Data processing agreement

Version 2026-10-30 · Oru Studio LLC

This agreement forms part of the service terms between Oru Studio LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA (the processor), and the merchant accepting it (the controller). It governs personal data processed through ShipReconcile and prevails over conflicting service terms on data protection.

Scope and instructions

The merchant instructs us to obtain recent Shopify order and shipment records, match them with merchant-uploaded carrier charges, generate reports, and perform support, security, deletion and export operations needed to provide the service. Processing lasts for the subscription and the limited deletion periods below. Data subjects are the merchant’s customers and authorized store users. Records include shop and order identifiers, order dates, tracking numbers, shipping amounts, currencies, tax flags, invoice numbers and charge descriptions. Do not upload customer names, contact details, payment-card data or sensitive personal data.

The merchant determines lawful purposes, provides required notices, establishes a lawful basis and is responsible for its instructions and source records. We process data only on documented lawful instructions, including this agreement and authorized app actions, unless law requires otherwise. We will inform the merchant of a legal requirement unless prohibited, and notify it if an instruction appears to violate applicable data-protection law. We do not sell, rent, advertise against or independently profile customer data.

People, security and incidents

Access is limited to authorized personnel who need it and are bound by confidentiality. We maintain proportionate access controls, HTTPS transport, encrypted credential storage, encrypted backups and restricted database access. We review security measures as the service changes. If we become aware of a personal-data breach affecting merchant data, we will notify the merchant without undue delay, share available facts, likely effects and mitigation, and provide updates as the investigation progresses.

Service providers and transfers

The merchant authorizes Contabo GmbH to provide server and database hosting. Shopify provides the commerce platform, authenticated API access and subscription billing under its own terms. We remain responsible for subprocessors’ performance of our processing obligations and require equivalent data-protection duties. Before adding or replacing a subprocessor, we will give at least 30 days’ notice through the app or the merchant’s designated contact. The merchant may object on reasonable data-protection grounds; if no suitable alternative is available, it may stop processing and terminate the service.

Oru Studio LLC is a United States entity. Cross-border processing must have any safeguards required by applicable law. This agreement alone is not a standard contractual clause or an adequacy decision. Contact naimkst@gmail.com before transferring data that requires additional transfer terms; we will arrange the applicable safeguards before that processing begins.

Requests, cooperation and verification

We assist the merchant with access, correction, deletion and other individual-rights requests, taking account of the service’s data and capabilities. We forward requests received directly to the merchant unless law requires otherwise. We also provide reasonable information and assistance with security, breach notifications, impact assessments and regulator consultations. On request, we supply information demonstrating compliance and permit proportionate audits by the merchant or its independent confidential auditor, with reasonable notice and protection of other tenants’ data. Urgent regulator or incident-related requests are handled promptly.

Return and deletion

The merchant can export reports and delete imports in the app. Invoice imports expire after 90 days; order snapshots after 60 days. Uninstall and shop-erasure notifications trigger deletion of app records. Customer erasure removes linked records and imports; minimal order identifiers are retained to prevent reimport while the installation remains active. Backups expire after seven days and are isolated from ordinary use; erasure instructions must be reapplied before a restored service resumes. At termination, we delete or, at the merchant’s choice, return remaining data and delete copies, except data that law requires us to retain, which remains protected and restricted.

Contact and changes

Send processing instructions, designated notification contact details, security inquiries and audit requests to naimkst@gmail.com. Material changes require a new version and renewed merchant acceptance before new syncs or imports. Obligations protecting retained data survive termination.