Sushinet

Cart Shield — Data Processing Agreement

Last updated: 18 October 2026 · Effective: 18 October 2026 · Version: 1.0

This Data Processing Agreement ("DPA") is entered into between:

It covers Cart Shield and nothing else. Our other apps carry their own, and their Annexes must not be read across to this one:

Structure and commitments mirror Ruleproof's DPA. The Annexes differ, and Annex III is the longest of our apps', because Cart Shield sends an order's IP address to outside lookup services.

How this becomes binding

You do not need to sign anything. This DPA is incorporated by reference into the terms you accept when you install Cart Shield, and takes effect automatically at installation.

If your compliance process requires a countersigned copy, or your own DPA template, email support@sushinet.fyi and we will sign and return one. If you require the European Commission's Standard Contractual Clauses as a separate executed instrument, we will enter into them (§11).

We publish the current version at https://sushinet.fyi/cart-shield/dpa, hosted separately from the app itself.

1. Definitions

"Controller", "Processor", "Data Subject", "Personal Data", "Processing" and "Supervisory Authority" have the meanings given in the GDPR.

2. Roles of the parties

Data Controller Processor
Your shoppers' data that Cart Shield touches — visit records, order records and their codes, the checkout check's inputs and marks, rules naming a person, live reads of order and customer details, the activity log You Us
Your own shop's data, and our operational records — OAuth session, shop settings, support correspondence, access logs, web server logs Us —

This DPA governs only the first row. Where we act as Controller, the Privacy Policy governs.

You confirm that, as Controller, you have a lawful basis for the Processing you instruct us to carry out — including for any reading from your shoppers' devices by the web pixel and the checkout check's script (Privacy Policy §3) — and that you have given your shoppers whatever notice Data Protection Law requires.

3. Processing only on your instructions

We Process Merchant Personal Data only:

  1. on your documented instructions, which comprise this DPA, the Privacy Policy, and the settings you configure in Cart Shield — installing it, choosing detections, writing rules, and switching on any action (holding, tagging, cancelling and refunding, the checkout check, the decoy); and
  2. where a law we are subject to requires it — in which case we will tell you before Processing, unless that law prohibits it.

We do not Process Merchant Personal Data for any purpose of our own. We do not sell it, share it for anyone else's purposes, use it to train models, or use one merchant's data to score another merchant's orders. Scoring uses fixed rules — lists, ranges, counts and fixed weights — and no machine-learning model.

We will tell you if, in our opinion, an instruction infringes Data Protection Law, and may suspend the affected Processing until it is resolved.

4. Confidentiality

Access to Merchant Personal Data is limited to the operator of Sushinet, who is bound by an ongoing duty of confidentiality. We do not employ staff or engage contractors with such access. If that changes, anyone granted access will be under a written confidentiality obligation before access is given, and we will update Annex II.

5. Security

We implement the measures in Annex II, which are designed to meet Article 32 of the GDPR and APP 11. Annex II describes what is actually in place; where a control is partial or provided by a platform, it says so.

6. Sub-processors

You give general authorisation for us to engage Sub-processors, subject to this section.

Our current Sub-processors are listed in Annex III and in §5 of the Privacy Policy. Each Processes Merchant Personal Data only on our instructions. The IP lookup services receive only an IP address: no other personal data, and no account or order identifier.

Before adding or replacing a Sub-processor that would receive Merchant Personal Data, we will update Annex III and notify you by email at least 30 days in advance. If you reasonably object on data protection grounds within that period, we will work with you in good faith to find an alternative. If we cannot, you may terminate by uninstalling Cart Shield, and we will delete your data under §9.

We remain fully liable to you for a Sub-processor's performance of its data protection obligations.

7. Assisting you with data subject requests

Cart Shield implements Shopify's three mandatory compliance webhooks:

All three verify the webhook's signature before acting; an invalid signature is rejected and no data is touched.

Where a Data Subject contacts us directly about data we hold as your Processor, we will refer them to you and tell you promptly.

We will also assist you with obligations under GDPR Articles 32–36 (security, breach notification, data protection impact assessments, prior consultation) by providing the information we hold. Cart Shield's automated decisions (Privacy Policy §8) are a reason your own assessment may need that information.

8. Personal data breaches

If a breach affects Merchant Personal Data, we will notify you without undue delay, and in any event within 72 hours of becoming aware of it, with, to the extent known: the nature of the breach, the categories and approximate volume of data and Data Subjects affected, the likely consequences, the measures taken or proposed, and a contact point. Where the full picture is not available within 72 hours, we will tell you what we know and follow up.

Where the Notifiable Data Breaches scheme or GDPR Article 33 requires it, we will also notify the relevant Supervisory Authority. We will not notify your shoppers directly unless you instruct us to or the law requires it.

9. Deletion and return

On uninstall, the OAuth session is deleted immediately by the app/uninstalled webhook. Shopify sends shop/redact about 48 hours later, and we then delete the shop's visits, orders, line items, rules, activity log, settings (including the encrypted Storefront token), the checkout check's counts, the refused-checkout records, and support references.

Before uninstall, Merchant Personal Data is subject to the retention limits in §7 of the Privacy Policy. ⚠️ Not all of it has a time limit while Cart Shield is installed: order records are kept until a redaction erases them, and the activity log is deleted after 90 days. Visit records are deleted 30 days after they are created, by an hourly job. The Privacy Policy states each one.

In your store. Tags, risk-panel verdicts and the decoy product (if you used it) are data in your own Shopify store and stay there after uninstall; Cart Shield no longer has access to remove them.

You may request earlier deletion, or a copy of Merchant Personal Data in a commonly used format, by emailing support@sushinet.fyi at any time.

Backups. Deletion from the live database is immediate. Database backups are kept about 30 days, and daily disk snapshots 4 days, and both expire automatically. We do not restore a backup to resurrect deleted data; if one were ever restored for disaster recovery, we would re-apply outstanding deletion requests to the restored data.

10. Audits and information

On written request, and no more than once in any 12-month period (unless a Supervisory Authority requires otherwise or there has been a breach affecting your data), we will:

  1. make available the information reasonably necessary to demonstrate compliance with this DPA — in the first instance by answering a written security questionnaire; and
  2. permit and contribute to an audit by you or an independent auditor you appoint, on at least 30 days' notice, during business hours, subject to confidentiality, and without compromising other merchants' security or privacy.

You bear the cost of an audit you initiate, unless it reveals material non-compliance.

11. International transfers

Merchant Personal Data is stored on a server in Sydney, Australia. The Sub-processors in Annex III mean an order's IP address, and the data Shopify itself holds, may also be disclosed to recipients outside Australia — the countries are listed in Annex III.

Australia is not the subject of a European Commission adequacy decision. Where the GDPR or UK GDPR applies to a transfer to us, that transfer relies on the safeguards in Article 46 — in practice the Standard Contractual Clauses (Module Two, Controller to Processor), which we will enter into with any merchant who asks — or, where genuinely applicable, the derogations in Article 49. Where executed, the SCCs prevail over this DPA in any conflict; Clause 17 and Clause 18 refer to the law and courts of Ireland unless the parties agree otherwise; the docking clause applies; and Annexes I, II and III of this DPA serve as the SCCs' corresponding annexes and list of authorised Sub-processors under Clause 9(a) Option 2.

Under APP 8 we remain accountable for what an overseas recipient does with personal information we disclose to it.

12. Liability, term, and general

Term. This DPA takes effect when you install Cart Shield and continues for as long as we Process Merchant Personal Data on your behalf. §§4, 8, 9, 10 and 11 survive termination to the extent required.

Liability. Each party's liability under this DPA is subject to the limitations and exclusions in the terms governing your use of Cart Shield. Nothing in this DPA limits liability that cannot lawfully be limited, including a Data Subject's rights under Article 82 of the GDPR.

Order of precedence. If this DPA conflicts with the app terms, this DPA prevails on data protection matters. If executed SCCs conflict with this DPA, the SCCs prevail.

Governing law. The laws of New South Wales, Australia, with the non-exclusive jurisdiction of its courts — except where §11 provides otherwise for executed SCCs.

Changes. Material changes are notified by email at least 30 days in advance, and the version and date at the top change with every revision. If you do not accept a change, you may uninstall and your data is deleted under §9.

Contact. support@sushinet.fyi

Annex I — Description of the Processing

This Annex also serves as Annex I to the Standard Contractual Clauses where those are executed.

Data exporter: the Merchant, acting as Controller. Data importer: Edwin Guo trading as Sushinet, acting as Processor. Contact: support@sushinet.fyi.

Subject matter. Provision of Cart Shield — scoring a merchant's storefront visits and orders for fraud signals, explaining each score, and carrying out the actions the merchant switches on.

Duration. For as long as Cart Shield is installed, subject to the retention limits in the Privacy Policy §7; then deletion on shop/redact (about 48 hours after uninstall) and, for the OAuth session, app/uninstalled (immediate).

Nature and purpose. Folding storefront events into per-visit counters; scoring orders against fixed rules; looking up an order's IP address with outside reputation services; writing verdicts to the order's risk panel; enforcing the merchant's checkout rules through a Shopify Function; and, only where the merchant switches them on, the checkout check, the decoy product, tagging, fulfilment holds, and cancel-and-refund; freezing an email address, phone number or delivery address for a set time; telling Shopify Flow an order was scored (no customer fields); and, on the merchant's click, creating two saved customer segments from Cart Shield's tag.

Categories of Data Subjects. Visitors to the Merchant's storefront, and buyers who reach checkout or place an order.

Categories of Personal Data.

Category Detail
Visit records An unkeyed hash of the shop and Shopify's browser clientId; event counters; first and last seen times; true/false findings about the User-Agent and time zone; a keyed code of the connection's IP address (72 hours); the order id of a completed checkout
Order records Order id, name and total; two unkeyed hashes of the buyer's email; a keyed code of the connection (72 hours, or 30 days on a Strong order) and of the shipping address (30 days); IP verdicts and country code; per-connection and per-address counts; line items' product ids and quantities; failed-payment and cards-tried counts; first-order flag; Shopify's risk level and cancellation reason; score, band and signals
The checkout check's inputs Interaction counts, a hidden form field's value, the visitor's consent state, browser tells (with consent, by default) and the cart token — judged in memory and not stored; the resulting mark on the cart, written into Shopify; per-day counts per shop
Rules naming a person Unkeyed hashes of an email, phone, name or address, with a partial hint (an address hint shows its postcode and country in full)
Live reads, not stored Buyer email and phone; delivery name, phone, street, unit and postcode; billing name and phone; shipping country and region; customer id for tagging
Activity log Order id, kind of event, defence, actor (Cart Shield, merchant or Shopify), a closed reason code, and the id of the rule or visit concerned, for each action Cart Shield takes or observes; never a name, email, phone, address, IP or rule value
Refused-checkout records A one-way hash of the checkout token, which defence refused it (a block rule, a freeze, the checkout check or the decoy), the rule's id, the day and Shopify's update time; never the buyer's email, phone, name, address or cart. Kept 90 days
Insights' daily totals Per shop per day, counts only (visits, orders, how often each signal fired, how many orders carried a card-testing finding); no shopper, order or code. Kept 365 days
IP addresses in transit An order's IP address, sent to the lookup services in Annex III and then discarded

Special categories. None, and no rule is designed to act on one.

Frequency. Continuous, for every storefront event and order, for as long as Cart Shield is installed.

What is NOT Processed into storage. No payment card details (transactions are read for two counts and discarded), no readable IP address, street address, phone number or time zone in the database, no device fingerprint, no mouse or keystroke recording, no raw event stream.

Annex II — Technical and organisational measures

This Annex also serves as Annex II to the Standard Contractual Clauses where those are executed.

Area Measure
Encryption in transit HTTPS between Shopify, the app, shoppers' browsers and the merchant's browser.
Encryption at rest The server's storage volume is encrypted with a provider-managed key; backups are held in object storage encrypted at rest. The checkout check's Storefront token is additionally encrypted (AES-256-GCM) with a key derived from a secret held only on the server.
Pseudonymisation IP addresses and shipping addresses are stored only as keyed codes (HMAC) with short expiry; emails and rule values as hashes. Stated limit: the HMAC key is the app's Shopify client secret, known to Shopify, and an IPv4 code can be reversed by anyone holding it (Privacy Policy §9).
Access control Administrative access is key-based only; password authentication is disabled; one operator. The database file is readable only by the app's own system account.
Process confinement The app runs as an unprivileged, dedicated system account under systemd confinement, with write access only to its own data directory, on a server shared only with our other apps.
Minimisation The pixel sends five fields per event (three more on particular events) and its payload is pinned by a test; events are folded into counters and discarded; the checkout check's inputs are judged in memory and not stored.
Retention limits Hourly clearing of expired IP and address codes; 30-day deletion of visits, hourly; 90-day limit on the checkout check's counts; 90-day limit on refused-checkout records (ids only); 90-day limit on the activity log (ids and closed codes only); 365-day limit on Insights' daily totals (counts only). Stated limit: order records have no time limit while installed.
Integrity of backups Nightly consistent snapshots, verified before upload, copied to a second bucket; about 30 days' retention.
Deletion Automated deletion through Shopify's compliance webhooks, signature-verified before acting; a test fails if a shop-scoped table is missing from the shop deletion.
Secure development Type checking and an automated test suite before deployment; data-inventory tests that fail when a stored table, a pixel field, a storefront-script field or an IP lookup provider is added without being disclosed.

Known limitations, stated deliberately. We are a single-operator studio: no 24/7 security operations centre, no ISO 27001 or SOC 2 certification, and no dedicated security team. The web server's access log records the IP address of every request except the web pixel's, which are logged without the IP address or headers; the checkout check's requests arrive through Shopify's app proxy, and their logged headers may carry the shopper's IP address (Privacy Policy §1.10).

Annex III — Authorised Sub-processors

This Annex also serves as the list of authorised Sub-processors under Clause 9(a) of the Standard Contractual Clauses where those are executed.

Sub-processor Role Location Merchant Personal Data it may hold
Shopify Inc. The platform Cart Shield runs on: orders, the web pixel, the app proxy, the checkout Function. Canada, United States All categories in Annex I — Shopify is their source.
Oracle Cloud Infrastructure The server running the app and its database, and the object storage holding backups. Sydney, Australia Everything Cart Shield stores.
IP reputation services (three, used in turn) IP reputation and country lookup. One per order: each after the first is used only when the ones before it are unavailable or out of quota. Overseas; locations not fixed by us An order's IP address, per lookup.
A DNS blocklist A list of compromised machines, queried through our server's DNS resolver. Overseas; the list operator's own servers, reached through our resolver An order's IPv4 address, inside the DNS query.

The IP lookup services are described by kind, not by name, as in §5 of the Privacy Policy: naming them would tell anyone trying to get round Cart Shield where to look.

Not Sub-processors of Merchant Personal Data, listed so nothing is implied: Zoho Desk (Australia) holds our support correspondence with you, where we are Controller — please keep shoppers' details out of it. Vercel Inc. (United States) hosts our public website only; no Cart Shield data reaches it.

We will update this Annex and give 30 days' notice before adding a Sub-processor that would receive Merchant Personal Data, per §6.