Data Processing Terms

These Data Processing Terms ("DPT") form part of the Smart Inventory Terms of Service between the Shopify merchant ("Merchant") and Avalon Solutions ("Avalon") when Smart Inventory processes personal data on the Merchant's behalf.

1. Roles and instructions

For personal data that Smart Inventory processes solely to provide inventory services for a Merchant, Merchant acts as the business/controller (or equivalent role) and Avalon acts as the service provider/processor. Avalon will process that data only on documented Merchant instructions embodied in the Merchant's use and configuration of Smart Inventory, these DPT, the Terms of Service, and applicable Shopify platform instructions, unless law requires otherwise.

2. Processing details

Subject matter: shared-material inventory management and Shopify inventory/order synchronization.

Duration: for the Merchant's installation/use of Smart Inventory and the limited retention period needed for deletion, reconciliation, security, or legal obligations.

Nature and purpose: receiving Shopify order events, identifying linked variants, reserving/restoring materials, synchronizing inventory, reconciling order changes/refunds, maintaining operational audit records, and securing the service.

Data subjects: customers who place or modify orders with the Merchant.

Data categories: order identifiers, line-item identifiers, product/variant identifiers, quantities, order lifecycle/restock state, and other minimum operational identifiers required for inventory processing. Smart Inventory does not request protected customer name, email, phone, or address fields.

3. Data minimization and purpose limitation

Avalon will process only the personal data reasonably required to provide the service and will not sell it or use it for unrelated advertising, profiling, or marketing.

4. Confidentiality and security

Avalon will maintain reasonable technical and organizational safeguards appropriate to the data processed, including transport encryption, credential encryption, access controls, tenant separation, webhook authenticity verification, and security monitoring. Personnel and service providers with access to protected data are limited to access required for authorized operational purposes.

5. Subprocessors

Avalon may use infrastructure providers to operate Smart Inventory. Current production hosting is provided through Railway. Avalon remains responsible for selecting providers appropriate to the service and requiring protections consistent with these DPT where applicable.

6. Privacy requests and Merchant assistance

Smart Inventory responds to Shopify's mandatory privacy webhooks and will provide reasonable assistance, taking into account the nature of processing, to help Merchant respond to legally required access, deletion, or similar requests relating to data processed by Smart Inventory.

7. Retention and deletion

Avalon will not retain personal data longer than reasonably necessary for the stated inventory-processing purpose. On uninstall, stored background credentials are removed. When Shopify sends the required shop/redact event, Smart Inventory deletes the Merchant tenant's stored app data from its active database, except where retention is required by law.

8. Security incidents

If Avalon becomes aware of a confirmed security incident affecting Merchant personal data processed by Smart Inventory, Avalon will notify the Merchant without undue delay as required by applicable law and will take reasonable steps to contain, investigate, and remediate the incident.

9. International transfers

Where personal data is transferred across jurisdictions, Avalon will use an applicable lawful transfer mechanism when required.

10. Return or deletion

Upon termination of processing, Avalon will delete or return personal data as required by applicable law and these DPT, subject to limited lawful retention obligations and Shopify-mandated privacy workflows.

11. Order of precedence

If these DPT conflict with the Smart Inventory Terms of Service regarding processing of personal data, these DPT control for that subject. The Privacy Policy provides additional transparency regarding the service's data practices.

Contact

Questions about these terms or Smart Inventory's data practices can be sent to avalontechsol@gmail.com.