Data Processing Agreement

1. Who this agreement is between

This agreement is between Pay Tech Payments LLC (303 South Water Street, Ste 200, Henderson, NV 89015), which operates Atlas by Covr, and each store that installs Atlas (“the store” or “you”). It applies from the moment a store installs the app.

“Shoppers” means your customers. “Personal data” means information about an identifiable shopper. “Applicable privacy law” means the data protection laws that apply to the processing, including US state privacy laws and, where they apply, the GDPR and UK GDPR.

2. Roles

You are the controller of your shoppers’ personal data, and Atlas is your processor. We process it only to run Atlas for your store, as described here, and on your documented instructions. Installing the app, approving its permissions, and choosing its settings are your instructions.

3. What we process, and why

• Checkouts we text about: the shopper’s phone number and first name, the products and value of the cart, and whether they have ordered before, to send the texts and to put new customers first.
• Conversations: the texts sent and received, and STOP requests, so a conversation can continue, your team can read it, and a shopper who said stop is never texted again.
• Orders the texts brought back: the order number and amount, and any refund or cancellation, to show you the results and bill you correctly.
• Read but not kept: the shopper’s SMS marketing consent in Shopify, the state in the checkout’s address, their own orders when they ask about one, and your products.

We never read shoppers’ email addresses. We do not sell personal data, share it for advertising, or use one store’s data for another.

4. Consent to be texted

By default Atlas texts only shoppers who subscribed to your text marketing in Shopify, on that same number. If you choose to also text numbers shoppers left at checkout, you confirm you have their consent to be texted. Either way, a STOP reply ends texts from your store at once and permanently.

5. Our people

Only the people who run Atlas can reach production data, only when their work needs it, and each is bound to keep it confidential.

6. How we protect it

• Encryption in transit (TLS) on every connection, and encryption at rest for the database and its backups.
• Your store's Shopify access key is encrypted again with a key held only in our production environment, and expires and renews on Shopify's schedule.
• Only the Shopify permissions Atlas needs: orders, customers and products, read only.

7. Sub-processors

Each receives only what its part needs, is bound by contract to protect it and use it for nothing else, and may not sell it.

• Vercel (US): hosting.
• Neon (US): the database.
• Sendblue (US): delivers the texts.
• Anthropic (US): the AI that drafts replies.

We post any change to this list here, with a new date at the top, before a new provider receives personal data. If you object, tell us; if we can’t address it, you may stop using Atlas and we will delete your data as described in section 10.

8. Where the data is

Personal data is stored and processed in the United States. Where applicable privacy law requires a transfer mechanism for data from outside the US, the parties rely on the standard contractual clauses that law recognizes, which are incorporated by reference.

9. Shoppers' requests

When a shopper asks to see or delete their data, Shopify sends us the request on your behalf. A deletion request removes their checkouts and conversations automatically, keeping only a STOP request, because forgetting it would let texting start again. A request to see their data is answered within 30 days. If a shopper contacts us directly, we tell you and help you respond.

10. How long we keep it, and when you leave

We keep your data while you use Atlas. If you uninstall, we stop texting about your checkouts and stop reading your store’s data at once, and when Shopify asks us to erase your store’s data (48 hours later) we delete your conversations, checkouts and results automatically, keeping only STOP requests as above.

11. If something goes wrong

If we become aware of a breach of security that leads to the accidental or unlawful loss, disclosure of, or access to your shoppers’ personal data, we will tell you without undue delay, and within 72 hours of confirming it: what happened, what data was involved, what we have done, and who to contact. We will help you meet any duty you have to notify shoppers or regulators.

12. Information and audits

We will answer your reasonable written questions about how we protect personal data, and give you the information you need to show this agreement is being followed, once a year or after a breach.

13. Everything else

This agreement is governed by the laws of the State of Nevada. If it changes in a way that matters, we change the date at the top and post the new version here. Our Privacy Policy describes the same practices for shoppers. Questions go to support@covrprotection.com.