Trust & transparency · Updated 3 October 2026

Data Processing Addendum

Scope and instructions

For store data processed to provide RevenueGuard, the merchant determines the purposes and acts as controller; the RevenueGuard operator acts as processor under the merchant's documented service configuration and lawful instructions. Merchant account administration may involve the operator's separate responsibilities. This Addendum forms part of the Terms of Service between the merchant and the individual operator identified below, and applies for the duration of the service and necessary deletion period. Processing is limited to the documented instructions in this agreement, the merchant’s configuration and lawful written requests.

Data and purpose

Processing comprises retrieving authorized Shopify catalog/configuration and limited recent order signals, performing synthetic checks, generating store-level monitoring observations, storing incidents/evidence, and delivering configured notifications. The service does not require customer name, email, phone or address fields for order anomaly detection. Raw orders and customer profiles are not retained. Synthetic checkout data must be fictional and merchant-authorized. Merchant account/team contact details and alert destination addresses are processed to operate the service.

Confidentiality and safeguards

The operator restricts access to authorized persons subject to confidentiality, protects credentials and synthetic profiles with AES-256-GCM field encryption, encrypts local evidence objects, uses HTTPS for public/API transport, and enforces workspace and Store access controls. The operator will maintain appropriate access revocation and assist merchants with reasonable information requests about these safeguards. This Addendum makes no claim of certification or verified whole-disk or backup encryption.

Subprocessors and transfers

Hosting, database/object storage, Shopify and configured notification providers support the service. The merchant authorizes providers in these categories as necessary to deliver the configured service. Provider identities, processing locations and applicable transfer safeguards are available from the privacy contact below. The operator remains responsible for its subprocessors’ processing obligations, will give notice of intended additions or replacements, and will allow the merchant to raise reasonable data-protection objections before the change. Transfers requiring additional safeguards will use an applicable lawful transfer mechanism. Merchant-selected alert endpoints are subject to the merchant's instructions. RevenueGuard does not sell customer data or use it for unrelated advertising.

Requests, incidents and deletion

The operator will assist with applicable data subject requests and notify the merchant of a confirmed personal-data breach without undue delay, using the contact arrangements established for the service. Shopify compliance webhooks are HMAC-verified. Customer requests normally find no customer-linked records. Uninstall stops operation; shop/redact erases store data and queues evidence deletion. Order observations expire after 90 days, temporary diagnostics after 7 days and technical timeline/trace/video after 30 days. Incident history can remain until store erasure. Backup expiry and restoration procedures require operator configuration so erased data is not reintroduced.

At termination the operator will delete or return applicable data under lawful merchant instructions, except a documented legal obligation. RevenueGuard does not assert an automatic legal-retention exception. Contact the operator for requests, security matters, subprocessor details or evidence of controls. Send privacy requests, processing instructions, subprocessor objections and security concerns to the privacy contact below. The operator will notify the merchant if an instruction appears to infringe applicable data-protection law and provide reasonable assistance with applicable compliance obligations.

Operator and contact

RevenueGuard is operated by Yavor Iliyanov Zagorski, an independent developer based in Bulgaria.

Legal name: Явор Илиянов Загорски
Address: с. Сандрово, ул. Марица 20, България

Privacy, data protection and security contact: info@youneed.dev.