Data processing agreement

Version 1.2 · Effective October 12, 2026

1. Who this agreement is between

This agreement is between LeLoop LLC ("LeLoop", "we") and the business that uses LeLoop for its online store ("you"). It applies automatically when you install LeLoop from Shopify, or when you start using LeLoop on a store that isn't on Shopify, and it is part of the terms on which you use LeLoop. If you'd like a signed copy, email leloop.team@gmail.com and we'll send one countersigned.

"Shopper data" means personal information about your store's visitors and customers that LeLoop handles for you. Terms such as "controller", "processor", "personal data breach" and "data subject" have the meanings the GDPR gives them, and the matching terms in other privacy laws (such as "business" and "service provider" under California law) apply in the same way.

2. Roles

• For shopper data, you are the controller (a "business" under California law) and LeLoop is your processor (a "service provider" or "processor" under US state privacy laws).
• For your own account information (your store's address, your account email, your plan), LeLoop is an independent controller, as our privacy policy explains.
• You are responsible for having a lawful basis for collecting shopper data through your popups, for your store's own privacy notice, and for the cookie banner that tells LeLoop what each shopper has allowed.

3. Your instructions

We process shopper data only on your documented instructions: this agreement, and the choices you make in LeLoop (which popups run, which fields they ask for, and which tools signups are sent to). If we believe an instruction breaks data-protection law, we'll tell you. If a law requires us to process shopper data in some other way, we'll tell you first, unless that law forbids it.

4. What we do with shopper data

The details of the processing are in Annex 1. In short: we show your popups, test versions against each other, create single-use discount codes in your store, save signups to your Shopify customer list, credit sales to the popups that helped, report results to you, and send signups to the tools you connect.

5. Our obligations

• Confidentiality. Only people who need access to run LeLoop have it, and each is bound to keep shopper data confidential. Today that is LeLoop's founder.
• Security. We protect shopper data with the measures in Annex 2, and we'll keep them at least as strong while this agreement lasts.
• Shoppers' requests. When a shopper asks your store to see or delete their information, Shopify passes the request to us. For a request to see it, we email you the records we hold about that shopper. For deletion, we erase them as described in section 11. For a store that isn't on Shopify, forward the request to us by email. If a shopper contacts us directly, we'll pass the request to you rather than answer it ourselves.
• Other help. We'll give you reasonable help with data protection impact assessments and with questions from a data protection authority, using the information we have.

6. US state privacy laws

Where the California Consumer Privacy Act or a similar US state law applies, LeLoop:

• won't sell or share shopper data (including for cross-context behavioral advertising);
• won't keep, use or disclose it for any purpose other than providing LeLoop to you as this agreement describes, or outside our direct business relationship with you;
• won't combine it with personal information we get from anyone else, except where the law allows a service provider to;
• will give it the same level of privacy protection the law requires of you, and will tell you if we can no longer meet these obligations;
• lets you take reasonable steps to stop and fix any use of shopper data that this agreement doesn't allow.

LeLoop certifies that it understands these restrictions and will comply with them.

7. Subprocessors

You allow LeLoop to use these providers ("subprocessors") to run the service:

• Render Services, Inc. runs LeLoop's servers (USA, Oregon). Traffic passes through Render's network provider, Cloudflare, Inc.
• Supabase, Inc. hosts LeLoop's database (USA, Oregon, on Amazon Web Services).
• Google LLC delivers LeLoop's emails to you through Gmail, including the records we send you when a shopper asks to see their information (USA).
• GitHub, Inc. stores LeLoop's daily database backups for 21 days (USA). Each backup is encrypted before it leaves our systems with a key only LeLoop holds, so GitHub can't read it.

We'll email you at least 30 days before adding or replacing a subprocessor. If you object on reasonable data-protection grounds, we'll try to resolve it with you; if we can't, you can stop using LeLoop, and uninstalling deletes your store's data. Each subprocessor is bound by data-protection terms at least as protective as this agreement, and LeLoop remains responsible to you for its subprocessors' work.

Not subprocessors: Shopify is your own platform, so what LeLoop saves to your store (customers, discount codes, files) is held by Shopify under your agreement with Shopify. Tools you connect, such as Klaviyo, Mailchimp, Postscript or your own system, are your processors, not ours; LeLoop sends them signups only when you turn them on.

8. Transfers outside Europe

Shopper data is stored in the United States. Where the GDPR, the UK GDPR or Swiss law applies to a transfer of shopper data to LeLoop, the parties agree to the following, which form part of this agreement:

• EU: the Standard Contractual Clauses approved by European Commission Decision 2021/914, Module Two (controller to processor). Clause 7 (docking) applies; under Clause 9, option 2 applies, with the 30 days' notice in section 7; the optional wording in Clause 11 doesn't apply; under Clause 13, the supervisory authority is the one that is competent for you; under Clauses 17 and 18, the law and courts of Ireland apply. Annexes I and II of the clauses are Annexes 1 and 2 below, and Annex III is the list in section 7.
• UK: the International Data Transfer Addendum to those clauses, issued by the UK Information Commissioner (version B1.0), with the details above. Either party may end the Addendum as its Section 19 allows.
• Switzerland: the same clauses, with the Swiss Federal Act on Data Protection in place of the GDPR where it applies, and the Swiss Federal Data Protection and Information Commissioner as the competent authority.

If these clauses conflict with the rest of this agreement, the clauses win.

9. If something goes wrong

If we become aware of a personal data breach affecting your shopper data, we'll tell you without undue delay, and within 48 hours, by email to your account address, so you can meet the GDPR's 72-hour deadline. We'll tell you what happened, the kinds and approximate number of shoppers and records involved, the likely consequences, what we've done and will do, and who to contact. If we don't know everything yet, we'll send what we know and follow up. We'll also tell Shopify within 24 hours, as Shopify's terms require. We won't notify your shoppers or a regulator on your behalf unless you ask us to or the law requires it.

10. Information and audits

On request, we'll give you the information you need to show that this agreement is being followed, and answer one security questionnaire a year (more after a breach, or if a regulator asks). If that isn't enough, you may audit LeLoop's compliance, or have an independent auditor do it, with 30 days' notice, during business hours, under a confidentiality agreement, and at your own cost. We also cooperate with Shopify's data-protection reviews.

11. How long we keep shopper data, and deleting it

• While you use LeLoop: your store's signups, popups and results are kept, and everything else is deleted on a fixed schedule as soon as LeLoop has no use for it. Our privacy policy lists each period.
• A shopper's deletion request: when Shopify forwards it, we erase that shopper's email address and phone number from your signups, cancel anything not yet sent to your connected tools, and detach their orders from our records.
• When you leave: when you uninstall LeLoop, Shopify notifies us 48 hours later, and we delete all of your store's data. A store that isn't on Shopify can delete itself in the dashboard (Settings → Delete your store from LeLoop), which deletes all of its data at once, or ask us by email, and we'll delete it within 30 days. You can export your signups from the dashboard at any time before you go.
• Copies: deleted data leaves our encrypted backups within 21 days, and our hosting logs within about 7 days.

12. Changes, and which document wins

We may update this agreement, for example when the law changes or when we add a subprocessor (with the notice in section 7). We'll email you about any change that lowers the protection it gives shopper data at least 30 days before it applies, and list every version below. If this agreement conflicts with any other agreement between you and LeLoop about personal data, this agreement wins.

Annex 1: Details of the processing

• Parties. Data exporter and controller: you, the store using LeLoop. Data importer and processor: LeLoop LLC, leloop.team@gmail.com.
• Whose data. Your store's visitors and customers.
• What data.
  • What shoppers type into a popup: their email address and, if you ask for it, their phone number. When a shopper agrees to text messages, whether they agreed, when, and the exact wording they agreed to.
  • A random visitor ID and a count of visits, kept in the shopper's browser and not linked to their name.
  • For each popup shown: whether it's a phone or computer, whether the visitor is new or returning, the kind of site that sent them (for example "search") and the offer shown. The page's path (without anything after a "?") and the cart's value are used at that moment to choose a popup, and aren't kept.
  • Discount codes issued, and whether they were used.
  • For orders: the order number, total, currency, and any LeLoop code or visitor ID on the order. No names, addresses or contact details from orders.
  • IP addresses, used only briefly in memory to stop abuse and never stored in our database; our hosting provider's logs record them, with browser details, for about 7 days.
• Sensitive data. None is intended. LeLoop never receives payment details.
• How often. Continuously, while LeLoop is installed on your store.
• Why. To provide LeLoop to you, as described in section 4.
• How long. As set out in section 11.

Annex 2: Security measures

• Encryption in transit: every connection uses HTTPS, including the one between our servers and our database, whose certificate we verify.
• Encryption at rest: the database is encrypted at rest by Supabase (AES-256). The access Shopify grants us for your store and the API keys you connect are encrypted again by LeLoop (AES-256-GCM).
• Access: only LeLoop's founder can reach production systems, and the hosting, database, code and email accounts use two-step login.
• Signing in: merchants sign in through Shopify's own session tokens, so LeLoop keeps no merchant passwords. A store that isn't on Shopify signs in with a one-time link emailed to its owner.
• Trusted messages only: order and data-request messages from Shopify are accepted only when Shopify's signature checks out.
• Keeping data apart: every store's data is kept separate from every other store's, and automated tests check it.
• Collecting less: no payment details, no IP addresses in the database, page addresses used only to choose a popup and never stored, and, where your cookie banner asks shoppers for consent, nothing at all until a shopper allows analytics.
• Abuse limits: public endpoints are rate-limited, discount codes are capped per visitor and per store, and bot signups are blocked.
• Backups: daily, encrypted before they leave our systems, and kept 21 days. We test restoring one every month, starting November 2026.
• Changes to the code: more than 600 automated tests run on every change, including the full app against a real database.
• Incidents: a written incident plan, with the notification times in section 9.
• Certifications: LeLoop itself has no SOC 2 or ISO 27001 certification. Our hosting and database providers, Render and Supabase, each have SOC 2 Type II reports.

See also our security page.

Versions

• 1.2, October 12, 2026: a store that isn't on Shopify can delete itself from the dashboard (section 11).
• 1.1, October 11, 2026: LeLoop no longer keeps the page or the cart's value with each popup shown (Annex 1).
• 1.0, October 11, 2026: first version.

Contact

LeLoop LLC · leloop.team@gmail.com