Data processing addendum
Effective 15 October 2026
This addendum is part of our terms of service and applies automatically when you install RebutCase. It covers the personal data of your customers that we process for you. You are the controller of that data and Zoviotech (Zovio Technologies) is your processor. It is written to meet Article 28 of the GDPR and the UK GDPR, and the service provider rules of US state privacy laws such as the CCPA. No signature is needed.
What we process
| Purpose | Building and saving responses to your Shopify Payments disputes, repeat disputer alerts, and answering Shopify's customer data and redaction requests |
|---|---|
| People | Your customers whose orders are disputed |
| Data | Name, email address, billing and shipping addresses, Shopify customer ID, order, payment check, fulfillment and refund details of the disputed order, and the count of earlier orders. No card numbers and no special categories of data. |
| How long | While the app is installed, within the retention periods in our privacy policy |
Our commitments
- We process the data only to provide RebutCase as you use it, which is your documented instruction. If we think an instruction breaks data protection law, we tell you.
- We do not sell the data, share it for advertising, or use it for any other purpose, including training AI models.
- Only the developer who runs RebutCase can access it, under a duty of confidentiality.
- We keep it secure: HTTPS in transit, encryption at rest, field-level encryption of names, emails, addresses and notes, no customer details in logs, and two-factor sign-in on every production account.
- We help you answer your customers' requests to see or delete their data. Shopify's customer data and redaction requests are handled automatically, and we pass on any request sent to us directly.
- If a breach affects your customers' data, we tell you without undue delay and within 72 hours of confirming it, with what we know and what we are doing about it.
- We give you the information you need to show compliance, and answer reasonable written questions about our security within 30 days.
Subprocessors
You allow us to use the providers listed in our privacy policy (Railway, Neon, OpenAI, Resend, Cloudflare and Google). Each is bound by data protection terms at least as protective as this addendum, and we stay responsible for them. Before we add or replace a provider, we update that list and tell you in the app or by email at least 14 days ahead. If you object for a reasonable data protection reason, you can uninstall the app before the change, and we refund any prepaid fees for the time left.
International transfers
Our providers store and process data in the United States. Transfers of data from the EEA, the UK or Switzerland rely on the European Commission's Standard Contractual Clauses (with the UK addendum where needed) in our providers' data processing terms.
When the service ends
When you uninstall RebutCase, Shopify sends us a deletion request 48 hours later and we delete all of your store's data, including your customers' data. You can delete it sooner in the app, under Settings, Delete all my app data. Deleted data leaves our database provider's restore history within 7 days.
Contact
Data protection questions and requests: support@zoviotech.com.