TagPipes for Shopify Terms

These TagPipes for Shopify Terms (the "Terms") are an agreement between Rawsoft, Inc., a Georgia corporation ("Rawsoft," "we," "us"), and the merchant that installs or uses TagPipes for Shopify (the "App") on a Shopify store ("you"). By installing or using the App, you agree to these Terms. If you install the App for a business, you confirm you have authority to bind that business.

Section 6 contains our data processing terms. They apply where we process personal information about your store's visitors and customers on your behalf. Our Privacy Policy describes the same data in more detail.

1. The App

The App records your store's activity through Shopify's Web Pixel, reads your paid orders to check that sales were tracked, shows you whether your tracking and connected ad platforms are working, and, only if you connect them, sends your store's events to Meta and Google Ads.

The App is free. If we introduce paid plans, charges will only be made through Shopify's billing and only after you approve them in Shopify.

We may change, add or remove features. If we decide to discontinue the App, we will tell you in the App at least 30 days beforehand.

2. Your Use of the App

You may use the App for your own Shopify store. You will not: resell the App or make it available to anyone other than people working for your store; reverse engineer it or try to derive its source code, except where the law allows it; use it to build a competing product; get around its limits or security; or use it in a way that breaks the law or Shopify's terms.

Rawsoft owns the App, the TagPipes platform and everything we provide through them. These Terms give you a right to use the App, not ownership of it. If you send us suggestions, we may use them without obligation to you.

3. Your Store Data

You own the data the App collects from your store ("Store Data"). You give us permission to collect, store, process and transmit Store Data only to provide, secure and support the App for you, and as section 6 describes.

We may produce aggregated statistics from the operation of the App to run and improve it, but only in a form that does not identify you, your store or any individual.

4. Meta, Google Ads and Other Platforms

Connecting Meta or Google Ads is your choice. Once you connect one, we send your store's events to it on your behalf and on your instructions. What that platform does with the data is governed by your own agreement with it, not by these Terms, and we are not responsible for it. You are responsible for having the right to send that data to the platform under its terms.

Credentials those platforms issue are stored encrypted, are never shown back to anyone, and are deleted when you disconnect the platform.

The App depends on Shopify, Meta, Google and other services we do not control. Changes they make can interrupt or change how the App works. Shopify is not a party to these Terms.

5. Your Responsibilities

You decide whether to use the App and which of its features and connections to turn on. You are responsible for:

• your store's privacy notice telling visitors and customers about the data the App collects and the platforms you send it to;
• your Shopify customer privacy settings, including whether and where visitors must give consent before analytics or marketing tools run;
• having a lawful basis for the data you ask the App to collect and send; and
• responding to your customers' privacy requests. We help as section 6.7 describes.

6. Data Processing Terms

6.1 Roles

For personal information about your store's visitors and customers, you are the controller (and the "business" under US state privacy laws) and Rawsoft is your processor (and "service provider" or "processor" under those laws). You decide why the information is processed. We process it only on your documented instructions, which are these Terms, the settings you choose in the App, and the platforms you connect. We are a controller only for the small amount of information about you as our customer that we need to run your account and support you.

If we believe an instruction breaks a data protection law, we will tell you and may pause the affected processing. We do not give legal advice, and telling you does not make us responsible for the instruction.

6.2 Details of processing

6.3 US state privacy law terms

For personal information covered by the California Consumer Privacy Act and other US state privacy laws, we will:

• process it only for the purposes in section 6.2;
• not sell or share it, as those laws define "sell" and "share";
• not retain, use or disclose it outside our direct business relationship with you, or for any purpose other than those in section 6.2;
• not combine it with personal information we receive from other merchants or collect ourselves, except as those laws allow;
• provide the same level of privacy protection those laws require, and tell you if we can no longer meet our obligations under them; and
• let you take reasonable steps to stop and fix any unauthorized use of it.

Where we hold aggregated or de-identified data under section 3, we will keep it de-identified and not try to re-identify it.

6.4 GDPR and UK GDPR terms

Where the GDPR or UK GDPR applies, in addition to the rest of this section 6: people at Rawsoft who can access personal information are bound by confidentiality; we apply the security measures in section 6.6; we help you, taking into account what the App does and the information we have, to respond to individuals' requests and with security, breach notification and data protection impact assessments; and we make available the information described in section 6.10.

6.5 Subprocessors

You authorize us to use the following subprocessors. We have data processing agreements with each of them, and we remain responsible for their work.

We will post any new subprocessor on this page and tell you in the App at least 30 days before it starts processing your store's personal information. If you object, tell us at privacy@rawsoft.com. If we cannot resolve your objection, you may stop using the App by uninstalling it.

6.6 Security

We protect personal information with measures appropriate to the risk, including:

• encryption in transit (HTTPS) and at rest;
• administrative access limited to the Rawsoft personnel who run the App, with two-factor sign-in on our hosting and Shopify accounts;
• backups of configuration and event data; and
• a written security incident response plan.

We may update these measures as long as the overall level of protection does not go down.

6.7 Your customers' privacy requests

We act on Shopify's privacy requests within 30 days: for a customer data request (customers/data_request) we give you what TagPipes holds about that customer for your store, as a file you download in the App; for a customer redaction request (customers/redact) we delete it. Your customers should send their requests to you. You decide how to respond.

6.8 Retention and deletion

While the App is installed, we keep raw store events for up to 13 months. When you uninstall, data sending stops right away. Shopify sends a shop redaction request (shop/redact) 48 hours after uninstall, and within 30 days of receiving it we delete all TagPipes data for your store and close its TagPipes account. Deleted data can remain in encrypted backups for up to 35 days before it is overwritten. We may keep records the law requires us to keep, and they stay protected under these Terms.

Events already delivered to Meta or Google Ads at your request are held by those companies under your agreements with them, and we cannot delete them.

6.9 Security incidents

If we become aware of a breach of security affecting your store's personal information, we will notify you without undue delay. We will tell you, as it becomes known, what happened, what data and roughly how many people are affected, what we have done, and who to contact. We will take reasonable steps to contain it and will cooperate with you. You decide whether to notify your customers or regulators. Our notice is not an admission of fault.

6.10 Information and audits

We will make available the information reasonably needed to show that we meet this section 6, including by answering a reasonable written security questionnaire once a year. Where a data protection law gives you a right to a further audit, we will cooperate with one on reasonable notice, during business hours, at your cost, and without access to other merchants' data.

6.11 International transfers

We process personal information in the United States. Where the GDPR applies to a transfer of personal information to us, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), are incorporated into these Terms, with you as data exporter, Rawsoft as data importer, and sections 6.2, 6.5 and 6.6 completing their annexes. Where the UK GDPR applies, the UK International Data Transfer Addendum to those Clauses applies.

6.12 Precedence

If this section 6 conflicts with any other part of these Terms on the processing of personal information, this section 6 controls.

7. Disclaimers

No warranty of legal compliance. The App records, checks, reports and sends data on your instructions. It does not determine, and Rawsoft does not warrant, that you or your store meet any law, regulation, platform policy or contract, including any privacy, consent, data protection or advertising law. We do not provide legal advice. Your own counsel decides your legal obligations and whether your settings satisfy them.

EXCEPT AS THESE TERMS EXPRESSLY STATE, THE APP IS PROVIDED "AS IS" AND "AS AVAILABLE," AND RAWSOFT DISCLAIMS ALL OTHER WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE APP WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT IT WILL DETECT EVERY TRACKING PROBLEM.

8. Limitation of Liability

NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA OR GOODWILL. EACH PARTY'S TOTAL LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS WILL NOT EXCEED THE GREATER OF THE FEES YOU PAID FOR THE APP IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO THE LIABILITY, OR ONE HUNDRED US DOLLARS (US$100). These limits do not apply to your obligations under section 9, to a party's fraud, gross negligence or willful misconduct, or to any liability the law does not allow to be limited.

9. Indemnity

You will defend Rawsoft against, and pay damages and costs finally awarded or agreed in settlement of, any third-party claim (including a regulatory proceeding) arising from: your store, your privacy notice or your privacy settings; data you instructed us to collect or send, including to platforms you connected; or your breach of these Terms or of a platform's terms. We will tell you about the claim promptly and let you control its defense, but you may not settle it in a way that admits fault for us or binds us to do something without our consent.

10. Term, Suspension and Termination

These Terms apply from when you install the App until you uninstall it. You may uninstall at any time. We may suspend the App for your store if needed to prevent harm to the App, to other merchants or to anyone else, if the law requires it, or if you breach these Terms. We may end these Terms for your store on 30 days' notice in the App, or immediately for a serious breach. When these Terms end, section 6.8 governs your data, and sections 2 (ownership), 6 (for any data we still hold), 7, 8, 9 and 12 continue to apply.

11. Changes to These Terms

We may update these Terms. The "Last updated" date at the top shows when they last changed. For a material change, we will tell you in the App at least 30 days before it takes effect, unless a change is required sooner by law. If you keep using the App after a change takes effect, the updated Terms apply. If you do not agree, uninstall the App.

12. General

These Terms are governed by the laws of the State of Georgia, United States, without regard to its conflict-of-laws rules, and the state and federal courts in Atlanta, Georgia have exclusive jurisdiction, except that either party may seek an injunction in any competent court to protect its intellectual property or confidential information. These Terms, with the Privacy Policy, are the entire agreement about the App. If you also have a signed TagPipes subscription agreement with Rawsoft, that agreement controls where it covers the same thing. We may assign these Terms to a successor in a merger, acquisition or sale of our business. If any part is unenforceable, the rest stays in effect. A failure to enforce a term is not a waiver. Notices to Rawsoft go to privacy@rawsoft.com; notices to you go through the App.

13. Contact

Questions about these Terms can be sent to privacy@rawsoft.com, or by mail to:

Rawsoft, Inc., 3480 Peachtree Rd NE, 2nd Floor, Suite 137, Atlanta, GA 30326, USA