Aovly data-processing agreement
Version 2026-11-06-v1 · Provider: Oru Studio · Contact: naimkst@gmail.com
This agreement takes effect for a merchant only when its authorized representative accepts it in the authenticated Aovly app. The acceptance record identifies the shop, authenticated Shopify merchant session, version and date. It governs personal data Oru Studio processes on that merchant’s behalf using Aovly.
Purpose and instructions
The merchant controls its customer data and instructs Oru Studio to deliver optional product offers, manage discounts, authenticate app access, calculate consent-permitted storefront attribution and refunds, and fulfill privacy requests. Oru Studio acts as processor for these operations and uses the data only on documented lawful instructions, including this agreement and app settings. If an instruction appears unlawful, Oru Studio will notify the merchant and suspend the affected processing while the issue is resolved. Legally required processing will be disclosed beforehand unless prohibited.
Data and people concerned
Processing concerns shoppers, merchant staff and support contacts. Records include shop and order identifiers, offer identifiers, amounts, currencies, timestamps, product selections, staff-session information, authorization credentials and short-lived purchase tokens. Order and refund payloads are processed transiently; customer names, contact details, addresses and payment-card information are not retained from them. Support messages may contain the information their sender includes. Do not include sensitive customer information in offer text or support email.
Merchant responsibilities and choices
The merchant provides lawful customer notices and any required consent, selects appropriate products, configures Shopify privacy settings and ensures it has authority to appoint Oru Studio. Aovly respects Shopify’s analytics and marketing processing permissions for optional storefront attribution. Offers remain usable without attribution. Oru Studio does not sell customer data, use it for unrelated advertising, or use it to train general-purpose models.
Confidentiality and security
Access is restricted to authorized personnel who need it and are subject to confidentiality obligations. Oru Studio maintains HTTPS, authenticated requests, shop isolation, restricted credentials, encryption for application database storage and backups, retention controls, backup recovery procedures and security monitoring. Protection will not be materially reduced during the agreement. Encryption protects stored volumes; it does not prevent authorized server administrators from accessing mounted data.
Subprocessors and international processing
The merchant authorizes Contabo for hosting and Google’s email service for support correspondence, subject to applicable written processing terms. Oru Studio remains responsible for its subprocessors’ obligations and will provide their contracting entities, processing locations and applicable safeguards on request. Shopify separately provides the merchant’s commerce, identity and checkout platform under its own agreements. Before any transfer requiring additional legal safeguards, Oru Studio must establish those safeguards, including the appropriate approved transfer clauses where applicable. This document itself is not an international-transfer mechanism.
Oru Studio will provide 30 days’ notice of new or replacement subprocessors. A merchant may object on reasonable data-protection grounds. The parties will seek a suitable alternative; if none is available, the merchant may stop the affected processing before the change. Urgent security substitutions will be notified as soon as practicable.
Rights, incidents and assistance
Oru Studio will promptly forward customer requests to the merchant and assist with lawful access, correction, deletion, restriction and other applicable rights. Shopify data requests are recorded for the authenticated merchant to export relevant attribution records. Requests received directly will be verified and referred to the merchant rather than disclosed to an unverified requester. Oru Studio will also provide reasonably necessary assistance with impact assessments, regulator consultations and security obligations.
Oru Studio will notify affected merchants without undue delay after becoming aware of a personal-data breach, with an operational target of 24 hours. Initial notice may be preliminary and will be supplemented with affected data categories, likely consequences, response actions and a contact. Oru Studio will preserve relevant evidence and cooperate; merchants control their notifications unless law requires otherwise.
Retention, export and deletion
Processing continues while the app is installed. Attribution records are retained for up to 90 days. Privacy-request records are retained for up to 30 days; expired purchase claims are cleaned daily. Operational logs are retained for up to 14 days and backups for up to seven days. On uninstall, shop records are removed from active storage; Shopify redaction requests also delete applicable records. Restricted backup copies expire within seven days. Deletion requests must be reapplied following a restore. Support correspondence is reviewed for deletion after resolution and must not be used to retain unnecessary customer data.
Merchants may export available data before uninstalling or instruct Oru Studio to return or delete it. Oru Studio will complete requests without undue delay and within 30 days, unless a shorter applicable deadline applies. Legally required retained data will be isolated and limited. Completion will be confirmed on request.
Accountability and priority
Oru Studio will provide reasonably necessary compliance information and permit proportionate confidential audits, ordinarily beginning with documentation and reasonable scheduling. This does not restrict urgent investigation or regulator access. Substantiated deficiencies will be addressed promptly. This agreement takes priority over conflicting service terms concerning merchant data; mandatory law and approved transfer clauses prevail. Material changes require notice and recorded acceptance. Nothing limits statutory rights.