Data Processing Agreement

1. Who this agreement is between

This agreement is between Pay Tech Payments LLC (303 South Water Street, Ste 200, Henderson, NV 89015), which operates Covr Suite, and each store that installs or uses Covr Suite (“the store” or “you”). It applies from the moment a store installs a Covr Suite app or otherwise sends us data.

“Shoppers” means your customers. “Personal data” means information about an identifiable shopper. “Applicable privacy law” means the data protection laws that apply to the processing, including US state privacy laws and, where they apply, the GDPR and UK GDPR.

2. Roles

You are the controller of your shoppers’ personal data, and Covr Suite is your processor. We process it only to provide the apps you switch on, as described here, and on your documented instructions. Installing an app, approving its permissions, and choosing its settings are your instructions.

3. What we process, and why

• Covr VIP: which customer bought a membership, their lifetime spend (when you use spend-based VIP) and their tags, to make them a member and end the membership on time. We write the result to your customer records in Shopify and keep no copy.
• Covr Cart: the products in your orders from the last 60 days, to learn which products sell together. We keep product pairs, never who bought them.
• Covr Discount and Covr State Limit: run inside Shopify’s checkout; no personal data reaches us.
• Covr Discount email codes, if you use them: we make one-time codes and send them to the email tool you connect, with the key you give us. Your email tool decides who gets each code; we never learn. When a code is used we keep the order number and amounts, to show you what the codes earned.
• Texting, if you use it: shoppers’ phone numbers, the texts sent and received, the consent you tell us applies to each automatic text, and STOP requests, to hold conversations from your store’s number.

The Shopify app does not read shoppers’ names, email addresses, phone numbers or addresses. We do not sell personal data, share it for advertising, or use one store’s data for another.

4. Our people

Only the people who run Covr Suite can reach production data, only when their work needs it, and each is bound to keep it confidential.

5. How we protect it

• Encryption in transit (TLS) on every connection, and encryption at rest for the database and its backups.
• Your store's Shopify access key is encrypted again with a key held only in our production environment, and expires and renews on Shopify's schedule.
• Only the Shopify permissions each app needs, and no access to shoppers' names, emails, phone numbers or addresses through the Shopify app.

6. Sub-processors

Each receives only what its part needs, is bound by contract to protect it and use it for nothing else, and may not sell it.

• Vercel (US): hosting, for every app.
• Neon (US): the database, for every app.
• Sendblue (US): delivers texts, for stores that use texting.
• Anthropic (US): the AI that drafts text replies, for stores that switch the assistant on.

We post any change to this list here, with a new date at the top, before a new provider receives personal data. If you object, tell us; if we can’t address it, you may stop using Covr Suite and we will delete your data as described in section 9.

7. Where the data is

Personal data is stored and processed in the United States. Where applicable privacy law requires a transfer mechanism for data from outside the US, the parties rely on the standard contractual clauses that law recognizes, which are incorporated by reference.

8. Shoppers' requests

When a shopper asks to see or delete their data, Shopify sends us the request on your behalf, and we answer within 30 days. The Shopify app holds no shopper data, so there is nothing to export or delete on our side; VIP’s membership details live on your customer record in Shopify and go with it. For texting, we delete a shopper’s texts on request within 30 days, keeping only a STOP request, because forgetting it would let texting start again. If a shopper contacts us directly, we tell you and help you respond.

9. How long we keep it, and when you leave

We keep your data while you use Covr Suite. If you uninstall the Shopify app, we stop receiving your data at once, and when Shopify asks us to erase your store’s data (48 hours later) we delete it automatically. If you stop using texting, we delete your conversations within 30 days of your request, keeping STOP requests as above.

10. If something goes wrong

If we become aware of a breach of security that leads to the accidental or unlawful loss, disclosure of, or access to your shoppers’ personal data, we will tell you without undue delay, and within 72 hours of confirming it: what happened, what data was involved, what we have done, and who to contact. We will help you meet any duty you have to notify shoppers or regulators.

11. Information and audits

We will answer your reasonable written questions about how we protect personal data, and give you the information you need to show this agreement is being followed, once a year or after a breach.

12. Everything else

This agreement is governed by the laws of the State of Nevada. If it changes in a way that matters, we change the date at the top and post the new version here. Our Privacy Policy describes the same practices for shoppers. Questions go to support@covrprotection.com.