Instaflow Data Processing Agreement

Last updated: 11 November 2026

This Data Processing Agreement ("DPA") explains how Instaflow handles personal data that it processes for you when you use Instaflow to build, host and measure landing pages for your store. In plain words: you decide what happens to your shoppers' and visitors' data; we only use it to run the service for you; we keep it secure; we use a short list of named subprocessors; we tell you quickly if something goes wrong; we help you answer your shoppers' requests; we never use it to train AI models; and we delete it when you leave. This DPA forms part of our Terms of Service. It does not cover the data we hold about you as an account holder. That data is covered by our Privacy Policy.

1. About this DPA

1.1 This DPA is between:

• Propeller Digital Limited, a private company limited by shares registered in Ireland under company number 784240, with its registered office at Unit 20, Platform 94, Mervue Business & Technology Park, Wellpark Road, Galway, H91 F9PX, Ireland, trading as Instaflow ("Instaflow", "we", "us"); and
• the business that has accepted the Terms of Service ("Customer", "you").

1.2 This DPA forms part of the Instaflow Terms of Service at /terms (the "Terms"). It applies whenever Instaflow processes Customer Personal Data while providing the Services. You accept it when you accept the Terms.

1.3 This DPA is designed to meet Article 28(3) of the GDPR. It also covers the UK GDPR, the Swiss FADP and US state privacy laws where they apply.

1.4 If this DPA conflicts with the Terms, this DPA wins for anything about personal data. If the SCCs apply and conflict with this DPA or the Terms, the SCCs win for the transfer they cover.

2. Definitions

Words defined in the Terms have the same meaning here. Words such as "controller", "processor", "personal data", "processing", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the GDPR. In addition:

• Account Data means personal data about you and your Authorised Users that we process as a controller to run your account. Examples are names, login emails, password hashes, two-factor settings, team membership, billing details, support messages, and security and usage telemetry about the app. Account Data is not Customer Personal Data.
• Applicable Data Protection Law means the GDPR, the Irish Data Protection Acts 1988 to 2018, the ePrivacy Directive as implemented in Ireland (S.I. No. 336 of 2011), the UK GDPR and UK Data Protection Act 2018, the Swiss FADP, and US state privacy laws, in each case to the extent they apply to the processing.
• Authorised Users means your staff and other people you allow to use your Instaflow account.
• Customer Content has the meaning given in the Terms. It includes your inputs, prompts, chat messages, brief text, brand assets, uploaded files, product and store data, and the pages and other Output generated for you.
• Customer Personal Data means personal data that Instaflow processes on your behalf as your processor (or sub-processor) while providing the Services. It is described in Annex 1.
• DPF means the EU-U.S. Data Privacy Framework, the UK Extension to it and the Swiss-U.S. Data Privacy Framework.
• EEA means the European Economic Area.
• FADP means the Swiss Federal Act on Data Protection of 25 September 2020.
• GDPR means Regulation (EU) 2016/679. UK GDPR means the GDPR as it forms part of UK law.
• SCCs means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914. "Module 3" and "Module 4" refer to the modules of those clauses.
• Services means the Instaflow services described in the Terms, including the app at app.instaflow.ai, page hosting at {brand}.instaflow.cc and on your own subdomain, the Instaflow analytics script and ingestion service, and the Instaflow Shopify app.
• Shoppers means your customers whose orders, checkouts and refunds reach us from Shopify.
• Shopify Data means data we receive about your store, your products and your Shoppers through the Shopify APIs and webhooks.
• Subprocessor means a third party we engage to process Customer Personal Data for the Services.
• UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022), as revised from time to time.
• Visitors means people who visit the pages you publish with Instaflow.

3. Roles and scope

3.1 You are the controller. For Customer Personal Data you decide why and how it is processed. You do this by choosing to connect your Shopify store, publishing pages, configuring your Shopify privacy and consent settings, and giving us instructions through the Services.

3.2 If you act for your own clients. If you use Instaflow for someone else (for example, an agency building pages for a brand), you are a processor for that client and we are your sub-processor. You confirm that your client has authorised you to give us the instructions in this DPA, including the use of our Subprocessors. You remain our only point of contact, and you pass on our information and notices to your client. Where a transfer under section 12 is needed in this case, Module 3 of the SCCs applies instead of Module 4 (see Annex 3).

3.3 We are the processor. We process Customer Personal Data only to provide the Services to you and only as described in this DPA and Annex 1.

3.4 Account Data is outside this DPA. We are an independent controller of Account Data. Our Privacy Policy explains how we use it. The same applies to data about visitors to our own website at instaflow.ai and people who use its contact form, and to the product, onboarding and marketing emails we send to Authorised Users.

3.5 Shopify is an independent controller. Shopify processes data about your store and your Shoppers under its own agreement with you. Carts, checkout and payments on your pages run on Shopify. Your pages also send Shopify's own analytics events and load Shopify's privacy banner (Annex 1, part E). We are not Shopify's processor, and Shopify is not our Subprocessor.

4. Your responsibilities

4.1 Lawful basis and notices. You are responsible for having a lawful basis for the processing and for telling Visitors and Shoppers about it. In particular you must:

• (a) keep a privacy policy for your store that describes the Instaflow analytics and order attribution described in Annex 1 (your pages link to your Shopify store's privacy policy);
• (b) configure Shopify's privacy and consent settings for your store correctly. Our analytics only run on pages of stores connected through the Instaflow Shopify app, and only when Shopify's Customer Privacy API reports that analytics processing is allowed. Shopify's settings, not ours, decide where consent is asked for; and
• (c) obtain any consent needed under the ePrivacy rules for the instaflow_visitor_id cookie and related storage on your pages.

4.2 Your instructions must be lawful. Your instructions must comply with Applicable Data Protection Law.

4.3 No sensitive data. You must not use the Services to collect or upload special category data (Article 9 GDPR), criminal offence data, government ID numbers, payment card data or financial account credentials, or personal data of children under 16, unless we agree in writing first. The Services are not designed for this data.

4.4 Your account security. You are responsible for your Authorised Users, their login credentials and the access permissions you give them.

4.5 Page content. You decide what personal data appears in the pages you publish (for example names in testimonials). You must review every page before you publish it, as the Terms require.

5. Our obligations as processor

In line with Article 28(3) GDPR, we will:

• (a) Follow your documented instructions. We process Customer Personal Data only on your documented instructions, including about transfers to a third country, unless required to do otherwise by Union or Member State law to which we are subject. In that case we will tell you about that legal requirement before processing, unless that law prohibits it on important grounds of public interest. Your instructions are: this DPA, the Terms, your settings and use of the Services, and any other written instruction we agree.
• (b) Ensure confidentiality. Everyone we authorise to process Customer Personal Data is bound by confidentiality or is under an appropriate statutory obligation of confidentiality (section 6).
• (c) Keep it secure. We take all measures required by Article 32 GDPR, as described in section 7 and Annex 2.
• (d) Use Subprocessors only as allowed. We engage another processor only under the conditions in Article 28(2) and (4) GDPR and section 9.
• (e) Help with data subject rights. Taking into account the nature of the processing, we help you by appropriate technical and organisational measures, insofar as possible, to meet your obligation to respond to requests from Visitors and Shoppers exercising their rights under Chapter III GDPR (sections 10 and 11).
• (f) Help with Articles 32 to 36. We help you meet your obligations under Articles 32 to 36 GDPR (security, breach notification to the supervisory authority and to data subjects, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to us (section 11).
• (g) Delete or return data at the end. At your choice, we delete or return all Customer Personal Data after the end of the Services and delete existing copies, unless Union or Member State law requires us to store the personal data (section 14).
• (h) Prove compliance. We make available to you all information necessary to demonstrate compliance with Article 28 GDPR, and we allow for and contribute to audits, including inspections, by you or an auditor you mandate (section 13).

We will immediately inform you if, in our opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. We may suspend the affected processing until you confirm or change the instruction. If we cannot reasonably comply with a lawful instruction, we will tell you and you may stop using the affected part of the Services.

6. Confidentiality

6.1 We give access to Customer Personal Data only to staff and contractors who need it to provide, support or secure the Services, and only to the extent they need it.

6.2 Each of them is subject to a duty of confidentiality that continues after their engagement ends.

6.3 We do not sell or share Customer Personal Data, and we do not contact your Shoppers or Visitors directly using Customer Personal Data, unless you instruct us to or the law requires it.

7. Security

7.1 We implement and maintain the technical and organisational measures in Annex 2. They take into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing and the risks to Visitors and Shoppers.

7.2 We may update these measures over time, but we will not reduce the overall level of protection.

7.3 You are responsible for the security of your own systems, your Shopify store, your Authorised Users' credentials, and the settings you choose in the Services (for example, turning on two-factor authentication and granting team roles).

8. Personal data breaches

8.1 If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay and in any case within 48 hours.

8.2 We will send the notice to the email address of your team owner(s) and to any privacy contact you give us. As far as it is known at the time, the notice will describe:

• (a) the nature of the breach, including the categories and approximate number of data subjects and records concerned;
• (b) the name and contact details of our contact point (privacy@instaflow.ai);
• (c) the likely consequences; and
• (d) the measures we have taken or propose to take, and anything we recommend you do.

If we don't have all this information at first, we will give it in phases without undue further delay.

8.3 We will take reasonable steps to contain, investigate and remedy the breach, and we will cooperate with you so that you can notify the supervisory authority and affected people where required. You decide whether and how to notify them.

8.4 Our notice of a breach is not an admission of fault or liability.

8.5 Unsuccessful attempts that do not compromise Customer Personal Data (for example blocked login attempts, pings, port scans or denial-of-service attacks) are not breaches under this section.

9. Subprocessors

9.1 General authorisation. You give us general written authorisation to engage Subprocessors. Our current Subprocessors are listed at /subprocessors, with what each one does, where it processes data and which transfer mechanism applies. You approve those Subprocessors by accepting this DPA.

9.2 Contracts with Subprocessors. We have a written contract with each Subprocessor that imposes data protection obligations no less protective than those in this DPA, including about security, confidentiality, use of the data only to provide services to us, breach notice, deletion, and a ban on training AI models on the data (section 15). These contracts also meet the requirements of Shopify's API Terms for service providers.

9.3 We stay responsible. We remain fully liable to you for each Subprocessor's performance of its data protection obligations.

9.4 Notice of changes. We will give you at least 15 days' notice before a new Subprocessor starts processing Customer Personal Data, or before we replace one. We will:

• (a) email the owner(s) of your team; and
• (b) update the list at /subprocessors, with the date of the change.

The notice will give the Subprocessor's name, what it will do and where.

9.5 Your right to object. You may object to a new or replacement Subprocessor by emailing privacy@instaflow.ai within 15 days of our notice, giving reasonable grounds relating to data protection. We will then discuss your concerns in good faith and, where we can, offer a reasonable alternative.

9.6 Termination as the remedy. If we cannot resolve your objection before the Subprocessor starts processing your data, you may terminate the affected Services by written notice before that date. This is your only remedy for an objection.

9.7 Urgent replacements. If we must replace a Subprocessor urgently for security or legal reasons, we may do so with shorter notice. We will tell you as soon as we can, and your rights under sections 9.5 and 9.6 still apply.

10. Shopify Data and Shopify's privacy webhooks

10.1 Use of Shopify Data. We use Shopify Data only to provide the Services to you, within the limits you set, and as allowed by Shopify's API Terms.

10.2 Compliance webhooks. Shopify sends us privacy requests through its mandatory webhooks. We will complete each of the following within 30 days of receiving the webhook, unless the law requires us to keep the data:

• (a) customers/redact (a Shopper asked you to delete their data): we delete that Shopper's orders, line items, refunds and linked purchase events, matched by the hashed customer ID or email or by the order IDs in the request.
• (b) shop/redact (sent by Shopify about 48 hours after you uninstall the app): we delete the Shopify Data for that store, including all Visitor analytics events, order, line item, refund and currency data, the store overview and product insight files, the AI generations for that store, the store connection and access tokens, and the stored webhook payloads.
• (c) customers/data_request (a Shopper asked you for a copy of their data): we compile the Customer Personal Data we hold about that Shopper and send it to your store's owner contact, so that you can answer the Shopper.

10.3 Uninstalling the app. When you uninstall the Instaflow Shopify app, we disconnect your store and delete its access tokens straight away. The rest of the Shopify Data is deleted under section 10.2(b).

10.4 Pages you published stay yours. shop/redact does not delete the pages you built or published, because they are your Customer Content. They stay until you unpublish and delete them, or until the Terms say we may remove them.

10.5 Helping with your Shoppers' and Visitors' requests. If a Shopper or Visitor asks you to access, correct, delete, restrict or port their data, or objects to processing, we will help you answer:

• (a) for Shoppers, through the Shopify webhooks in section 10.2, which is the main route; and
• (b) for anything the webhooks don't cover (for example a Visitor who gives you the value of their instaflow_visitor_id cookie), by acting on your written request to privacy@instaflow.ai within 14 days and in any case in time for you to meet your legal deadline.

11. Other assistance

11.1 Requests sent to us. If a Visitor or Shopper contacts us directly about Customer Personal Data, we will pass the request to you without undue delay (if we can tell which customer it relates to) and tell the person to contact you. We will not answer the request ourselves unless you instruct us to or the law requires it.

11.2 Articles 32 to 36. Taking into account the nature of the processing and the information available to us, we will give you reasonable help with:

• (a) your security obligations under Article 32, by maintaining Annex 2 and answering reasonable security questions;
• (b) notifying personal data breaches to the supervisory authority and to the people affected under Articles 33 and 34, as described in section 8;
• (c) any data protection impact assessment you need to carry out under Article 35, by giving you information about how the Services process Customer Personal Data; and
• (d) any prior consultation with a supervisory authority under Article 36.

11.3 Costs. Help under this DPA is included in the fees when it is part of the normal Services or caused by our breach. For help that goes well beyond this (for example, bespoke reports or many hours of work), we may charge reasonable costs, which we will agree with you in advance.

12. International transfers

12.1 Where we are. Instaflow is established in Ireland, in the EEA. Our Subprocessors and the regions they use are listed at /subprocessors.

12.2 Customers in the EEA. If you are established in the EEA, sending Customer Personal Data to us is not a transfer outside the EEA, and the SCCs do not apply between you and us.

12.3 Customers outside the EEA. If you are established outside the EEA (for example, a Shopify merchant in the United States), and Customer Personal Data subject to the GDPR passes from us to you (for example, when you view analytics or order attribution in the app, or receive a data export), then, unless your country benefits from an EU adequacy decision (or you are certified under the DPF where it applies to you):

• (a) the parties rely on Module 4 (processor to controller) of the SCCs, which are incorporated into this DPA by reference and completed as set out in Annex 3;
• (b) if you are acting as a processor for your own client (section 3.2), Module 4 still applies between you and us, and you are responsible for any transfer terms between you and your client;
• (c) where the UK GDPR applies to the transfer, the SCCs apply as amended by the UK Addendum, completed as set out in Annex 3; and
• (d) where the Swiss FADP applies, the SCCs apply with the Swiss changes in Annex 3.

The SCCs are governed by Irish law, and disputes about them go to the courts of Ireland, except where the UK Addendum requires otherwise.

12.4 Onward transfers to Subprocessors. Some Subprocessors process Customer Personal Data in the United States or elsewhere outside the EEA, or can access it from there. For each such transfer we rely on:

• (a) the Subprocessor's certification under the DPF, where it is certified and the certification covers the data; or
• (b) otherwise, Module 3 (processor to processor) of the SCCs (with the UK Addendum and Swiss changes where relevant) in our contract with the Subprocessor, or Module 3 SCCs between the Subprocessor's EEA entity and its non-EEA affiliates.

12.5 New transfer mechanisms. If a transfer mechanism we rely on is changed, replaced or found invalid, we may switch to another valid mechanism under Chapter V GDPR by notice to you, as long as it does not reduce the protection of Customer Personal Data.

13. Audits

13.1 Documents first. On your written request, no more than once a year, we will give you the information reasonably needed to show that we comply with this DPA. This includes answers to a reasonable security questionnaire, a summary of our security measures and policies, our current Subprocessor list, and copies or summaries of the certifications or audit reports of our main Subprocessors where their terms allow.

13.2 Audits and inspections. If the documents in section 13.1 are not enough to show compliance, or if a supervisory authority requires it, or after a personal data breach affecting your data, you may carry out an audit (remote or on-site) yourself or through an independent auditor bound by confidentiality. The following rules apply:

• (a) give us at least 30 days' written notice with a proposed scope, date and duration;
• (b) audits are limited to once a year, except where a supervisory authority requires more or after a personal data breach affecting your data;
• (c) the audit must take place during normal business hours and not unreasonably disrupt our business, other customers' data or our security;
• (d) we may object to an auditor who is our competitor or not independent, and you will then choose another; and
• (e) you pay for the audit. We will not charge for our own time unless the audit takes more than 8 hours of our staff time.

If the audit finds that we materially breach this DPA, we will bear our own costs and fix the breach promptly.

13.3 Confidentiality. Audit information and reports are our confidential information. You may use them only to check compliance with this DPA and to meet your legal obligations.

13.4 SCC audits. Any audit under the SCCs follows this section.

14. Return and deletion

14.1 During the term. We keep Customer Personal Data only for the periods set out in Annex 1, part D, and delete it automatically after that.

14.2 When you delete things. When you delete a page, a team or your account, or uninstall the Shopify app, we delete the related Customer Personal Data as described in the Services and in section 10.

14.3 On termination. When the Services end, you can export the data the Services allow you to export. We will then delete all Customer Personal Data within 30 days after the end of the Services, unless you ask us in writing before the end to return a copy first.

14.4 Backups. Copies in backups are deleted as the backups expire, within 7 days. Until then we keep them secure and do not use them for any other purpose.

14.5 Legal retention. We may keep Customer Personal Data longer only where Union or Member State law requires us to store it. In that case this DPA continues to apply, and we keep the data only for the period and purpose that law requires.

14.6 Certificate. On your written request we will confirm in writing that deletion is complete.

15. No AI training

15.1 We never train on Customer Personal Data. We do not use Customer Personal Data, including any anonymised, aggregated or derived version of it, to create, develop, train, fine-tune or improve any machine learning or artificial intelligence model, whether ours or anyone else's.

15.2 Pages and content only with your opt-in. We do not use Customer Content, Output or Shopify Data for those purposes either, unless you turn on the "Help improve Instaflow" setting described in section 12 of the Terms. If you do, we first take reasonable steps to remove personal data from the Pages and briefs we use, and we use page performance only in aggregated form. That use is therefore not processing of Customer Personal Data under this DPA. Accepting the Terms or this DPA does not turn the setting on. You can turn it off at any time.

15.3 Our model providers don't train on it either. We use AI model providers (currently OpenAI, through its API) only to generate Output for you. Our contracts with them prohibit using your data to train or improve their models, and to use it for their own purposes. We do not store prompts and responses at OpenAI for later use (our requests are sent with storage of responses turned off). OpenAI keeps prompts and responses in its abuse-monitoring logs for up to 30 days and then deletes them, unless the law requires it to keep them longer. Every other Subprocessor is bound by the same no-training restriction (section 9.2).

15.4 What we may do. We may record usage metrics that contain no personal data and no Customer Content (for example, the number of pages generated or credits used) to run, bill and secure the Services.

15.5 No significant automated decisions. The Services do not make decisions about Visitors or Shoppers that produce legal or similarly significant effects on them. Analytics and attribution are used only to report on page performance to you.

16. US state privacy laws

16.1 Where the CCPA or another US state privacy law applies, you are the "business" or "controller" and we are your "service provider", "contractor" or "processor".

16.2 We will not:

• (a) sell or share Customer Personal Data (as those terms are defined in those laws);
• (b) retain, use or disclose it for any purpose other than providing the Services, or outside our direct business relationship with you; or
• (c) combine it with personal data we receive from others or collect ourselves, except as those laws allow.

16.3 We will give it the level of protection those laws require, and we will tell you if we can no longer meet our obligations. You may take reasonable steps to stop and fix any unauthorised use.

16.4 We certify that we understand and will comply with these restrictions. Notice under section 9 and audits under section 13 meet our obligations under those laws for Subprocessors and audits.

17. Liability

17.1 Each party's liability under or in connection with this DPA, and under the SCCs between the parties, is subject to the limits and exclusions of liability in the Terms. Those limits apply to this DPA and the Terms together, not separately.

17.2 Nothing in this DPA limits:

• (a) the rights of data subjects under the SCCs or Applicable Data Protection Law; or
• (b) any liability that cannot be limited by law.

18. Term, changes and law

18.1 Term. This DPA applies from when you accept the Terms and lasts as long as we process Customer Personal Data, even after the Terms end.

18.2 Changes. We may change this DPA only as the Terms allow (30 days' notice of material changes). We may also make changes needed to comply with the law or a supervisory authority, or to adopt a new transfer mechanism, as long as they do not reduce the protection of Customer Personal Data.

18.3 Law and courts. This DPA is governed by Irish law, and the courts of Ireland have exclusive jurisdiction, as set out in the Terms.

18.4 Supervisory authority. Our lead supervisory authority is the Data Protection Commission (Ireland).

19. Contact

• Instaflow data protection contact: privacy@instaflow.ai, Propeller Digital Limited, Unit 20, Platform 94, Mervue Business & Technology Park, Wellpark Road, Galway, H91 F9PX, Ireland.
• Your contact: the email addresses of your team owner(s), and any privacy contact you add to your account. Keep these up to date. Notices under this DPA are sent there.

Annex 1: Description of the processing

A. Parties

• Controller (or processor, under section 3.2) / data exporter: the Customer named in its Instaflow account. Contact: the team owner email(s). Activities: selling products through a Shopify store and using Instaflow to build, host and measure landing pages.
• Processor / data importer: Propeller Digital Limited trading as Instaflow, Unit 20, Platform 94, Mervue Business & Technology Park, Wellpark Road, Galway, H91 F9PX, Ireland, Ireland. Contact: privacy@instaflow.ai. Activities: providing the Instaflow AI landing page builder, page hosting, analytics and order attribution.

B. Categories of data subjects

• Visitors: people who visit the pages you publish with Instaflow.
• Shoppers: your customers whose orders, checkouts and refunds reach us from Shopify.
• Your staff and other people named in Customer Content: for example names in brand assets, briefs, uploaded files, testimonials or reviews. (Your Authorised Users' account details are Account Data and are not covered.)

C. Categories of personal data

1. Visitor analytics events (only on pages of stores connected through the Instaflow Shopify app, and only once Shopify's Customer Privacy API allows analytics processing; pages of stores linked by public storefront collect none):

• Identifiers: a random visitor ID kept for 180 days in the instaflow_visitor_id cookie and in local storage, and a random session ID kept in session storage for the browser tab session.
• Page and campaign data: the page URL including its query string, UTM parameters (source, medium, campaign, content, term) and ad click IDs (gclid, fbclid, ttclid, msclkid); the page title; and the referrer URL and domain.
• Coarse location: country, region and city, derived by Cloudflare from the IP address at the time of the request. The IP address itself is not stored.
• Device data: device type, browser and operating system, and a bot flag, parsed from the user agent. The raw user agent string is not stored.
• Shopping events: page views, product views, add-to-cart and begin-checkout events, with product, variant, collection, cart and checkout IDs, currency, quantity, value, discount, tax and shipping.
• Event data: the event ID, name, type and time, the shop domain and the page ID, and any custom event properties you send.

2. Shopify order data (from the orders/create, orders/paid and orders/cancelled webhooks):

• order ID and name, timestamps, currency, totals, refunded total, financial and fulfilment status, source name, landing site, referring site, cart and checkout tokens, and UTM parameters;
• the Shopper's email and Shopify customer ID, stored only as keyed HMAC-SHA256 hashes;
• line items: product and variant IDs, SKU, vendor, titles, quantity and prices; and
• raw_order_json and raw_line_item_json: the order and line-item payload as received, after recursive removal of these keys: billing_address, browser_ip, client_details, contact_email, customer, email, phone and shipping_address. Shopper names, addresses, phone numbers, email, browser IP and client details are therefore not stored.

3. Checkout and refund data:

• Checkouts (checkouts/create): landing site URL and path, referring site, UTM source, medium and campaign, cart and checkout tokens, currency, quantity, amounts and source name. No email or customer fields.
• Refunds (refunds/create): refund ID, order ID, timestamps, currency, refund amount and refunded quantity. No email or customer fields.
• Purchase events created from paid orders, and the store's currency history.

4. Product data, store data and page content:

• product and store data read from Shopify through the Storefront and Admin APIs, store domains, brand data, AI store overviews and product page insights, and public store and product pages read for you;
• your briefs, prompts and chat messages; the files in your team's file library (images, fonts and text files, up to 3 MB each and 100 per team); product images you ask the AI to edit; and the generated page code, copy and images; and
• the content of your published pages.

This is mostly business data, but it can contain personal data, for example names in reviews or testimonials, or staff names in briefs and files.

5. Shopify privacy request data: the payloads of Shopify's customers/data_request, customers/redact and shop/redact webhooks. These can include a Shopper's email, phone number, customer ID and order IDs. They are stored encrypted and used only to carry out the request.

Special category data: none. Section 4.3 applies.

D. Nature and purposes of the processing

We process Customer Personal Data only to provide the Services to you, namely:

• Hosting: serving your published pages to Visitors from Cloudflare's network on {brand}.instaflow.cc or your own subdomain, including the cart cookie (instaflow_cart_{shopDomain}, 10 days) that keeps a Visitor's Shopify cart.
• Analytics: collecting, validating and storing Visitor events, filtering out bots, and reporting page performance to you.
• Attribution: linking Shopify checkouts, orders and refunds to the page that produced them (through the _instaflow_landing_page_id cart attribute and UTM data) and reporting revenue by page.
• AI generation: generating, editing, building and previewing pages from your Customer Content using AI models and isolated build sandboxes, including generating page images and editing your product images.
• Privacy requests: carrying out Shopify's privacy webhooks and your instructions under sections 10 and 14.
• Security, support and troubleshooting of the above.

Frequency: continuous, while you use the Services.

E. What happens on Shopify's side (for information)

Your pages also run Shopify features that Shopify provides to you directly, as an independent controller: the cart and checkout, Shopify's privacy banner and consent cookies, Shopify's own analytics events (page views and add-to-cart, with URL, referrer, user agent and Shopify's _shopify_y and _shopify_s cookies, only when consent is given), and the data-sale opt-out. Instaflow does not receive or store that data, except as described in part C.

F. Duration and retention

The processing lasts for the term of the Terms and ends with deletion under section 14. Within that period:

G. Subprocessors

See /subprocessors. Subprocessors process Customer Personal Data only for the purposes in part D.

H. Competent supervisory authority

The Data Protection Commission (Ireland) is our lead supervisory authority. For Module 4 SCCs, see Annex 3.

Annex 2: Technical and organisational security measures

This Annex lists the measures in place in the Services today.

1. Data minimisation and pseudonymisation

• No IP addresses in analytics. The ingestion service stores only the country, region and city derived by Cloudflare.
• No raw user agents. The user agent is parsed into device, browser and OS; the raw string is discarded.
• Hashed Shopper identifiers. Shopper email and Shopify customer ID are stored only as HMAC-SHA256 hashes keyed with a secret.
• PII keys removed from orders. Billing and shipping addresses, browser IP, client details, contact email, customer object, email and phone are removed recursively from order and line-item payloads before storage.
• Consent gating. Analytics run only on pages of stores connected through the Shopify app, and only when Shopify's Customer Privacy API allows analytics processing. Events queued before consent are dropped if consent is not given.
• Bot filtering. Bot traffic is flagged and excluded from processed analytics.
• Short raw retention. Raw events are deleted automatically after 1 day.

2. Encryption

• In transit: all Services endpoints (the app, page hosting, the analytics and webhook endpoints, and the file buckets) are served over HTTPS (TLS). Login session cookies are Secure and httpOnly in production.
• At rest (application level): Shopify admin access and refresh tokens, two-factor (TOTP) keys, two-factor recovery codes and Shopify privacy webhook payloads are encrypted in the database by the application.
• At rest (infrastructure level): database, object storage and analytics storage are encrypted at rest by our hosting providers.

3. Access control to the Services

• Passwords are hashed with Argon2 and never stored in readable form.
• Optional two-factor authentication (TOTP). Once enabled, it is required again in every new session.
• Session tokens are stored only as SHA-256 hashes. Sessions expire after 30 days.
• Short-lived codes: email verification and password reset codes expire after 10 minutes.
• Role-based team permissions: owner, admin, editor and custom roles. Only owners manage billing and other owners, and editors can only work on pages.
• Invites expire after 7 days and can only be accepted by the invited email address.

4. Access control for our staff and systems

• Access to production systems and Customer Personal Data is limited to named staff who need it, with multi-factor authentication.
• Access rights are reviewed at least every 12 months and removed promptly when someone leaves.
• Production secrets are kept in a secrets manager, not in source code.
• Test and development use separate data from production.

5. Isolation

• Per-page isolation: each published page runs as its own Cloudflare Worker in a Workers for Platforms namespace, separate from other customers' pages.
• Isolated build sandboxes: page code is built and previewed in isolated E2B sandboxes. Preview sandboxes stop 10 minutes after last use, and build runs have time and output limits.
• Separate services: analytics ingestion and Shopify webhook processing run as separate Cloudflare Workers from the main app.

6. Protection of inputs and endpoints

• Shopify webhook verification: Shopify webhooks are verified by HMAC signature before they are processed.
• Bot protection: Cloudflare Turnstile protects signup, and disposable email domains are refused.
• Ingestion limits: the analytics endpoint accepts at most 64 KB and 20 events per request, rate-limits to 1,000 requests per minute per store and page, rejects events with out-of-range timestamps, and checks that the request origin matches the page URL.
• Uploads: all files you upload go to your team's file library in a private storage bucket, through signed URLs, with type and size limits (images, fonts and text files, up to 3 MB each and 100 per team). Store overviews and product insights are also stored privately. A file becomes public only if the AI copies it into a page and you publish that page. AI-generated page images are stored publicly, because published pages display them.

7. Monitoring and logging

• Server-side error tracking is configured not to collect user details, cookies, request or response bodies, IP-like headers, query parameters or AI inputs and outputs.
• In production, the Instaflow app loads Better Stack's JavaScript tag only for users who accept it in the app's cookie banner. It can record session replays, browser errors, web vitals, console logs, clicks and form submissions, and a browser fingerprint. It does not identify users by name or email. Its settings are in the Better Stack dashboard: sample rate and text and input masking it records every session of users who accept, with text and form inputs masked..
• AI pipeline logs contain only IDs, status and timings, no content, and are kept for 3 days.

8. Data storage locations

• Visitor analytics and order data are stored in Tinybird on AWS eu-central-1 (Frankfurt).
• Uploaded files are stored in Cloudflare R2 with the EU jurisdiction setting.
• The application database is hosted by Render in the US (Oregon).

9. Organisational measures

• Encrypted backups, tested restores, and a backup retention period of up to 7 days.
• Vulnerability and patch management, including dependency updates.
• A named owner for our security policy.

Annex 3: SCC selections (Module 4, UK Addendum and Switzerland)

This Annex applies only where section 12.3 applies.

Part 1: EU SCCs, Module 4 (processor to controller)

1. Parties and signature. The data exporter is Instaflow (processor). The data importer is the Customer (controller, or processor under section 3.2). Each party is treated as having signed the SCCs, including Annex I, by accepting the Terms.
2. Module. Module 4 applies. (Where the Customer is a processor for its own client, Module 4 still applies between the parties: section 12.3(b).)
3. Clause 7 (docking clause): not used.
4. Clause 11 (redress): the optional wording is not used.
5. Clauses 14 and 15: apply only where Instaflow combines the personal data received from the Customer with personal data collected by Instaflow in the EU, as those Clauses provide.
6. Clause 17 (governing law): the SCCs are governed by the law of Ireland.
7. Clause 18 (choice of forum): disputes arising from the SCCs are resolved by the courts of Ireland.
8. Annex I.A (list of parties): Annex 1, part A of this DPA.
9. Annex I.B (description of the transfer):
   • Categories of data subjects and personal data: Annex 1, parts B and C.
   • Sensitive data: none.
   • Frequency: continuous, while the Customer uses the Services.
   • Nature of the transfer: Instaflow makes Customer Personal Data available to the Customer through the Instaflow app (analytics and attribution reports) and through exports, including answers to Shopify customers/data_request webhooks.
   • Purpose: to provide the Services, as described in Annex 1, part D.
   • Retention: Annex 1, part F.
10. Clause 9 (sub-processors), Clause 13 (supervision), Annex I.C and Annexes II and III do not apply to Module 4. Annex 2 of this DPA describes our security measures for information.
11. Liability: Clause 12 is subject to section 17, to the extent the SCCs allow.

Part 2: UK Addendum

Where the UK GDPR applies to a transfer from Instaflow to the Customer, the SCCs in Part 1 apply as amended by the UK Addendum:

1. Table 1 (parties): as in Part 1, item 1 and Annex 1, part A.
2. Table 2 (selected SCCs, modules and clauses): the version of the approved EU SCCs incorporated by this DPA, Module 4, with the selections in Part 1.
3. Table 3 (appendix information): Annex 1 of this DPA.
4. Table 4 (ending the Addendum when the Approved Addendum changes): neither party.
5. Part 2 (mandatory clauses): the parties agree to the Mandatory Clauses of the Approved Addendum. As required by those clauses, the UK Addendum and the SCCs as they apply to UK transfers are governed by the law of England and Wales, and disputes about them go to the courts of England and Wales.

Part 3: Switzerland

Where the Swiss FADP applies to a transfer from Instaflow to the Customer, the SCCs in Part 1 apply with these changes:

1. References to the GDPR are to the FADP, where the transfer is subject to it.
2. The competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner (FDPIC).
3. The term "Member State" must not be read so as to stop data subjects in Switzerland from suing in their place of habitual residence (Switzerland).
4. Governing law and forum remain Irish (Part 1, items 6 and 7).

This document was adapted from a template prepared and made publicly available by General Legal, PC. General Legal has not reviewed, and takes no position on, any modifications made to it.