Marlo Data Processing Addendum
Effective Date: November 12, 2026
This Data Processing Addendum ("DPA") forms part of the Marlo Merchant Terms of Service between you (the "Merchant" or "Controller") and Tal Builds (the "Processor") and governs the processing of personal data in connection with the Marlo applications.
1. Subject Matter and Duration
This DPA applies to the processing of personal data by the Processor on behalf of the Controller for the duration of the Controller's use of the Marlo applications, plus any period required to complete deletion of personal data as described herein.
2. Nature and Purpose of Processing
The Processor processes personal data solely to provide the features of the Marlo applications:
- Order tracking (Marlo: AI Order Tracking): Receiving order webhook data from Shopify to identify and report order sources (web, AI agent, POS).
- Product catalog export: Fetching product data on demand to generate CSV feeds. Product data is not persisted.
3. Categories of Data and Data Subjects
3.1 Data Processed for Order Tracking
For merchants using the order tracking feature, we process the following limited order data:
- Platform order ID
- Order timestamp
- Source channel (web, AI agent, POS, or unknown)
- Order total and line item totals
- Currency
- Shopify's opaque customer ID (a platform-generated identifier)
We do NOT collect: customer name, email address, phone number, shipping address, billing address, or any other directly identifying customer information.
3.2 Data Subjects
Data subjects are end customers of the Merchant whose orders are processed through the Merchant's Shopify or Wix store. The only personal data element we store is the platform's opaque customer ID, which cannot be used to directly identify individuals without access to the Merchant's platform account.
3.3 Merchant Data
We also store the following merchant account data: platform account identifier (shop domain or instance ID), OAuth access tokens, optional merchant-entered settings, and billing tier information.
4. Processor Obligations
4.1 Processing Instructions
The Processor shall process personal data only on documented instructions from the Controller, which are embodied in the Marlo Merchant Terms of Service and this DPA, unless required to do so by applicable law.
4.2 Confidentiality
The Processor ensures that persons authorized to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.
4.3 Security Measures
The Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
- Encryption in transit: All data transmitted between clients, the application, and the database is encrypted using TLS.
- Encryption at rest: Data stored in our database is encrypted at rest by our hosting and database provider (Vercel Postgres).
- Access controls: Access to personal data is limited to authorized personnel on a need-to-know basis, following the principle of least privilege.
- Webhook verification: Incoming webhooks from Shopify are verified using HMAC signatures to ensure authenticity.
5. Sub-processors
The Controller authorizes the Processor to engage the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting and database (Vercel Postgres) | United States |
| Shopify Inc. | E-commerce platform (for Shopify apps) | Canada / United States |
| Wix.com Ltd. | E-commerce platform (for Wix apps) | Israel |
The Processor will notify the Controller of any intended changes to sub-processors and give the Controller the opportunity to object.
6. Data Subject Requests
Data subject requests are handled through the platform's GDPR compliance webhooks:
- customers/data_request: We record the request and return any stored order IDs associated with the customer.
- customers/redact: We delete all order records associated with the specified customer.
- shop/redact: We delete all data associated with the merchant's shop.
The Processor will assist the Controller in responding to data subject requests to the extent technically feasible.
7. Personal Data Breach Notification
The Processor will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting the Controller's data. The notification will include the nature of the breach, categories of data affected, and measures taken or proposed to address the breach.
8. Data Deletion and Retention
- On uninstall: When a merchant uninstalls the app, API tokens are revoked immediately and all merchant data is scheduled for deletion within 48 hours.
- On shop/redact webhook: All merchant data is deleted immediately upon receiving the platform's shop redaction webhook.
- Retention: We retain order data only for as long as the merchant's account is active. We do not retain personal data beyond what is necessary to provide the Services.
9. Audits
The Processor will make available to the Controller, on reasonable request, information necessary to demonstrate compliance with this DPA and allow for audits conducted by the Controller or an auditor mandated by the Controller. Audits shall be conducted with reasonable notice, during normal business hours, and shall not unreasonably interfere with the Processor's operations.
10. International Transfers
Personal data may be transferred to and processed in the United States and other countries where our sub-processors operate. For transfers outside the European Economic Area, we rely on Standard Contractual Clauses (SCCs) or other appropriate safeguards as required by applicable data protection laws.
11. Liability
Liability under this DPA is subject to the limitations set forth in the Marlo Merchant Terms of Service.
12. Governing Law
This DPA is governed by the laws of the State of Israel, consistent with the Marlo Merchant Terms of Service.
13. Contact
For questions about this DPA or to exercise data protection rights, please contact us at talbuilds0@gmail.com.