How AwesomeSoft processes merchant-controlled personal data when providing Postli links, social publishing, AI tools and revenue attribution.
This DPA covers personal data Postli processes on your behalf and forms part of our Terms of Service. Read it alongside the Privacy Policy.
This Data Processing Agreement ("DPA") forms part of the Postli Terms of Service between AwesomeSoft ("Processor") and the merchant accepting those Terms ("Merchant"). It applies when Postli processes personal data on the Merchant's behalf. The Merchant is the controller or, where it acts for another controller, an authorised processor. The Merchant's identity and contact details are those associated with its Shopify store and subscription. The DPA takes effect when the Merchant accepts the Terms for services involving such processing.
"Applicable Data Protection Law" means privacy and data-protection law applicable to the processing, including the GDPR and UK GDPR where applicable. Terms such as personal data, controller, processor and personal-data breach have the meanings given by that law. AwesomeSoft's independent account, billing, support and public-site processing is described in the Privacy Policy.
| Subject matter | Postli short links, social publishing, media, analytics and Shopify revenue attribution. |
|---|---|
| Nature and purpose | Collecting, recording, organising, storing, retrieving, transmitting, analysing, matching, returning and deleting data to deliver the Merchant's configured service and support. |
| Duration | For the service relationship and the period needed to return or delete data under section 10, subject to lawful retention. |
| Data subjects | Merchant owners and staff, connected account representatives, customers, leads, storefront visitors and people whose personal information the Merchant includes in authorised content. |
| Personal data | Store/account identifiers; contact details; social profile/page/organisation identifiers and tokens; posts, comments, prompts and media; links and UTM parameters; click IDs and IP hashes; approximate location, referrer, device and event data; order and conversion identifiers, customer emails, external customer IDs, amounts, currency, timestamps and merchant-supplied metadata. |
| Sensitive data | Not required or intended. The Merchant must not submit special-category data, payment-card details, credentials in prompts, or children's data. |
| Frequency | Ongoing, as the Merchant configures and uses features; AI processing occurs when requested. |
AwesomeSoft will process entrusted personal data only on the Merchant's documented instructions, including these Terms and DPA, the Merchant's app settings and authorised service requests, and instructions about transfers, unless law requires otherwise. We will inform the Merchant of a legal requirement before processing unless prohibited by law, and promptly inform it if we consider an instruction infringes applicable data-protection law.
The Merchant determines purposes and lawful bases, ensures it has authority to provide instructions, supplies accurate privacy notices, obtains required tracking consent, handles its controller obligations, and configures accounts and access appropriately. Where it acts as processor, it warrants its controller has authorised this appointment and the instructions. Instructions outside the service's scope require agreement on feasibility and any reasonable cost.
AwesomeSoft will ensure personnel authorised to process entrusted data are bound by confidentiality obligations or an appropriate statutory duty, have access only as necessary for their work, and receive appropriate data-protection guidance. Confidentiality continues after their access or engagement ends.
AwesomeSoft will maintain technical and organisational measures appropriate to the risk, taking account of the nature of data, state of the art and implementation costs. Measures include shop-scoped authorisation and Shopify session-token verification; encryption of stored social access/refresh token fields; HTTPS service connections; authenticated compliance webhook handling; and hashing of IPs in click records. Raw requests may still be processed in queues and operational logs.
We will limit privileged access, manage credentials, address security vulnerabilities, maintain procedures for restoring service following an incident, and assess measures as risks change. The Merchant remains responsible for its Shopify staff access, connected platform permissions and the data it chooses to publish. This DPA does not represent a certification, a guarantee against every incident, or a claim that all operational logs and backups are anonymous.
The Merchant grants general written authorisation for the following sub-processors, limited to the functions described:
| Provider | Function and data | Location |
|---|---|---|
| Vultr | Application and database hosting; entrusted app records and media stored on the server | Piscataway, New Jersey, United States |
| Anthropic | Optional AI generation/optimisation; submitted prompt, draft and selected product/platform context | United States; provider processing locations may vary |
Vercel hosts the marketing site; Microsoft Clarity and Google/GTM support public-site analytics. They do not receive Merchant app records merely because the Merchant installs Postli. Shopify and social platforms selected by the Merchant receive data under the Merchant's authorisations and their own terms; they are not automatically AwesomeSoft sub-processors for all their activities.
Before engaging a sub-processor for entrusted data, we will impose written obligations providing equivalent data-protection safeguards and remain responsible for its performance as required by law. We will give at least 30 days' notice of intended additions or replacements through an account contact or service notice, allowing an objection on reasonable data-protection grounds. We will work to resolve an objection; if no reasonable alternative is available, the Merchant may terminate the affected service before the change. Contact us for current provider and processing-location details before enabling a feature requiring a particular residency arrangement.
Taking account of the processing, AwesomeSoft will provide appropriate technical and organisational assistance with requests for access, correction, deletion, restriction, portability and objection. We will notify the Merchant of a request concerning entrusted data and will not respond substantively except on its instructions or as law requires. The Merchant is responsible for verifying and responding to its data subjects.
Shopify compliance handlers assist with access to matching conversion events and redaction of customer email/external identifiers. They do not guarantee that every record relating to an individual is automatically identified or deleted. Contact us for requests requiring additional assistance.
AwesomeSoft will notify the Merchant without undue delay after becoming aware of a personal-data breach affecting entrusted data. We will provide available information about its nature, affected categories and approximate numbers where known, likely consequences, response measures and a contact point; further details may follow in phases. We will cooperate with reasonable investigation and mitigation requests. The Merchant determines and makes required notifications to regulators and individuals unless applicable law requires otherwise.
Taking account of the nature of processing and information available to us, we will assist the Merchant with its obligations concerning security, breach notifications, data-protection impact assessments and prior consultation with supervisory authorities. We will provide reasonably necessary information and cooperate with competent authorities as required by law. Reasonable additional assistance beyond ordinary service support may be subject to agreed charges, without limiting legally required cooperation.
At the end of processing, at the Merchant's choice, AwesomeSoft will return or delete entrusted personal data and delete existing copies unless law requires retention. Request an export before uninstalling, or contact us to arrange return or deletion of records not exposed in the app. We will agree a practical method and timing, taking account of legal deadlines and Shopify's redaction process.
The app's shop/redact handler deletes the shop and related app records and stored media when Shopify delivers that request, ordinarily no earlier than 48 hours after uninstall. Uninstalling alone does not mean instant erasure. Customer redaction clears matching conversion email/external identifiers; additional requests may require manual assistance. Disconnecting a social connection marks it inactive and does not immediately remove stored tokens; platform authorisations can be revoked in the platform's settings.
Lawfully retained data will be isolated from ordinary use and used only for the retention purpose. Residual backup copies will remain protected, will not be restored to ordinary processing except for recovery, and will be deleted through the applicable backup lifecycle; contact us for the current schedule. We will confirm completion on reasonable request. Copies already published to social platforms or held by Shopify remain under those parties' controls.
AwesomeSoft will make available information reasonably necessary to demonstrate compliance with this DPA and allow and contribute to audits, including inspections, by the Merchant or its authorised independent auditor. Audits should use existing documentation where sufficient, take place with reasonable notice during business hours, and protect security and other customers' confidential information. These arrangements must not prevent an audit required by law, a regulator or a credible breach concern. Scope, confidentiality and reasonable costs will be agreed in advance where practicable.
The Merchant acknowledges that the app/database are hosted in the United States and service administration/support may involve access from Bangladesh. Optional providers and Merchant-selected platforms may process data elsewhere. AwesomeSoft will process transfers only on documented instructions and in compliance with applicable transfer restrictions.
Where an adequacy decision does not apply and a restricted transfer requires contractual safeguards, the parties must execute the appropriate EU standard contractual clauses and/or UK transfer instrument, with the correct modules, parties and completed annexes, before that transfer. This DPA is not itself a completed SCC or UK addendum and does not promise EU-only residency. Contact us to arrange required transfer documentation before providing data that requires it. Mandatory transfer safeguards prevail over conflicting commercial terms.
This DPA lasts for as long as AwesomeSoft processes entrusted data, including retained copies. It prevails over conflicting Terms for data-protection obligations; mandatory law and any executed transfer clauses take precedence. The Terms govern liability and disputes only to the extent permitted by applicable law and without reducing mandatory data-subject rights or liability. Material changes will be notified through appropriate account/service channels and must not reduce protections required by law.
Processor: AwesomeSoft, operator of Postli. For instructions, provider details, signed documentation, audits, security incidents or data return/deletion, email awesomesoft.io@gmail.com. Include your Shopify shop domain and an authorised contact; do not include credentials or unnecessary customer information.