Data processing agreement

Who this is between

This agreement is between the business that uses a workspace on Ecomyard (you, the brand) and Ecomyard (KVK 96480556, Willemsplein 21, 6811 KB Arnhem, the Netherlands). For the personal data in your workspace, you are the controller and Ecomyard is your processor. Where you installed Ecomyard from the Shopify App Store, you are the business that owns the Shopify store.

For our own accounts, billing and website, Ecomyard is the controller itself. Our privacy policy describes that part.

What we process for you

We process personal data to run Ecomyard for your workspace: your affiliate program with its signup pages, tracked links, discount codes, commissions and payouts, your content workflow, gifting, Instagram content about your brand, the emails and notifications you set up, and the reports you look at.

The people concerned are your team members, the creators and affiliates who apply to or join your program, the customers who order in your Shopify store with an affiliate's code or link, the people who click an affiliate's link, and the Instagram accounts that tag or mention your brand.

The data concerned:

We process it for as long as your workspace exists, and delete it as described under When it ends.

• Your team: names, email addresses, roles and what they do in the workspace.
• Creators and affiliates: names, email addresses and social handles; what they fill in on your signup pages, such as their country, phone number, shipping address and answers to your questions; their code, link, tier, commissions and payouts and the PayPal address they are paid on; the content and messages they send; and the IP address of their latest visit to their portal.
• Your store's customers, for orders placed with an affiliate's code or link: the order number, amounts, products, shipping country, whether it was their first order, and a shortened name (first name and last initial). Their email and IP address are compared once with the affiliate's, to catch a self-referral, and not stored.
• People who open an affiliate's link: the time, their browser, the page they came from and whether the link came from a paid ad. Not their IP address.
• Instagram accounts that tag or mention your brand, as described in our privacy policy.

Only on your instructions

We process the data only on your documented instructions. Those are these terms, the settings you choose and the actions you take in Ecomyard, and anything the workspace owner asks us in writing. We do not use your data for our own purposes, do not sell it and do not use it to train AI models.

If an instruction would break data protection law, we tell you and do not carry it out. If the law requires us to process data in another way, we tell you first, unless the law forbids that.

Confidentiality

Only people who need to, to run, support or secure Ecomyard, can access your data, and each of them is bound to confidentiality.

Security

We protect your data with measures that fit the risk. The main ones:

Every workspace is isolated in the database itself: row-level security on every table, so one workspace cannot read another's data even if application code has a bug. Traffic is encrypted in transit and data is encrypted at rest. Tokens for the platforms you connect are kept server-side and are never shown in the browser. Creator portals show each creator only their own data. Personal data held for a limited time is erased on schedule, such as the browser recorded with a link click after 30 days.

Our security page describes these measures in more detail. We review them as the product and the risks change.

Subprocessors

You give us general permission to use subprocessors. The current ones are listed at the end of this agreement, with what they do and where.

We tell you at least 30 days before we add or replace a subprocessor, by email to your workspace owner and on this page. You can object on reasonable data protection grounds within those 30 days. If we cannot meet the objection, you can stop using Ecomyard and cancel before the change takes effect.

Each subprocessor is bound by a written contract with the same data protection obligations as this agreement. We remain responsible to you for how they process your data.

Requests from the people concerned

Ecomyard gives you the tools to answer requests from the people whose data you hold: to look them up, correct them, export them and delete them. Where you cannot do something yourself, we help.

If someone asks us directly about data in your workspace, we pass the request on to you without undue delay and do not answer it ourselves, other than to tell them we have passed it on.

Data breaches

If we become aware of a breach of personal data in your workspace, we tell your workspace owner within 48 hours. We say what happened, which data and roughly how many people are concerned, what the likely consequences are and what we have done and will do about it. What we do not know yet, we send as soon as we know it.

We help you meet your own duties to notify the supervisory authority and the people concerned. Whether and how to notify them is your decision.

Impact assessments and the authority

Where you need a data protection impact assessment or a prior consultation with a supervisory authority for your use of Ecomyard, we give you the information about our processing that you need for it.

Data outside the EU

Your workspace's database and files are stored in the EU. Where a subprocessor processes data outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission, which for the United States means the company is certified under the EU-US Data Privacy Framework, or on the Commission's standard contractual clauses. The list at the end of this agreement says which applies per subprocessor.

When it ends

You can export your data at any time, including your commission and payout records. When you ask us to delete your workspace, or stop using Ecomyard, we delete the personal data we hold for you within 30 days. Database backups that contain it are overwritten within 7 days after that.

If you installed Ecomyard from the Shopify App Store and remove it from your store, we delete your workspace and everything in it 30 days later, unless you reinstall it before then. Your workspace owner gets an email first, with how to export.

Commission and payout records are part of your own administration, which you may have to keep for seven years. Export them before you delete your workspace: after the deletion, we no longer have them. We only keep data beyond this when the law requires us to, and then only for that purpose.

Audits

We give you the information you need to check that we meet this agreement. Ask us in writing and we answer your questions about our processing and security.

If that is not enough, you or an independent auditor you appoint can audit our compliance once a year, announced 30 days ahead, at your cost, during business hours and under confidentiality. An audit never gives access to other customers' data. A supervisory authority can always audit us.

Liability and law

Liability under this agreement follows the liability section of our terms of service. Where this agreement and the terms differ on data protection, this agreement prevails.

Dutch law applies to this agreement, and disputes go to the competent court in Gelderland, the Netherlands, unless the law gives you another forum. Questions about this agreement: hello@ecomyard.com.

Our subprocessors

These companies process personal data for Ecomyard, each for one job:

• Supabase Pte. Ltd. (Singapore). Database, sign-in and file storage, for all data in a workspace. Stored in the EU (Ireland). Supabase's support staff, also in the United States, can reach it when a problem needs them. Transfers outside the EEA: EU standard contractual clauses.
• Vercel Inc. (United States). Hosting of the website and the app, for everything that passes through the app. The app's functions run in the EU (Dublin); routing and static files go through Vercel's worldwide network. Transfers outside the EEA: the EU-US Data Privacy Framework and EU standard contractual clauses.
• Plus Five Five, Inc., known as Resend (United States). Sending email, for the names and email addresses of recipients and the content of the emails. Stored in the United States, for 30 days. Transfers outside the EEA: the EU-US Data Privacy Framework and EU standard contractual clauses.
• Anthropic Ireland, Limited (Ireland). AI research and ad copy, for the workspace content a team member asks the AI to work with, such as products, personas and creative names. Processed outside the EU and deleted within 30 days. Never used to train models. Transfers outside the EEA: EU standard contractual clauses.
• Google Cloud EMEA Limited (Ireland). reCAPTCHA, the check that a form is sent by a person, for the IP address and browser data of whoever sends a form that has it, such as a signup page. Processed by Google worldwide. Transfers outside the EEA: the EU-US Data Privacy Framework and EU standard contractual clauses.
• Upstash, Inc. (United States). Limiting how often a form, a sign-in or a link can be used, for IP addresses and account ids. Kept for minutes. Transfers outside the EEA: the EU-US Data Privacy Framework and EU standard contractual clauses.
• Platforms you connect yourself, such as Shopify, Instagram, Google Drive, Slack, Klaviyo and your own Claude account, are not our subprocessors: they work for you under your own agreement with them, and we exchange data with them on your instruction. PayPal pays your affiliates as a controller in its own right, under its own terms.