Data processing agreement

1. Parties and roles

The controller is the brand that holds the workspace ("you"). The processor is [LEGAL ENTITY], [ADDRESS], Portugal ("we"). Brand data means everything you or your members add to the workspace, or that a connected shop sends to it. Where brand data includes personal data, this agreement applies to it.

2. Instructions

• We process brand data only on your documented instructions. Those instructions are: the terms, this agreement, and what you do in Toile (uploading, connecting, exporting, deleting).
• We use brand data only to provide Toile to you. We do not sell it. We do not use it to train models. We do not use it to inform what we show any other brand, or to build benchmarks, unless you agree in writing.
• If the law requires us to process brand data in another way, we tell you first, unless that law forbids it.
• If we think an instruction breaks the GDPR, we tell you.

3. Confidentiality

Everyone who can access brand data on our side is bound by a duty of confidentiality. Access is limited to the people who run Toile, and only as far as needed to run, support or fix it.

4. Security

We keep the technical and organisational measures in Annex 2. We may improve them, but never lower the overall level of protection.

5. Sub-processors

• You give general authorisation for the sub-processors in Annex 3.
• We tell workspace owners by email at least 30 days before adding or replacing a sub-processor that handles brand data. You can object in that time, for a reasonable reason. If we cannot meet the objection, you may end the agreement and receive a refund of fees paid for the time after it ends.
• Each sub-processor is bound by a written contract with data protection duties no weaker than these. We remain responsible to you for them.

6. Transfers

We store brand data in the EU. Where a sub-processor handles data outside the European Economic Area, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework for certified companies) or on the Standard Contractual Clauses.

7. Helping you

• If someone asks us to exercise their data protection rights over brand data, we pass the request to you and do not answer it ourselves, unless you ask us to.
• Toile lets you export and delete brand data yourself. Where you need more help with a request, an impact assessment or a question from a supervisory authority, we help as far as is reasonable.

8. Personal data breaches

If we become aware of a breach affecting brand data, we tell the workspace owner without undue delay, and within 48 hours, so you can meet your own 72-hour duty. We tell you what happened, what data and how many people may be affected, what we have done, and who to contact. We keep you updated as we learn more.

9. Deletion and return

You can export brand data at any time. A workspace without a plan is kept read-only until its owner deletes it; we do not delete it on our own. If we end the agreement, owners are emailed first and have 30 days to export. When a workspace is deleted, by its owner or after those 30 days, we delete its brand data from our live systems at once, including its error reports. Backups are overwritten within [BACKUP DAYS] days. We keep nothing longer, unless the law requires it.

10. Audits

On request we give you the information needed to show that we meet this agreement. If that is not enough, you may audit us, or have an independent auditor bound by confidentiality do so, once a year, with 30 days' notice, during working hours, at your cost.

11. Other terms

This agreement lasts as long as we process brand data for you. If it conflicts with the terms of service, this agreement wins on data protection. Liability under this agreement follows the terms of service, except where the GDPR does not allow a limit. Portuguese law applies.

Annex 1. The processing

Annex 2. Security measures

• Separation: each workspace's data is reachable only by its members; membership is checked on every request. Tests check that one workspace cannot read another's data.
• Encryption: HTTPS (TLS) for all traffic, with HSTS. The database is encrypted at rest by Neon. Shop access tokens are also encrypted with AES-256-GCM using our own key.
• Access: passwords hashed; email confirmation required; sign-in rate limits; sessions expire; a password reset ends other sessions. Production access is limited to named people, with two-factor sign-in on every provider account.
• Data minimisation: error reports and logs are stripped of file contents, request bodies, cookies and query strings before they are stored. The stripping of file contents works by pattern (text that looks like rows of a file), so it is a strong filter, not a guarantee. Our own error log keeps the workspace and account id; nothing personal is sent to Sentry. No customer data is taken from Shopify.
• Resilience: managed Postgres with point-in-time backups ([BACKUP DAYS] days). Every change is tested automatically before release.
• Records: a log of who uploaded, replaced or deleted files in each workspace.
• Deletion: deleting a workspace removes its files, versions, settings, members, invitations and shop connection.

Annex 3. Sub-processors