Data Processing Addendum
Our obligations as a processor of personal data on your behalf. Forms part of the Merchant Terms.
Last updated 18 August 2026
Roles
You are the controller of personal data relating to your customers. Cart Catalyst is a processor and acts only on your documented instructions, which for these purposes are the Merchant Terms, this addendum, and your configuration in the app.
Subject matter and scope
| Subject matter | Reporting on product and kit sales performance |
| Duration | For order-derived records, 730 days from the sale |
| Categories of data subject | Customers of your store |
| Categories of personal data | Order identifier, line identifier, product, variant, quantity, unit price, kit identifier, sale timestamp |
| Special category data | None. We do not receive or process special category data. |
Our obligations
- Process personal data only on your instructions and for the purposes described.
- Apply the technical and organisational measures set out in the Privacy Policy, including encryption at rest and in transit.
- Ensure personnel with access are bound by confidentiality.
- Assist you in responding to data subject requests, including via Shopify's compliance webhooks.
- Notify you without undue delay on becoming aware of a personal data breach affecting your data.
- Delete order-derived personal data at the end of the retention period, and on request following uninstall.
Sub-processors
You authorise the sub-processors below. We will give notice before adding a new sub-processor that processes personal data, and you may object.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database hosting | AWS, US West (Oregon) |
| Vercel | Application hosting and scheduled jobs | United States |
| Shopify | Source of the data we receive, on your instruction | Global |
Aggregated data
Monthly aggregates contain no order, line, kit or customer identifiers and are not personal data. We process them for benchmarking and product analytics as described in the Merchant Terms, subject to your right to exclude your store.
Questions about this document: privacy@cartcatalyst.com