Data Processing Agreement

Last updated: 27 October 2026. Tilltrend is pre-launch. This Data Processing Agreement (DPA) supplements the Terms of Service and Privacy Policy and governs the processing of personal data that the operator of Tilltrend carries out on the merchant's behalf.

We wrote this the same way we built the product: plainly, with no claims we can't stand behind. Where the merchant or its customers are in the EU, GDPR Art. 28 applies to the operator as processor, alongside the Serbian Law on Personal Data Protection (ZZPL) as the home regime.

1. Parties

• Controller (the merchant): the Shopify merchant who installs and uses Tilltrend. The merchant decides why and how the personal data in its store is processed.
• Processor (the operator): Vladimir Vukojičić, the person who operates Tilltrend, of Belgrade, Serbia. The processor processes that personal data only on the controller's behalf.

The app itself is not the processor. Tilltrend is software; the processor is the person who operates Tilltrend.

2. Subject-matter & duration

This DPA covers the processing of personal data that the processor performs to provide the Tilltrend service to the controller. It takes effect when the controller installs Tilltrend or otherwise accepts it, and it continues for as long as the processor processes personal data on the controller's behalf, after which the deletion-or-return terms in section 11 apply.

3. Nature & purpose of processing

The processor provides read-only, governed analytics over the controller's Shopify data: building governed metrics, answering questions in the app, preparing the data exports the controller requests, and operating, securing, supporting, and improving the service. The processor reads store data through the Shopify API under the scopes the controller approves at install.

4. Categories of data subjects & types of personal data

• Categories of data subjects: the merchant's customers.
• Types of personal data: names, contact details, and order history that live in the merchant's Shopify store.

The processor does not seek special categories of personal data; any present in the store is processed only incidentally, in providing the service.

5. Processor obligations

The processor will:

• Process personal data only on the controller's documented (written) instructions, including any instruction to transfer personal data to another country or international organisation, unless required to do otherwise by a law that applies to the processor; in that case the processor will inform the controller of that legal requirement before processing, unless the law forbids it.
• Apply appropriate technical, organisational, and personnel security measures to protect the personal data (see section 7).
• On termination of the service, delete or return all personal data and all copies on the controller's decision, unless a law that applies to the processor requires the data to be retained (see section 11).

Processor-becomes-controller warning. If the processor ever determines the purposes and means of any processing of the personal data itself, it becomes a controller for that processing and takes on the corresponding obligations. This DPA describes the processor acting only on the controller's behalf.

6. Confidentiality

The processor keeps the personal data confidential and ensures that the people authorised to process it are bound by an appropriate duty of confidentiality. Access is limited to personnel who need it to provide the service.

7. Security measures

The processor applies, and maintains, the following measures. No method of storage or transmission is perfectly secure, and the processor does not claim otherwise.

• Least-privilege, read-only database role for analytics and BI connections.
• Shopify webhook verification: the authenticity of every Shopify webhook is verified before the processor acts on it.
• Encrypted storage of access tokens and connected credentials issued at install (encrypted at rest).
• EU data location: the service and the controller's warehouse are hosted in Germany (EU).
• Nightly backups with a tested restore procedure, and independent uptime monitoring of the service.

8. Sub-processors

The controller authorises the processor to engage the following sub-processors:

• Shopify: the platform the store and billing run on.
• Anthropic (United States): the AI provider behind the Ask feature; receives the question the controller types and, on request for an interpretation, the governed query results behind the answer, which can include rows at per-customer grain (pseudonymous identifier, country, order count, spend). No direct identifier is transmitted.
• Hetzner Online GmbH (Germany): cloud hosting for the service (EU, Falkenstein).
• Neon: managed Postgres; the controller's warehouse is stored in Neon's eu-central-1 region (Frankfurt, Germany, on AWS infrastructure).
• Cloudflare: network edge (DNS, TLS, tunnel) in front of the service.

The processor will give the controller advance notice of any intended addition or replacement of a sub-processor, and the controller may object on reasonable data-protection grounds. The processor imposes the same data-protection obligations on each sub-processor by contract (flow-down) and remains responsible to the controller for its sub-processors' performance.

9. Assistance to the controller

Taking into account the nature of the processing, the processor will assist the controller with:

• Data-subject requests: requests from the merchant's customers flow through Shopify's mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact), which Tilltrend implements.
• Breach notification: the processor will notify the controller without undue delay after becoming aware of a personal-data breach affecting the controller's data, and will provide the information then available so the controller can meet its own regulatory notification deadlines (under GDPR, the 72-hour notification to the supervisory authority).
• Data protection impact assessments (DPIAs) and prior consultations, where the controller reasonably needs the processor's input.

10. International transfers

The service and the controller's warehouse are hosted in Germany (EU); the Ask feature sends the controller-typed question and, on request for an interpretation, governed-query results (which can include per-customer rows) to Anthropic in the United States. Providing the service can therefore involve cross-border transfers of personal data. The processor carries out such transfers only on the controller's instructions and where appropriate safeguards are in place.

11. Deletion or return on termination

On termination of the service, the processor will delete or return all personal data and all copies, on the controller's decision, unless a law that applies to the processor requires retention. In practice: on uninstall the processor deprovisions the tenant and deletes the warehouse built from the store. For the public Tilltrend app from the Shopify App Store, Shopify sends a shop/redact request after the uninstall and the deletion runs on receipt. A design-partner store runs on a private, single-store app, which is subscribed to the same request. On either app the processor also runs the same deletion by hand on the controller's request, and confirms it to the controller. A customer removed at the source via customers/redact falls out of the analytics on the next sync.

12. Audit & information rights

The processor will make available to the controller the information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by the controller or an auditor it mandates, on reasonable notice and subject to confidentiality.

13. Order of precedence

For matters concerning the processing of personal data, this DPA prevails over the Terms of Service in the event of a conflict.

14. Acceptance

The controller accepts this DPA by installing or using Tilltrend, and both parties are bound by it from that moment. No signature is needed. If the controller wants a signed copy for its records, it can ask at contact@tilltrend.app and the processor will countersign one.

15. Contact

Questions about this DPA: contact@tilltrend.app.