Data processing agreement

Last updated 25 October 2026

This agreement is part of the terms of service and applies to every store that uses Afterflow. It covers the personal data of the store’s customers that Afterflow processes for the store.

Roles

The store is the controller of its customers’ personal data. Afterflow is the processor and handles that data only on the store’s instructions, which are the settings and flows the store chooses in Afterflow.

What is processed and why

• Data: customers’ email address and first name, order number, products bought, order amount, marketing consent at checkout, and records of emails sent, opened and files downloaded.
• Purpose: delivering the files a customer bought, letting them get their links again, and sending the follow-up emails the store has switched on.
• Duration: while the store uses Afterflow, and no longer than two years after each purchase.

Afterflow’s commitments

• Process the data only for the purposes above, never for its own marketing, and never sell it.
• Keep it confidential. Only people who run Afterflow can access it, and every dashboard access is logged.
• Protect it: HTTPS for all traffic, encrypted storage and backups, encrypted access tokens, and signature checks on every request from Shopify.
• Help the store answer customers’ requests to see or delete their data. With the Shopify app this happens automatically.
• Tell the store without undue delay, and within 72 hours, after becoming aware of a personal data breach that affects its customers. See security and incidents.
• Delete the data when the store stops using Afterflow, as described in the privacy policy.

Subprocessors

Afterflow uses these subprocessors: Render (hosting and storage, Frankfurt, Germany), Resend (email delivery, EU), and Shopify (order data and billing for the Shopify app). If a store connects Klaviyo, events are sent to that store’s own Klaviyo account on its instruction. Afterflow will update this list before adding a new subprocessor.

Transfers

Data is stored in the EU. Where a subprocessor handles data outside the EU, it does so under the European Commission’s standard contractual clauses or another valid transfer mechanism.

Contact

Questions about this agreement go to antondogena@gmail.com.