This agreement applies when ChargeFix processes personal data on behalf of a merchant. The merchant is the controller of its customers' data, and ChargeFix is the processor. It forms part of our Terms of Service.
1. What We Process and Why
- Purpose: to prepare, save, and file chargeback evidence that the merchant asks for.
- Data: for each dispute, the customer's name, email, shipping and billing address, and order, payment, and shipment details from the merchant's Shopify store.
- Data subjects: the merchant's customers.
2. Our Commitments
- We process personal data only on the merchant's documented instructions, which are the actions taken in the app.
- We do not sell personal data or use it for advertising, profiling, or any purpose beyond the one above.
- Everyone with access is bound by confidentiality, and access is limited to what is needed.
- We store only minimal dispute details (case ID, amount, reason, status, dates). Customer names, emails, addresses, and letters are not stored by ChargeFix.
- We help merchants respond to customer data requests, and we delete shop data when Shopify notifies us the shop has been removed.
3. Security
Traffic is encrypted in transit (HTTPS) and stored data is encrypted at rest. Secrets are kept in environment configuration and not in code. Access to administration systems uses two-step sign-in. Each time customer data is read or evidence is written, we record who, what, and when, never the data itself.
4. Sub-processors
The merchant authorises these providers, used only to deliver the service:
- Shopify: source of orders and disputes, and destination for evidence.
- Supabase: database hosting for settings and minimal dispute details.
- Cloud hosting provider: runs the application.
- OpenAI or Anthropic: drafts the rebuttal letter from the order details of the case being reviewed.
- EasyPost (optional): looks up delivery status for a tracking number.
We require sub-processors to protect data at a level comparable to this agreement.
5. International Transfers
Where personal data is transferred outside its region of origin, we rely on appropriate safeguards such as Standard Contractual Clauses.
6. Incidents
If we become aware of a breach affecting personal data, we will notify the affected merchants without undue delay and within 72 hours, with the information we have, and help them meet their own obligations.
7. Return and Deletion
When a merchant uninstalls ChargeFix, we delete the shop's stored data when Shopify's shop-removal request arrives. Evidence already saved to Shopify stays in the merchant's Shopify account.
8. Audits
On reasonable request, we provide the information needed to show compliance with this agreement.
9. Contact
Email: contact@chargefix.pro