Data Processing Addendum
Last updated
How Zevron handles your customers’ personal data when it fights disputes for you. It applies automatically to every merchant; no signature needed.
1.Roles
This addendum is part of the Terms of Service between Zevron and the merchant. It applies whenever Zevron processes personal data about the merchant’s customers.
- The merchant is the controller: it decides why and how its customers’ data is used.
- Zevron is the processor: it processes that data only to provide the service, on the merchant’s documented instructions. The Terms, the merchant’s settings and its requests to us are those instructions.
Data about the merchant’s own staff and account is covered by our Privacy Policy, where Zevron is controller.
2.Scope of processing
- Purpose: building, drafting, reviewing and filing chargeback responses, and reporting dispute causes to the merchant.
- Data subjects: the merchant’s customers involved in a dispute.
- Data: names, email and postal addresses, order and subscription history, delivery tracking, support and email history, checkout IP and device details, AVS/CVV results, documents the merchant uploads, and product usage events tied to a customer email.
- Sensitive data: none intended. Merchants should not upload special-category data or full card numbers.
- Duration: for the term of the agreement, until deletion under section 7.
3.Zevron's obligations
- Process personal data only on the merchant’s instructions, and tell the merchant if we believe an instruction breaks the law.
- Make sure everyone with access is bound by confidentiality.
- Help the merchant answer data subject requests. Shopify’s
customers/data_requestandcustomers/redactwebhooks are handled automatically. - Help with data protection impact assessments and regulator consultations where they relate to the service.
- Make available the information needed to show compliance with this addendum, and allow reasonable audits, no more than once a year, with 30 days’ notice.
4.Subprocessors
The merchant authorises Zevron to use these subprocessors:
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Vercel, Inc. | Application hosting and request logs | All service data in transit | United States |
| Supabase, Inc. / Neon, Inc. | Managed Postgres database | Account, dispute, order and customer records; usage events | United States |
| Anthropic, PBC | AI drafting of dispute responses | Dispute, order and customer details needed for a draft | United States |
| Resend, Inc. | Transactional email | Merchant contact email; email content | United States |
| Stripe, Inc. | Billing our fee to merchants not on Shopify | Merchant name, contact email and invoices; card details are held by Stripe, never by us | United States |
| EasyPost, Inc. | Carrier tracking lookups | Tracking numbers and shipment status | United States |
| Slack Technologies, LLC | Optional dispute alerts, only if you connect Slack | Dispute summaries you choose to receive | United States |
Each one is bound by written terms that protect data at least as well as this addendum. We will email the merchant at least 30 days before adding or replacing one. The merchant may object on reasonable data protection grounds; if we cannot address the objection, the merchant may terminate without penalty. Zevron stays responsible for its subprocessors’ performance.
5.Security measures
- Encryption in transit with TLS on every connection.
- Shopify and app access tokens encrypted at rest with AES-256-GCM; database storage encrypted at rest by the provider.
- Read-only store access, apart from submitting dispute evidence.
- Access to production data limited to staff who review disputes or provide support, using individual accounts.
- Each merchant’s data is separated by account in the application and database.
- Every AI draft is reviewed by a person before it is filed, unless the merchant turns on auto-file for clean, low-value cases.
6.Breach notification
If we become aware of a personal data breach affecting the merchant’s data, we will notify the merchant without undue delay and within 72 hours. The notice will describe what happened, the data and people affected, likely consequences, and what we are doing about it, with updates as we learn more.
7.Deletion on termination
When the service ends, we delete the merchant’s personal data:
- For Shopify stores, automatically 48 hours after uninstall, on Shopify’s
shop/redactwebhook. - Otherwise, within 30 days of termination.
Before then the merchant can ask for an export at [email protected]. We keep only what the law requires us to (such as billing records), and keep it protected under this addendum.
8.International transfers
Zevron and its subprocessors process data in the United States.
Where the merchant transfers personal data from the EEA to Zevron, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated by reference. Annex I is completed by section 2 of this addendum, Annex II by section 5, and Annex III by section 4. For the UK, the UK International Data Transfer Addendum applies; for Switzerland, the clauses apply with references read as the Swiss FADP.
9.Precedence and contact
If this addendum conflicts with the Terms, this addendum wins for personal data. If it conflicts with the Standard Contractual Clauses, the clauses win.
Questions or a countersigned copy: [email protected]. Privacy requests: [email protected].