---
id: "9.3"
title: "Data processing agreement"
dept: security-privacy-and-legal
status: needs-you
owner: Param
branded: false
last_verified: 2026-10-26
sources:
  - "brew/legal-pages.js:23-33"
  - "brew/docs/shopify-app-review.md:18, 39, 89-93"
  - "brew/docs/shopify.app.toml:12-15"
  - "brew/vault.js:1-3"
  - "brew/docs/production.md:11-12, 35-41"
  - "brew/public/live.js:348-351"
  - "memory brew-meta-app-review, brew-live-stores, brew-prod-backend"
  - "handbook content/sales-and-partnerships/contracts.md"
---

# Data processing agreement

## Answer

No data processing agreement exists with any partner brand; this document proposes the one we offer, so a partner's lawyer has a short, true answer to "what do you do with our data", and it waits on Param and a lawyer before anyone signs it.

## Today

| What exists | Source |
|---|---|
| No DPA, signed or drafted, with any of the five partners | [src: handbook content/sales-and-partnerships/contracts.md] |
| The five partners whose data is on production: Arata, Nutrova, Mana, PUMA India, Scrubroom | [src: memory brew-live-stores] [src: memory brew-prod-backend] |
| Meta's data handling form names Yellow Monk Technologies LLP as controller and Google LLC, Google Cloud, India and the US, as processor | [src: memory brew-meta-app-review] |
| Shopify protected customer data: Level 1 requested, no names, emails, phones or addresses | [src: brew/docs/shopify-app-review.md:18, 89-93] [src: brew/docs/shopify.app.toml:12-15] |
| Shopify's data request and erasure webhooks are handled | [src: brew/docs/shopify-app-review.md:39] |
| Connected accounts are read only and their keys are encrypted with AES-256-GCM | [src: brew/legal-pages.js:23] [src: brew/vault.js:1-3] |
| Production data sits in Cloud SQL and a bucket in asia-south1 with backups | [src: brew/docs/production.md:11-12, 35-41] |
| Deletion is an email request, promised within 7 days | [src: brew/public/live.js:348-351] |

## Tomorrow

| Item | Version | Tag |
|---|---|---|
| A short DPA offered with the design partner agreement | v1 | New, proposed |
| The same DPA linked from the full terms for every brand | v1 | New, proposed |
| A DPA update when posting and scheduling write to the brand's accounts | v2 | Changes |
| A DPA update when results are measured from order data | v3 | Changes |

### The proposed DPA, for Param and a lawyer

This is a draft, not legal advice. Every number is a proposal.

| Clause | Proposal |
|---|---|
| Parties | The brand, and Yellow Monk Technologies LLP |
| Roles | The brand controls its store data and its customers' data; we process it only to run the service for the brand |
| What we process | Public data about the brand and its rivals; numbers from connected accounts; order totals and counts from Shopify, never a customer's name, email, phone or address; names and emails of the brand's team; what the team writes and uploads |
| Purpose | Read the store, write Plays, cards, drafts and briefs for the brand's team; nothing else; never to train a model of our own |
| Instructions | We act only on the brand's use of the service and its written requests |
| People | Only named staff open brand data, and only to support the brand; today anyone at `joinsquareup.com` or `shopos.ai` can, so this clause needs the access change proposed in access rules first |
| Subprocessors | The list on our subprocessors page; 14 days' email notice before a new one, with the right to object and leave |
| Where | Google Cloud in India; some AI and email vendors in the US |
| Security | As on our security practices page: encryption of keys, read only access, revocable sessions, backups |
| Breaches | We tell the brand's admins within 72 hours of confirming a breach that touches their data, with what we know |
| Help | We help with the brand's own data requests within 7 days |
| Deletion | Within 7 days of a request or the end of the agreement; backups roll off within 14 days after that |
| Proof | A written answer to a security questionnaire once a year; no on-site audits |
| Term | As long as the brand uses the service |

## How we do it

1. Param and a lawyer settle the table above into a two page document.
2. Send it with the design partner agreement to the five partners; record each yes in the contracts register.
3. Keep the subprocessors page current; any new vendor in the code means an email to every partner 14 days before it goes live.
4. Every DPA promise must be something the code or a runbook already does; if not, fix the code first or change the promise.

## Numbers

| Metric | Definition | Where measured | Status |
|---|---|---|---|
| Partners with a signed DPA | Of the five design partners | Contracts register | Proposed, 0 on record |
| Subprocessor notices sent | Emails sent before a new vendor | hello@ outbox | Proposed |

## Open

1. **Do we offer a DPA now, or only when a partner asks?** Proposal: now, with the partner agreement, because PUMA India is likely to ask.
2. **Breach notice time?** Proposal: 72 hours from confirming, which is a common standard; the lawyer checks Indian law.
3. **Backups after deletion?** Point in time recovery keeps 7 days and daily backups keep 14. Proposal: say backups roll off within 14 days and are never restored for a deleted brand.
4. **Who signs for us?** Proposal: Param, as a designated partner of the LLP; he confirms he is one.