Who does what
You decide which stores to connect and what to do with their data: you are the controller. Zikkio processes that data only to provide the API, on your documented instructions: we are the processor.
What we process
Catalog data: products and variants, with name, SKU, GTIN, price, cost, stock, brand, category and image links.
Order data: the orders your application reads, with the end customer’s name, addresses and email.
Store keys: API keys, passwords and OAuth tokens, encrypted with AES-256.
Connection data: the store address and the account it belongs to.
Whose data
Product and price data is not personal data. Personal data appears in orders, which carry the end customer’s details, and can appear in store keys, such as the admin login of a Magento store. The names and emails of your team are account data, covered by our Privacy policy.
How long
Store keys are deleted as soon as a store disconnects. The catalog copy is deleted within 30 days of disconnecting, backups included. [How long order data is kept: to confirm.] When you close your account, we delete your data within [Number of days, to confirm].
Sub-processors
We tell you 30 days before adding or replacing a sub-processor, so you can object.
| Provider | What they do | Location |
|---|---|---|
| Amazon Web Services | What they do: Servers, database and cache | Location: United States |
| Sentry | What they do: Error tracking, configured not to receive personal data | Location: United States |
| Slack | What they do: Internal error alerts, without store keys or request bodies | Location: United States |
| [Payment provider] | What they do: Billing and invoices | Location: [To confirm] |
| [Email provider] | What they do: Account and billing emails | Location: [To confirm] |
| [Bot protection provider] | What they do: Protects sign-up from bots | Location: [To confirm] |
Security measures
Store keys encrypted with AES-256 and never returned by the API.
TLS with certificate checks on every call.
Every request checked against the account that owns the store.
Logs kept for 5 days, without store keys or request bodies.
The Security page describes them in full.
Personal data breaches
If a breach affects your data, we tell you without undue delay and within [Number of hours, to confirm] of finding it, with what we know and what we are doing about it.
Requests and audits
We help you answer requests from data subjects and supervisory authorities. On request we share the information you need to show compliance.
Transfers
Data is stored in the United States. Transfers out of the European Economic Area rely on [Transfer mechanism, for example the EU Standard Contractual Clauses].
Getting a signed copy
The standard agreement comes with every paid plan. On the Developer plan, [processor terms for free accounts, to confirm with counsel]. Write to info@zikkio.com for a copy signed by both sides.