EditImpact data processing agreement

Effective 13 October 2026

This agreement is between Triple U Solutions ("we", the processor) and each merchant who installs EditImpact ("you", the controller). It covers the personal data EditImpact processes on your behalf through your Shopify store, and it forms part of your use of EditImpact. Our privacy policy describes the same processing in plain terms.

1. What we process and why

• Purpose: to show you how each product's sales changed after edits to the product. We process the data only for this purpose and only on your instructions, which are your installation and use of the app.
• Order data: EditImpact reads the products, quantities and amounts on your orders and adds them up per product per day. It keeps only those daily totals. It does not read or keep customer names, email addresses, phone numbers, addresses, customer IDs or individual orders.
• Store data: your store's Shopify domain, the access token Shopify issues to the app, your currency and time zone, your products' titles, descriptions, prices and photo and collection membership, edits you enter, and your settings.
• Data subjects: your customers, only to the extent that their purchases are counted in daily totals that cannot be traced back to them.

2. How we protect it

• All traffic to and from the app uses HTTPS (TLS).
• Data is stored encrypted at rest on DigitalOcean storage volumes, and backups are encrypted at rest in DigitalOcean Spaces.
• Only the people at Triple U Solutions who run the app can access the servers and data, using key-based access.
• The people who process the data are bound by confidentiality.
• The app never writes to your store and never sells, shares or uses the data for advertising.

3. Subprocessors

We use these providers to host and run the app. They process data only to provide their service to us:

• DigitalOcean (servers, storage and encrypted backups; New York, United States).
• Cloudflare (network delivery and protection for traffic to the app).
• Slack (our internal notifications; contains your store's domain and app events such as installs, never order or customer data).

We will update this list before adding a subprocessor that processes your data. You can object by contacting us; if we cannot address the objection, you can uninstall the app.

4. Where the data is processed

Data is processed and stored in the United States. Where the law requires a transfer mechanism for personal data leaving your country, the parties rely on the European Commission's Standard Contractual Clauses (controller to processor) and their UK and Swiss equivalents, which are incorporated by reference.

5. Your customers' rights

EditImpact keeps no data that identifies a customer, so there is nothing to return or erase for an individual. We still respond to Shopify's customer data request and erasure requests, and we will help you with any request or data protection assessment about the app.

6. Security incidents

If we become aware of a breach affecting data we process for you, we will tell you without undue delay, and within 72 hours, at your store's contact email, with what we know and what we are doing about it.

7. Deletion

When you uninstall EditImpact we delete your store's data straight away, and again when Shopify asks us to (48 hours after uninstalling). Backups that may still contain it expire within 30 days.

8. Information and audits

On request we will give you the information you reasonably need to show that this agreement is followed, including a description of our security measures. If the law requires an audit, we will cooperate with one at a reasonable time and with reasonable notice.

9. Contact

Triple U Solutions · [email protected]