Terms & Data Processing Agreement

These terms apply to every merchant who installs Symbiotic, and are accepted on installation. They incorporate the Data Processing Agreement in Part B.

Part A — Terms of service

1. The service

Symbiotic is a Shopify app that lets a shopper negotiate a discount on a product page inside limits the merchant sets, and mints a Shopify discount code for the agreed price. The merchant configures every limit that matters — which products are negotiable, the floor beneath which the app will not go, and the rewards attached to optional actions. Symbiotic never issues a discount outside those limits.

2. Merchant responsibilities

The merchant is responsible for the accuracy of its product pricing, for the disclosure text shown at any opt-in, and for the legality of the discounts it configures in its own market. The merchant must not use Symbiotic to present a reference price that is not a genuine selling price.

3. Fees

Plans and usage allowances are shown on the pricing page and billed through Shopify's billing system. Charges appear on the store's Shopify invoice, and cancelling the app in Shopify ends the subscription.

4. Availability and liability

The app is provided as-is, without warranty of uninterrupted availability. It is designed to fail safe: if the backend is unreachable the storefront widget removes itself and the store's normal checkout is untouched, so a Symbiotic outage never blocks a sale. To the extent permitted by law, our aggregate liability is limited to the fees paid for the app in the twelve months before the claim.

5. Termination

Either party may terminate at any time; a merchant does so by uninstalling the app. On uninstall, Shopify sends a shop redaction request and all of that store's data is deleted, as described in Part B §8.

6. Governing law

These terms are governed by the laws of India, without regard to conflict-of-law rules. The courts of Mumbai, Maharashtra have exclusive jurisdiction over any dispute.

Part B — Data Processing Agreement

1. Roles

The merchant is the controller of personal data relating to its customers and store visitors. KraftPixel Digital Solutions Pvt Ltd, operating Symbiotic, is the processor, and processes that data only on the merchant's documented instructions — which, for the avoidance of doubt, are given by installing the app and configuring its campaigns.

2. Subject matter and duration

Processing lasts for as long as the app is installed, plus the retention periods in §7. Its subject matter is running a price negotiation on the merchant's storefront and reporting on its outcome.

3. Categories of data subject and data

Data subjects are the merchant's store visitors and customers. The categories processed are:

• Negotiation data — the product being negotiated, the offers exchanged, and the resulting discount code. Not identifying on its own.
• Order attribution — from Shopify's new-order notification: order id, currency, order total and discount codes. No customer identity is requested or received; Symbiotic is not approved for the protected customer fields, so Shopify redacts name, email, phone and address before delivery.
• Contact given at an opt-in — an email address or phone number a shopper chooses to provide in exchange for a deeper discount, stored encrypted with the exact disclosure wording shown.
• Abuse-prevention signals — a one-way hash of IP, user agent and language, used to rate-limit coupon farming. Not reversible and not used for tracking.

No special-category data is processed. Symbiotic does not sell or share personal data, and does not use it to train models.

4. Security measures

• All traffic is served over TLS; storefront requests are HMAC-verified before any processing.
• Access tokens and shopper contacts are encrypted at rest with AES-256-GCM under a key held only in the deployment environment.
• Production credentials live in the hosting dashboard, never in the source repository or image.
• Administrative access to the production environment is limited to named staff.

5. Sub-processors

The list is short and complete. There are no analytics, advertising, or session-recording third parties in the app or the storefront widget.

• Shopify Inc. — the platform the app runs on and the source of the data.
• Hetzner Online GmbH (Falkenstein, Germany) — the dedicated server running the application and its PostgreSQL database.
• Cloudflare, Inc. — DNS and the TLS proxy in front of the application domain.
• OpenRouter — used only while a merchant is setting up a campaign, to draft the negotiator's persona and copy for the merchant to review and save. It is never called during a negotiation and never receives shopper personal data.

Merchants will be notified before any new sub-processor is added.

5a. Where data is stored

Merchant and shopper data is stored on servers in Germany, so data originating in the EEA and UK stays there in normal operation. Administration and support are carried out from India by KraftPixel Digital Solutions Pvt Ltd under this agreement, which is the only routine transfer outside that region.

6. Assisting the controller

Shopify's mandatory privacy webhooks are implemented and act for real. A customer data request returns what is held; a customer redaction deletes the matching consent records immediately, whatever their retention period; a shop redaction deletes the store and everything belonging to it. Merchants who need help with a rights request beyond this can write to info@kraftpixel.com.

7. Retention

These periods are enforced by an automated daily sweep, not on request.

8. Deletion on termination

When a merchant uninstalls, Shopify sends a shop redaction request and the store's record and every row belonging to it — campaigns, sessions, audit logs, consent records and attributions — are deleted. Access tokens are deleted at uninstall.

9. Breach notification

We will notify affected merchants and Shopify without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting their data, with what we know about its nature, likely consequences and remediation.

10. Audit

On reasonable written request, and no more than once a year, we will provide the information needed to demonstrate compliance with this agreement.

See also our privacy policy.