Data Processing Addendum
This addendum is part of the terms on which PRS CLOUD TECH PRIVATE LIMITED ("we", "us", the Processor) provides Lyrakart Customer Mobile App to a Shopify merchant ("you", the Controller). The merchant accepts it by installing the app and, where the app asks, by ticking the acceptance box. It applies to personal data of your shoppers and staff that we process for you. Our privacy policy describes the data in more detail; if the two differ, this addendum governs for merchant-controlled data.
1. Roles
- For shopper data (customer records, orders, devices, app activity, forms, community and chat content) you are the controller and we are the processor. We process it only to provide the app to you and only on your documented instructions, which are your use of the app's settings and these terms.
- For your staff accounts and billing contact data we act as controller for running the service, keeping an audit trail and security.
- If we believe an instruction breaks the law we will tell you.
2. What we process
| Category | Data | Purpose |
|---|---|---|
| Shopper identity | Email (stored as a one-way hash), Shopify customer ID, tags, marketing-consent flag, order count, total spent, last order date. Name, phone and address are not read from Shopify. | Push audiences, automations, linking an app install to a customer |
| Orders | Order number, totals, currency, payment and fulfilment status, discount codes, app attribution | Attribution, reporting, order-status messages |
| Shopper-supplied | Email, name, phone typed into sign-in, appointment, quote, contact or newsletter forms; community posts, live chat, assistant questions, prescription files (only if you switch the feature on) | Providing that feature for you |
| Device and activity | Install ID, platform, model, OS and app version, language, country, push token, notification permission, screens viewed, taps, searches | Push delivery, analytics, fixing problems |
| Staff | Name, email, role, login and change history | Accounts, roles, audit trail |
Data subjects are your shoppers and your staff. We do not process payment card data; checkout is Shopify's.
3. Sub-processors
You authorise these sub-processors. We will update this list before adding one that handles shopper data, and you may object by writing to us before the change takes effect.
| Sub-processor | What it processes | When |
|---|---|---|
| Shopify | Store, customer and order data, billing, app sign-in | Always |
| Hosting provider of our server at 160.250.204.8 | All data held by the app: database, files, backups | Always |
| Anthropic | Assistant questions and product context sent to its model API | Only if you switch on the shopping assistant or AI writing help |
| eWebGuru (mail) | Recipient address and text of account and notification emails | Always, for emails we send |
| Apple and Google (push and app stores) | Push token and notification content | When you publish an app and send pushes |
| Expo | App build and, later, over-the-air updates. No shopper data is intended to pass through it. | Planned; not in use for shopper data today |
| Mux or Cloudflare (live video) | Live-show video and viewer connection data | Only if you enable live shows with that provider |
We have written terms with sub-processors that we can contract with; for Shopify, Apple, Google, Anthropic and Cloudflare/Mux those are their standard terms. We remain responsible to you for them.
4. Our duties
- Staff with access to personal data are bound by confidentiality and limited to what their work needs.
- We apply the measures in our security overview. We will not lower the level of protection during the term.
- We help you answer shopper requests (access, export, correction, deletion). Shopify's data-request and redact messages are answered automatically; a shopper can also delete their account inside the app or at /d/<app key>.
- We help with your own impact assessments and regulator questions, on reasonable request.
- We let you check our compliance by written answers to reasonable questions, and by a call or document review once a year, or after a breach.
5. Retention and deletion
- Shopper data is kept while you use the app. Shopper account deletion removes the shopper's data straight away, except commercial records that are anonymised.
- Raw Shopify webhook messages are deleted after 7 days when handled (customer and order topics) and in any case after 30 days. Contact messages are deleted after 400 days.
- When you uninstall, we stop syncing. Shopify sends a shop redaction request after 48 hours, and we delete the store's data within 30 days; if no request arrives we delete it 30 days after uninstall anyway.
- Backups are kept 7 days on the server and 14 days in the encrypted off-site copy, so deleted data leaves backups within 14 days after deletion from the live system.
- Copies you exported to your own tools are yours and we cannot recall them. If law requires us to keep something we say so and keep only that.
6. Personal data breach
If we confirm a breach affecting your data, we tell you without undue delay and in any case within 72 hours of confirming it, by email to your account owner. The notice says what happened, which data and shops are affected, what we have done and what we advise. We follow our incident response policy (summary in the security overview). We send more detail as we learn it.
7. Your duties as controller
You are responsible for having a lawful basis and any consent needed for the shopper data you ask us to process, for the notices you give your shoppers, and for the features you switch on. You must not send us special-category data except in features designed for it (the prescription feature), and then only with the shopper's consent.
8. International transfers
Our server and company are in India. Sub-processors above may process data in other countries. Where the law of your shoppers' country requires a transfer mechanism, we will sign standard contractual clauses with you on request.
9. Term and law
This addendum lasts as long as we process data for you. Liability under it follows the limits in the main terms. Indian law applies unless your local data-protection law requires otherwise.
10. Contact
PRS CLOUD TECH PRIVATE LIMITED, H-65, Sector 63, Noida, India 201301 · info@lyrakart.com
Privacy policy · Data Processing Addendum · Security overview