Merchant privacy and processing terms

Effective 2026-10-07. Adopted by SoftStudioX and the owner development-store merchant for this release.

Parties, instructions and purpose

Order Profit Protector is operated by SoftStudioX, with support and privacy contact softstudix@gmail.com. The merchant controls its store's customer data. SoftStudioX processes that data on the merchant's behalf to provide the installed app's order import, contribution estimates, descriptive order history and financial risk explanations. The merchant's installation and use instruct this processing; SoftStudioX does not use the data for an independent marketing, data-sale or shared-blacklist purpose.

The merchant is responsible for its lawful basis, customer notices and any required consent for processing. The app does not install marketing tracking or use marketing consent to decide fulfillment. A customer withdrawal or objection that affects this processing must be communicated by the merchant through its Shopify privacy-request process or the support contact. SoftStudioX assists with scoped access, deletion and requests requiring manual reconciliation.

Scope and recipients

Processing covers Shopify order and customer identifiers, order financial values, payment and fulfillment status, line quantities and catalog identifiers, merchant settings, configured costs and saved financial assessment factors. Customer names, contact fields, full addresses and payment card details are not requested. Contact fields delivered incidentally in privacy webhooks are discarded. Shopify credentials are encrypted and excluded from customer exports.

Data remains scoped to the merchant's installation; customer history is not shared between stores. The disclosed infrastructure provider is DigitalOcean, with the app VPS in Frankfurt, Germany. Shopify delivers the authorized data and privacy requests. AI review is disabled in this hosted release. Enabling a new recipient or purpose requires an updated disclosure and applicable authorization before data is sent. These terms do not assert that an unexecuted international transfer agreement exists; any required transfer mechanism must be established before the affected processing begins.

Security, duration and assistance

SoftStudioX restricts access to authorized operations, authenticates merchant access through Shopify, verifies webhook signatures, separates tenants and uses verified encrypted network connections. App database files, temporary database snapshots and the database write-ahead log are stored on an encrypted LUKS2 volume. Runtime processes do not swap decrypted data to disk. Recovery checkpoints are encrypted before transfer to the operator's separate recovery device. Access tokens are additionally encrypted in application storage. These controls do not protect against a compromised authorized server administrator.

Orders and linked cost/assessment records expire one year after the Shopify order creation date. Verified customer deletion requests erase matching records sooner. Uninstall stops ingestion, revokes local sessions and queues store deletion. Completed request receipts and access selectors expire after 30 days; keyed suppression markers last no more than one year, and inactive installation markers no more than 90 days. Restored backups must have subsequent deletions reapplied before access resumes. Backup encryption, retention and recovery must match the verified release configuration and its public notice.

Merchants receive scoped exports through Data privacy even without an active subscription. They must deliver an export securely to the verified requester within the applicable deadline; the app does not email customers directly. SoftStudioX assists merchants with relevant requests and notifies affected merchants of confirmed incidents without undue delay, providing the facts available for their response. Reports go to softstudix@gmail.com.

Availability and acceptance

These terms are available through the public privacy notice and the installed app's Data privacy page. Installing and using the app instructs the processing described here. A merchant who cannot accept these terms must discontinue use and uninstall the app. SoftStudioX retains the owner merchant's 2026-10-07 release adoption record. Material changes to purposes or recipients require updated disclosure and applicable authorization before the change takes effect.