Rebatory Data Processing Agreement (DPA)
Last updated: September 11, 2026.
This DPA supplements the Terms of Service between the merchant operating a Shopify store using Rebatory ("Merchant," acting as data controller) and Rebatory's operator ("we," acting as data processor), regarding personal data of the Merchant's customers ("Customers") that Rebatory processes on the Merchant's behalf.
1. Subject matter, duration, nature and purpose
Rebatory processes Customer personal data solely to operate the store credit, cashback, and VIP loyalty program described at our Privacy Policy: identifying returning Customers, calculating VIP tier and cashback rate from order spend, and issuing and tracking store credit and referral rewards. Processing continues for as long as the App remains installed on the Merchant's store.
2. Categories of data subjects
The Merchant's Customers who place orders in the Merchant's store.
3. Categories of personal data
- Shopify customer ID
- Email address
- First and last name
- Cumulative order spend with the Merchant
- Referral relationships (which Customer referred which)
4. Sub-processors
We use the following sub-processors to run the App:
- Shopify — the platform Rebatory runs on top of, and the source of the Customer data described above.
- Fly.io — application/database hosting (region:
iad, USA). - Sentry — error monitoring, with PII scrubbing (
send_default_pii = false) on by default, so it does not receive Customer data under normal operation. - Postmark — transactional email delivery. Used solely to deliver the data-subject export that Shopify's
customers/data_requestwebhook obliges us to send you; that message contains the Customer data described above, so Postmark does process Customer personal data. - mailbox.org — hosts our
support@rebatory.commailbox (Germany-hosted). Used for direct correspondence with you as the Merchant, which may include Customer personal data you forward to us (for example, as part of a data subject request).
If we add a new sub-processor that will process Customer personal data, we'll update this page and, on request, notify you at least 15 days beforehand so you can object on reasonable data-protection grounds.
5. Security measures
Personal data is encrypted in transit (HTTPS/TLS on every path) and at rest (Fly.io Managed Postgres, which has hosted production since September 2026). Backups are automated by Fly.io Managed Postgres — a full base backup plus hourly incremental and daily differential backups, supporting point-in-time recovery.
Our error monitoring runs with personal-information reporting disabled by default, so Customer data is not sent to it under normal operation. Rebatory is operated by one person, so there are no staff accounts to grant, restrict or revoke, and no third party has access to production data. We maintain a written security incident response procedure, which we can share with you on request.
6. Assistance with data subject rights
Rebatory implements Shopify's mandatory customers/data_request
and customers/redact webhooks, so that a Customer request
routed to you as the Merchant results in Rebatory exporting or erasing
their data on your behalf. You remain responsible for responding to the
Customer as the data controller.
7. Breach notification
We will notify you without undue delay after becoming aware of a personal data breach affecting Customer data processed by the App, so you can meet your own notification obligations as the data controller.
8. Deletion of data on termination
Uninstalling the App erases the Merchant's Customer data as described in
the Privacy Policy; a following shop/redact webhook acts as a
safety net if any data survived uninstall.
9. Audits
On reasonable written request, no more than once per year, we'll provide information reasonably necessary to demonstrate compliance with this DPA.
10. International data transfers
Rebatory is hosted on Fly.io in the iad region (Ashburn,
Virginia, USA). For a Merchant whose Customer personal data originates in
the EEA or the UK, this means that data is transferred outside the EEA/UK.
A standing transfer mechanism (EU Standard Contractual Clauses) is not yet
in place. If you require SCCs, contact us at
support@rebatory.com and we will
put them in place with you.
11. Company information
Rebatory is operated by Maurice Samba, Große Bergstraße 17, 30989 Gehrden, Germany, currently as a sole proprietorship. If the business is later registered as a company, this section will be updated with the registered business name.