GDPR & data requests

Who is the controller

For conversations on your storefront, you are the controller and Shoplite is your processor. You decide the agent's purpose and configuration; we process shopper data on your instructions and for no independent purpose.

For your own merchant account - your shop domain, your login, your plan - we are the controller. A data processing addendum covering the processor relationship is available from [email protected].

Requests that arrive through Shopify

Shopify requires every app to implement three mandatory privacy webhooks, and we handle all of them. Each is acknowledged immediately and the work is queued, so a request never fails because a job took too long.

You do not need to do anything to make these work. They are active from the moment you install.

If you are a shopper

Contact the store you were talking to. They are the controller of that conversation, and they can raise the request with us on your behalf - the routes above are built for exactly this.

If you cannot reach the merchant, write to [email protected] with the store and roughly when you spoke to the agent, and we will help identify the right controller.

If you are a merchant

Export and erasure are available from Settings → Privacy in the dashboard, and by email if you would rather we did it. Tell us the customer identifier or the shop, and what you need.

We answer within thirty days, and usually much faster. If a request is complex enough to need longer, we will tell you before the thirty days are up rather than after.

Retention

Nothing is kept indefinitely just because it might be useful. These are the outer limits:

Subprocessors

These are the third parties that may process personal data on our behalf. We will give notice before adding to this list, and you may object.

International transfers

We are based in the United States and our subprocessors may process data outside your country. Where personal data leaves the EEA or the UK we rely on Standard Contractual Clauses, together with the UK Addendum where relevant.

Copies of the mechanisms we rely on are available on request.

Security measures

Platform credentials are encrypted at rest. Webhooks are HMAC-verified against the raw request body before processing, and App Proxy requests are signature-verified, so we act only on genuine Shopify traffic. Dashboard access uses signed, HTTP-only session cookies with per-shop roles.

Model providers are used under terms that prohibit training on data we send them.

Breach notification

If a breach affects personal data we process for you, we will notify you without undue delay and with enough detail for you to meet your own notification duties as controller.

Contact

Privacy and data requests: [email protected]. Postal: Zitrino LLC, 16192 Coastal Highway, Lewes, Delaware 19958, United States. We do not currently have a statutory Data Protection Officer; requests are handled by the team that built the system.