Data Processing Agreement.
Last updated: November 3, 2026.
Between the merchant who installs the Ovestia app (the "Controller") and MONSHOOTING, a French SAS with a capital of €5,000, RCS Paris 833 332 414, 41 rue Boissy d'Anglas, 75008 Paris, France (the "Processor").
This agreement supplements the Ovestia terms of use and meets Article 28 of the GDPR. It does not cover data for which the Processor is itself the controller, described in the privacy policy.
1. Subject and duration
The Processor processes personal data on the Controller's behalf to provide the Ovestia stylist: composing outfits, measuring what the stylist produces, attributing orders. This agreement lasts as long as the app is installed, and until the deletion in section 9 is complete.
2. Data and data subjects
| Item | Description |
|---|---|
| Data subjects | Store visitors, customers who placed an order |
| Stylist usage | Usage events tied to a random session identifier, sent only if the consent decision allows it |
| Stylist feedback | Outfit adopted or skipped, piece swapped, with a salted, truncated hash of the IP address, sent only if the consent decision allows it |
| Attributed orders | Order ID and number, total, lines from an outfit, quantities, amounts, currency, session identifier if the consent decision allows it |
| Not processed | Name, email, phone, postal address, customer ID and payment method are neither read nor kept. No special categories of data (GDPR Article 9) |
3. Instructions
The Processor processes this data only on the Controller's documented instructions, unless required by law, in which case it informs the Controller where the law allows. Installing the app, its settings and this agreement are those instructions. The Controller remains responsible for the legal basis, for informing its customers, and for its store's consent banner.
4. Confidentiality
Anyone authorised to process this data is bound by confidentiality, and their number is limited to what is strictly necessary.
5. Security
The Processor applies the measures in Annex A and may change them without lowering their level.
6. Sub-processors
The Controller gives general authorisation for the sub-processors in Annex B. Any addition or replacement is announced 30 days in advance by email to the merchant account. The Controller may object on reasonable data protection grounds; failing a solution, it may uninstall the app. The Processor imposes the same obligations on its sub-processors and remains liable for their performance.
7. Data subject rights and assistance
Requests sent by Shopify are handled within the legal deadlines. Any request received directly is passed to the Controller. The export for an access request is sent to the Controller manually. Erasing a customer removes the link to the order and the session identifier, and keeps the amounts, which become anonymous. The Processor also assists the Controller with impact assessments and prior consultation, to the extent of what it processes.
8. Personal data breach
The Processor notifies the Controller without undue delay and no later than 48 hours after becoming aware of a breach, at the merchant account's email address, with the information it has.
9. End of processing
On uninstall, the store's data is deleted on receipt of the erasure request Shopify sends 48 hours later. Reinstalling before then keeps the data. What remains afterwards: backups, deleted by rotation within 14 days; proof of GDPR requests, for up to 400 days; anonymised cost counters; the emptied store record, as proof of erasure.
10. Audit
The Processor provides the information needed to show compliance with this agreement and answers written questions within 30 days. The Controller may carry out an audit, or have a third party bound by confidentiality do so, on 30 days' notice, once a year, except after a breach or at an authority's request.
11. Transfers outside the European Union
Data is hosted in the European Union (Annex B). Any transfer to a sub-processor outside the Union relies on one of the safeguards in Chapter V of the GDPR.
12. Liability and governing law
Liability limits, transfer to another company and governing law are those of the terms of use, subject to the rights the GDPR grants to individuals.
Annex A: security measures
- Encryption in transit (HTTPS).
- Encryption at rest of the database and backups.
- Webhooks verified by signature; dashboard access by Shopify session token.
- Operations console protected by a hashed password and a second factor.
- Daily backups, off-site copy, rotation within 14 days.
- Service monitoring and alerts to the operator.
Annex B: sub-processors
| Sub-processor | Role | Location | Section 2 data |
|---|---|---|---|
| Render Services, Inc. | Hosting | Frankfurt, Germany | All |
| MongoDB, Inc. (Atlas) | Database | Frankfurt, Germany | All |
| Backblaze, Inc. | Backup copy | Amsterdam, Netherlands | All |
| Cloudflare, Inc. | Traffic routing | Global network | IP address in transit |
Upstash, Anthropic, Resend and Telegram are part of the service without receiving this data; they are listed in the privacy policy.