Data Processing Agreement
Last updated 1 September 2026 · forms part of the Terms of Service
NordStock is not available yet. It is not in the Shopify App Store, so no merchant data is being processed under this agreement today. It takes effect on the day you install the app.
This agreement covers Article 28 of the GDPR. When you install NordStock, you decide what happens to your data and we act on your instructions. In the language of the regulation: you are the controller, we are the processor.
1. Who is who
Controller: you, the merchant who installed NordStock.
Processor: Nordvara.ai, Bart Vrancken. Contact: our support window.
This agreement is entered into when you install the app and ends when you uninstall it and the deletion below has run.
2. What we process, and why
Purpose: running the inventory features you asked for — suppliers, purchase orders, receiving, cost history, reporting and the AI assistant.
Nature: storing, reading, calculating and writing back to your Shopify store.
Categories of data subjects: your staff who use the app, and the contact people at your suppliers.
Categories of personal data:
- Store owner and staff: shop domain, email address of the account that installed the app
- Supplier contacts: name, email address, phone number, as you enter or import them
- Audio: a short voice clip, only when you use voice input, only for the moment it takes to turn it into text
We do not process your customers’ personal data. We read order quantities and prices to calculate stock and margin, not names or addresses.
No special categories. Nothing here falls under Article 9.
3. Our instructions come from you
We process personal data only on your documented instructions. Installing the app and using its features is that instruction. If we ever have to process data because a law requires it, we tell you first — unless that same law forbids us from telling you.
If an instruction from you appears to breach the GDPR, we say so.
4. Confidentiality
Access is limited to the people who need it to run the service. Today that is one person, the developer. Anyone with access is bound to confidentiality.
5. Security
The measures we take, in plain terms:
- Everything travels over HTTPS; nothing is sent in the clear
- Data at rest is encrypted by our database provider
- Every row carries the shop domain, and every query is filtered on it — one merchant cannot read another’s data
- Access tokens live in server-side environment variables, never in the browser and never in the repository
- Webhooks from Shopify are verified by HMAC signature before we act on them
- Backups are handled by our database provider within the EU
6. Sub-processors
You give general authorisation for the sub-processors below. We will tell you before we add or replace one, and you may object.
| Sub-processor | What it handles | Where |
|---|---|---|
| Supabase | Database — all data described in section 2 | EU (Frankfurt) |
| Vercel | Hosting and request logs. Visitor counts on our public website are cookieless and hold no personal data | EU region |
| Anthropic | Your question plus the relevant stock figures, when you ask the AI assistant or run a forecast | US |
| OpenAI | The audio clip, when you use voice input | US |
7. Transfers outside the EU
Two sub-processors are in the United States: Anthropic and OpenAI. Those transfers rest on the European Commission’s Standard Contractual Clauses, which form part of our agreements with them.
If you would rather no data left the EU at all: the AI assistant and voice input are the only features that send anything to the US. The rest of NordStock — suppliers, purchase orders, receiving, cost history, reporting — stays inside the EU. Tell us and we will switch those two features off for your store.
8. Helping you meet your obligations
If one of your staff or a supplier contact asks to see, correct or delete their data, we help you answer within the legal deadline. Tell us through the support window and we will find and act on it.
We also help with data protection impact assessments and with consultations with a supervisory authority, as far as the information sits with us.
9. If something goes wrong
If we become aware of a personal data breach, we notify you without undue delay and in any case within 48 hours, with what we know: what happened, which data, how many records, and what we are doing about it. You decide whether the authority and the people involved need to be told; that call is yours as controller.
10. Deletion at the end
When you uninstall the app, Shopify sends us a shop redact request. We purge every record belonging to your store — products, suppliers, purchase orders, receipts, cost history, movements, subscriptions.
Shopify allows 48 hours for this. We do it in one pass and return an error if any part fails, so a partial delete cannot pass for a complete one.
You can also ask for deletion at any time without uninstalling.
11. Audits
You may ask us to demonstrate that we comply with this agreement. In practice: ask, and we answer in writing, including the security details in section 5. If you need an on-site audit, we arrange it at a reasonable time and you carry the cost.
12. Your data is always yours
Everything you put into NordStock can be exported as CSV at any time, without asking us. See the privacy policy for what that covers.
13. Which text wins
Where this agreement and the Terms of Service disagree about the processing of personal data, this agreement wins. For everything else, the terms apply.
A note on this document. It is written to be read, not to be survived, and it reflects how NordStock actually works today. It is not legal advice. If your own counsel needs changes or a signed copy on your paper, ask through the support window — that is a normal request and we will not make it difficult.