Data Processing Agreement

Last updated: 6 September 2026

When you connect a store to Adkemist, we process data on your behalf. This sets out what we may do with it, what we may not, and what happens when you stop using the service. It applies in addition to the terms of service and the privacy policy.

1. Who this is between

Kamil Fachtali, carrying on business as THE FATALI PARTNERS, operates Adkemist.

In this agreement, “we” and “us” mean that operator, and “you” means the merchant whose store or advertising account is connected. It takes effect when you connect a store and lasts as long as that connection does.

2. Which of us is which

You are the controller of your store’s data. You decide what to collect and why. We are a processor: we act on the data you connect, for the purposes you connected it for, and for nothing else.

We are also a controller for a small, separate set of data — your Adkemist account, your email address, and our own service logs. That part is governed by the privacy policy, not by this document.

3. What we process, and why

When you connect a Shopify store, we read:

• Order totals — the subtotal, discounts, refunds, shipping and tax on each order.
• Line-level product sales, and the unit cost of an item where your store records one, so margin is measured rather than estimated.
• Whether an order was a first purchase, as a number — Shopify’s own count of how many orders that buyer has placed.
• The campaign parameters an order arrived with, as Shopify records them on the order itself. We do not observe your storefront and we place nothing on it — this is a field we read, not a measurement we take.

The purpose is one thing: measuring what your store actually sold, and comparing it against what your advertising platforms claim they caused. We do not use your data to train models, to build any profile that outlives your account, or to inform any other merchant’s analysis.

4. Acting on your instructions only

We process your data only to provide the service, and only for as long as you keep the connection. Connecting a store is the instruction; disconnecting it withdraws that instruction.

If a law obliged us to process your data some other way, we would tell you before doing it, unless that same law forbade us from telling you.

5. What we deliberately do not hold

We hold no personal data about any customer of your store. Not their name, email address, phone number, postal address, IP address or customer id — not even a hashed one. The query we send Shopify does not ask for those fields, and our database has no column that could hold one.

This is not a policy we could quietly drop. It is enforced by an automated test that fails if a field whose name suggests personal data reappears on an order row, and by the scopes we request: Adkemist asks for read_orders, read_products and read_inventory, and holds no permission that would let it write anything to your store.

The practical consequence is that a request from one of your customers to access or erase their data has nothing to reach in our systems. We receive and record those requests from Shopify so that our answer is “we checked and held nothing” rather than silence, and we answer them within 30 days.

6. Who else touches it

We use a small number of providers to run the service. Each is bound by terms at least as protective as this agreement.

If we add a provider that would process your store data, we will say so on this page before it starts. You may object by disconnecting your store.

7. Where it goes

Adkemist is operated from Québec, Canada, and the data is held in the United States (US West (Oregon), us-west-2). Where data leaves the European Economic Area or the United Kingdom, our providers rely on the European Commission’s standard contractual clauses.

8. How it is protected

• Encrypted in transit and at rest. Every connection to the service and to the database is over TLS, and the database is encrypted on disk.
• Row-level isolation. Your data is readable only by the workspace that connected it. That is enforced by the database itself through row-level security, not by application code that could forget.
• The access token is unreadable to the application. The token that authorises reading your store is revoked at the column level from every client role; only the server-side service role can read it, and it never reaches a browser.
• Least privilege by design. We request no scope that allows writing to your store, and no scope that would give us access to your customer records.

9. How long we keep it

While your store is connected, we keep the order figures so the tool can compare this week against last month. After you uninstall Adkemist from your store:

• Normally within 48 hours. Shopify notifies us that the app was removed and we erase the store’s record, which deletes every order figure and daily total held for it.
• Within 30 days otherwise. If the erasure notice never arrives, a scheduled job deletes any store we recorded as uninstalled more than 30 days earlier. This is a ceiling, not a target.

The 30-day window exists so that a merchant who reconnects within the month keeps their history rather than starting from nothing.

We keep one thing longer: a record that a deletion happened, holding a date and a reference and nothing about your store’s customers. An audit trail that erases itself proves nothing.

10. When you leave

Uninstalling the app from your store ends this agreement and starts the deletion described above. You can also write to us at privacy@adkemist.io and ask for immediate erasure rather than waiting for Shopify’s notification.

Your store’s own data is unaffected. We only ever read it — nothing we do can change or remove anything in Shopify.

11. If something goes wrong

If we become aware of a breach affecting data we process for you, we will tell you without undue delay and in any case within 72 hours of becoming aware of it. We will say what happened, what it affected, and what we are doing about it — and we will say so even where the answer is uncomfortable.

12. Demonstrating all this

On reasonable request, we will provide the information needed to show that we are meeting this agreement. We are a sole proprietorship (entreprise individuelle) rather than an enterprise vendor, so we do not hold a SOC 2 report or an ISO certification, and we would rather say that than imply otherwise.

13. Changes

If we change this agreement in a way that affects how your data is processed, we will say so on this page and, where the change is significant, by email before it takes effect.

14. Contact

Privacy and data protection questions go to privacy@adkemist.io. Anything else about the service goes to support@adkemist.io.