1. Roles and scope
For personal information that a Shopify merchant submits to Order Elite or makes available through authorized Shopify APIs, the merchant generally acts as controller or business and Firgelli Automations Inc. acts as processor or service provider. Each party remains responsible for the obligations that apply to its role. These terms apply only to processing needed to provide Order Elite under the merchant's documented instructions.
2. Merchant instructions
Documented instructions include installing and configuring Order Elite, using its staff workflows, enabling supported integrations, and submitting verified support or privacy requests. FIRGELLI will notify the merchant if an instruction appears to violate applicable data-protection law unless the law prohibits notice.
3. Processing details
- Purpose: customer and order lookup; RMA, replacement, reship, add-on and manual-order creation; shipping selection; payment requests; linked history; fulfillment handoff; security; support; and legal compliance.
- Data subjects: merchant staff, customers, recipients, and contacts whose information appears in authorized commerce records.
- Data types: identifiers, contact details, addresses, order and product details, payment and fulfillment status, shipping and tracking context, staff notes, optional business tax identifiers, and security or audit events.
- Duration: the active installation period, followed by the event-based deletion and 30-day privacy-export schedule in the privacy policy. A legally required record is kept only for its applicable statutory period.
4. Confidentiality and security
Personnel authorized to process merchant data are bound by confidentiality obligations. We use least-privilege access, tenant separation, encrypted transport, secret management, logging controls, vulnerability management, incident handling, backup protection, and access offboarding appropriate to the service and risk.
5. Subprocessors
FIRGELLI Automations may use subprocessors needed to operate Order Elite and requires them to protect personal information through appropriate contractual and security obligations. The current provider list and purposes appear on the subprocessors page. Material changes are dated on that page, and merchants may contact us with a reasonable data-protection concern.
6. Assistance
Taking into account the nature of processing and information available, FIRGELLI will provide reasonable assistance with verified data-subject requests, security obligations, breach response, impact assessments, regulator consultations, and evidence reasonably needed to demonstrate compliance.
7. Privacy events and requests
Shopify's mandatory customer data request, customer redaction, and shop redaction events are handled through the authenticated app workflow. Merchants and individuals can also follow the privacy request process. A public contact page does not replace the platform's required compliance webhooks.
8. Return and deletion
On uninstall, access sessions are deleted. Customer-linked data is deleted or irreversibly redacted when a verified customer-redaction request is processed, and remaining tenant-scoped personal information is deleted or irreversibly redacted when Shopify sends the verified shop-redaction event. Encrypted customer-data export artifacts expire 30 days after creation. A legally required record is isolated and kept only for its applicable statutory period.
9. International transfers
FIRGELLI Automations and its providers may process information in the United States, Canada, and other countries where the service or a merchant-enabled provider operates. We use safeguards required by applicable law for protected cross-border transfers.
10. Compliance information and contact
Upon reasonable written request, FIRGELLI Automations provides information needed to demonstrate these commitments, subject to confidentiality, security, and the rights of other merchants. Questions can be sent to apps@firgelliauto.com.