Legal

Data processing agreement

Effective 7 September 2026 · Hatzlacha Management LLC

This agreement is between Hatzlacha Management LLC, which operates Affiliate Loop (“we”, the processor), and the merchant who installs it (“you”, the controller). It takes effect when you install the app and stays in force for as long as it is installed. It forms part of the terms you accept on install, and where it conflicts with any other terms between us on the subject of personal data, this agreement wins.

1. Roles

You decide why and how the personal data of your customers and your affiliates is processed. You are the controller. We process it only to provide the app to you, on your instructions. We are the processor. We never sell personal data, never share it with a third party for that third party’s own purposes, and never use it to build profiles or train models.

2. What we process, and why

Subject matter — running your affiliate and creator programme. Duration — for as long as the app is installed, plus the short deletion window in section 7.

Your customers. On an order that one of your affiliates was credited for, we store the order id, order name, order subtotal, the buyer’s email address and Shopify customer id, which affiliate was credited, and how. The email is used to show you who an affiliate brought and to stop an affiliate earning commission on their own purchase. We do not store customer names, phone numbers, addresses or payment data. Orders that no affiliate was credited for are not stored.

Your affiliates. Name, email address, the referral code and coupon they were issued, their commission rate, what they have earned and been paid, and any content they submit to you. This is your business relationship with them; we hold it on your behalf.

Visitors who click a referral link. The click, the referral code, the destination, a coarse timestamp, and a hash of the visitor’s IP address salted with the day, which lets a click be de-duplicated without the record becoming a location history. The address itself is never stored.

3. Our instructions are yours

We process personal data only on your documented instructions, which the act of using the app’s features constitutes, and as required by law. If a law requires us to process it otherwise, we will tell you before we do, unless that law forbids us from telling you.

4. Confidentiality and staff

Everyone with access to your data is bound by confidentiality, is granted the least access that lets them do their work, and loses that access the day they no longer need it. Accounts with production access require multi-factor authentication and unique passwords held in a password manager. There are no shared logins.

5. Security

We maintain the technical and organisational measures described in our security and incident response policy, which forms part of this agreement: encryption in transit and at rest, encrypted backups, per-shop isolation enforced in the data layer, separated test and production data, and an access log for personal data. We will not weaken those measures during the term.

6. Sub-processors

You give us general authorisation to use the sub-processors below. Each is bound by terms no less protective than these. We will give you notice before adding or replacing one, and you may object on reasonable data protection grounds, in which case you may terminate by uninstalling the app.

• 01

  Render

  Application hosting and the PostgreSQL database. United States.

• 02

  Resend

  Transactional email: affiliate sign-in links and programme notices. Receives affiliate email addresses only, never buyer addresses. United States.

• 03

  Shopify

  The source of the order and customer data we process, and your own platform. Not a sub-processor in the ordinary sense, listed for completeness.

If you connect your own Meta advertising account or your own email sending credentials, data flows to those services under your relationship with them, not ours.

7. Deletion and return

Uninstalling deletes your sessions immediately. Programme data is held for a short window in case the uninstall was accidental, then erased in full; Shopify also compels this through its shop/redact webhook forty-eight hours after uninstall. You can export your commission and payout ledger as CSV at any time while the app is installed, and we recommend doing so before you uninstall.

8. Helping you meet your obligations

We answer Shopify’s customers/data_request and customers/redact webhooks automatically, which covers most requests your customers make through Shopify. For anything else — a request that arrives directly, a regulator’s question, a data protection impact assessment — write to us and we will give you the information and assistance you reasonably need, taking into account the nature of the processing and what is available to us. If a data subject contacts us directly, we will not answer on your behalf; we will tell them to contact you and tell you it happened.

9. Breach notification

We will notify you without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting your data, with what happened, the categories and approximate volume of data involved, the likely consequences and the measures taken. You are the one who notifies your customers and, where required, your supervisory authority; we will give you what you need to do it.

10. Audit

On reasonable written request, no more than once a year unless a breach or a regulator makes it necessary, we will provide the information needed to demonstrate compliance with this agreement and will cooperate with an audit you or an independent auditor you appoint carries out, on reasonable notice and without disrupting the service or exposing another merchant’s data.

11. International transfers

The app and its sub-processors are hosted in the United States. Where you are in the EEA, the UK or Switzerland, transfers are made under the European Commission’s Standard Contractual Clauses, module two, controller to processor, which are incorporated into this agreement by reference, with the UK Addendum where the UK GDPR applies. The details in sections 1, 2 and 6 populate the annexes.

12. Liability and changes

Nothing here limits either party’s obligations under applicable data protection law. We may update this agreement to reflect a change in the app or in the law; a material change is notified by email to the address on your Shopify account before it takes effect, and continuing to use the app after that is acceptance.

Contact