Merchant data processing terms
Version: 2026-10-19
1. Parties and instructions
SoftStudioX provides InstaPay Payment. The installing merchant controls why buyer payment evidence is collected and is responsible for lawful instructions, customer notices and the underlying sale. SoftStudioX processes evidence on the merchant’s instructions to provide this app. Shopify provides the store, order and subscription platform under its own terms. Authorized use of the app’s settings and review, export and deletion controls supplies processing instructions.
2. Data and purpose
Processing includes receiving, validating, compressing, encrypting, storing, displaying, exporting and deleting an order reference or ID, buyer InstaPay username or phone, optional payment screenshot, and minimal order eligibility information. Store identity, app settings and installation credentials support operation and security. The app does not receive funds, connect to banks, authenticate screenshots or automatically mark orders paid. Merchants must check actual bank receipt and use Shopify’s payment controls. Do not submit PINs, passwords, OTPs or unrelated financial information.
3. Confidentiality and use limits
SoftStudioX uses buyer evidence solely to provide this merchant-directed service, never for sale, advertising, AI training or automated eligibility decisions. Operational access must be authorized, limited to the task and subject to confidentiality obligations. The merchant must restrict access to its Shopify account and any exported evidence. Minimal operator account and security records are used to administer and protect the service.
4. Security and responsibility
Controls include HTTPS, authenticated merchant access, store-scoped queries, encrypted evidence and installation tokens, independently encrypted backups, image re-encoding, verified Shopify webhooks and minimized logs. These terms do not promise an availability SLA or establish that a screenshot proves payment. Both parties must maintain appropriate access controls and cooperate on security enquiries.
5. Retention and ending the service
Live evidence expires after 29 days, access is denied at expiry, and cleanup runs hourly. Encrypted snapshots run every six hours, expire after 12 hours and are cleaned hourly; expired live evidence is removed before each new snapshot. Operator-managed live and snapshot copies remain below 30 days during normal operation. Merchant deletion, uninstall and applicable Shopify redaction requests delete live evidence earlier; existing snapshots age out on that schedule. Recovery purges restored evidence before reopening service. Merchant exports, bank records and Shopify records follow their respective controllers’ policies. Uninstall the app to stop future processing; uninstall clears the merchant agreement acceptance record.
6. Requests and incidents
Customers contact their merchant for access or deletion. SoftStudioX provides authenticated export/deletion controls, mandatory Shopify privacy webhook handling and support at softstudix@gmail.com. A customer redaction request removes all claims for the store because typed claims are not mapped to verified customer IDs. SoftStudioX will assist with relevant privacy requests and notify the merchant without undue delay after confirming a breach affecting its evidence. The merchant remains responsible for required customer and regulator notices.
7. Infrastructure and international processing
The primary server, local database and encrypted snapshots run on DigitalOcean infrastructure in Frankfurt, Germany (fra1). DigitalOcean publishes provider data-processing terms, including transfer provisions, at digitalocean.com/legal/data-processing-agreement. The server region does not establish the locations of all provider support or control-plane processing, merchant access or Shopify processing. SoftStudioX must maintain appropriate provider agreements and any safeguards required by applicable law before permitting covered transfers. Only providers necessary to operate the app may process evidence. SoftStudioX will notify merchants before a new provider or material location change and allow a data-protection objection before the change. Merchants can contact support or uninstall if an objection cannot be resolved.
8. Accountability and acceptance
SoftStudioX will make relevant processing and security information available through documentation and reasonable support requests without disclosing another merchant’s data or credentials. Material changes require a new published version, merchant notice and renewed acceptance. An authorized merchant representative accepts this version using the app’s explicit agreement control; a buyer upload checkbox is separate. The app records the store, version and acceptance time, without collecting additional buyer data. These terms do not override mandatory law or Shopify’s platform agreements. Questions and notices: softstudix@gmail.com.