No data processing agreement exists with any partner brand; this document proposes the one we offer, so a partner's lawyer has a short, true answer to "what do you do with our data", and it waits on Param and a lawyer before anyone signs it.
Today
What exists
Source
No DPA, signed or drafted, with any of the five partners
Shopify's data request and erasure webhooks are handled
brew/docs/shopify-app-review.md:39
Connected accounts are read only and their keys are encrypted with AES-256-GCM
brew/legal-pages.js:23brew/vault.js:1-3
Production data sits in Cloud SQL and a bucket in asia-south1 with backups
brew/docs/production.md:11-12, 35-41
Deletion is an email request, promised within 7 days
brew/public/live.js:348-351
Tomorrow
Item
Version
Tag
A short DPA offered with the design partner agreement
v1
New, proposed
The same DPA linked from the full terms for every brand
v1
New, proposed
A DPA update when posting and scheduling write to the brand's accounts
v2
Changes
A DPA update when results are measured from order data
v3
Changes
The proposed DPA, for Param and a lawyer
This is a draft, not legal advice. Every number is a proposal.
Clause
Proposal
Parties
The brand, and Yellow Monk Technologies LLP
Roles
The brand controls its store data and its customers' data; we process it only to run the service for the brand
What we process
Public data about the brand and its rivals; numbers from connected accounts; order totals and counts from Shopify, never a customer's name, email, phone or address; names and emails of the brand's team; what the team writes and uploads
Purpose
Read the store, write Plays, cards, drafts and briefs for the brand's team; nothing else; never to train a model of our own
Instructions
We act only on the brand's use of the service and its written requests
People
Only named staff open brand data, and only to support the brand; today anyone at joinsquareup.com or shopos.ai can, so this clause needs the access change proposed in access rules first
Subprocessors
The list on our subprocessors page; 14 days' email notice before a new one, with the right to object and leave
Where
Google Cloud in India; some AI and email vendors in the US
Security
As on our security practices page: encryption of keys, read only access, revocable sessions, backups
Breaches
We tell the brand's admins within 72 hours of confirming a breach that touches their data, with what we know
Help
We help with the brand's own data requests within 7 days
Deletion
Within 7 days of a request or the end of the agreement; backups roll off within 14 days after that
Proof
A written answer to a security questionnaire once a year; no on-site audits
Term
As long as the brand uses the service
How we do it
Param and a lawyer settle the table above into a two page document.
Send it with the design partner agreement to the five partners; record each yes in the contracts register.
Keep the subprocessors page current; any new vendor in the code means an email to every partner 14 days before it goes live.
Every DPA promise must be something the code or a runbook already does; if not, fix the code first or change the promise.
Numbers
Metric
Definition
Where measured
Status
Partners with a signed DPA
Of the five design partners
Contracts register
Proposed, 0 on record
Subprocessor notices sent
Emails sent before a new vendor
hello@ outbox
Proposed
Open
Do we offer a DPA now, or only when a partner asks? Proposal: now, with the partner agreement, because PUMA India is likely to ask.
Breach notice time? Proposal: 72 hours from confirming, which is a common standard; the lawyer checks Indian law.
Backups after deletion? Point in time recovery keeps 7 days and daily backups keep 14. Proposal: say backups roll off within 14 days and are never restored for a deleted brand.
Who signs for us? Proposal: Param, as a designated partner of the LLP; he confirms he is one.
