Merchant data-processing terms

Parties, purpose and instructions

The merchant determines the lawful purpose of customer discount eligibility. Catwa is operated by an individual in Egypt under the public brand Catwa. Catwa processes relevant data on the merchant’s documented instructions to authenticate, synchronize app-owned catalog metadata, manage discount codes, verify subscription access, secure the app and fulfil support/privacy requests. Contact: owner@catwastore.com.

These terms and the privacy policy are offered to the merchant for acceptance in the authenticated app. They apply for the duration of the service and the stated retention periods. They do not represent Catwa as an incorporated company or replace mandatory legal disclosures or safeguards.

Responsibility for the app and support

Catwa, the app developer and operator, is solely responsible for this application, its development, distribution, operation and support, and for its access, use and storage of merchant data. The merchant contracts with Catwa for the app service. Shopify is not responsible for defects in the app or harm resulting from its installation or use, to the extent permitted by applicable law. Unless Shopify expressly states otherwise, Shopify does not provide installation or usage support for this app. Contact Catwa at owner@catwastore.com for app support or disputes. Catwa remains responsible for liabilities arising from merchant access to or use of the app and from processing of merchant data by Catwa, subject to applicable law.

Changes, suspension or termination of Shopify API access can affect app availability. No guaranteed discount outcome or uninterrupted service is promised; merchants should verify their intended discount rules before use. Nothing here limits mandatory rights under applicable law, requires exclusivity, prohibits competitive development, or restricts independent merchant business relationships.

Data and permitted use

Processing covers shop identifiers, authentication/session properties, catalog and collection identifiers and variant options, app discount settings, customer/segment identifiers chosen for eligibility, and minimal privacy-request receipts and exports. The app does not request customer names, email, phone or addresses for discount logic, and does not collect payment-card details. It does not sell customer data, use it for advertising, or make significant legal decisions about people.

The merchant is responsible for lawful instructions, customer notices and required consent. Catwa will raise apparently unlawful instructions with the merchant and will assist with verified applicable consent, access, correction and deletion requests. Data will not be repurposed for marketing or unrelated profiling.

Confidentiality and security

Access is limited to authorized persons subject to confidentiality. Catwa uses HTTPS, authenticated Shopify sessions, verified webhook signatures, shop-scoped database operations and secure credential handling. On learning of a personal-data breach, Catwa will notify the affected merchant without undue delay, provide known scope, consequences and mitigation information, and update the merchant as facts become available. No absolute-security guarantee or independent certification is claimed.

Service providers and international processing

The merchant authorizes Shopify for store APIs/checkout and Cloudflare for app hosting and D1 storage, subject to their applicable terms. Processing can occur outside the merchant’s country. Catwa will disclose material changes in service providers before additional processing and provide a reasonable opportunity to raise objections. Catwa will not add another processor without appropriate disclosure and contractual arrangements.

These terms do not themselves supply standard contractual clauses or certify that every international transfer is lawful. Where applicable law requires additional transfer safeguards or specific contractual terms, these must be established before the affected processing. The merchant can contact owner@catwastore.com to assess requirements and must not enable processing that lacks required safeguards.

Requests, retention and assistance

Catwa will reasonably assist with verified data-subject requests, security enquiries and proportionate compliance/audit requests using available records. Shopify privacy requests must be fulfilled within 30 days. A prepared export must be delivered securely to the verified merchant before delivery is acknowledged.

Verified uninstall removes shop-scoped credentials, synchronization jobs, locks and the agreement receipt. Pending privacy requests survive uninstall for fulfilment, and are removed on shop/redact. Completed privacy receipts and prepared exports are purged after seven days following completion or acknowledged delivery. Shopify-hosted data follows Shopify lifecycle and merchant controls. Cloudflare Free log retention is three days where enabled, and D1 backup history is seven days. Manual backups require a separate inventory and deletion schedule. Completed deletion requests must be reapplied before restored data is used.

Acceptance and changes

Only a person authorized for the merchant may accept. The app stores the authenticated shop domain, terms version and acceptance time, not a signature image or extra personal contact details. Material updates require renewed acceptance. The merchant can stop processing by uninstalling and request assistance with remaining app-owned Shopify data. Billing approvals are separate: accepting these terms does not approve a subscription charge.