the terms disagree about personal data, this agreement wins. It is governed by the same law as the terms. Questions go to support@kaparo.app.