This agreement forms part of the RosterSort terms of service when accepted by an authorized merchant representative in the app. The merchant acts as controller and Oussama Elayouchi (Vigil Labs), operator of RosterSort, acts as processor for the processing described below.
Instructions, purpose and data
The merchant instructs RosterSort to read customer IDs, names, emails, phone numbers, addresses, order counts and amounts, and the fields needed for customer exports; sort and compare profiles; retain duplicate results and merchant decisions; perform merges only after merchant confirmation; and provide requested exports. Processing concerns the merchant’s customers and lasts while the app is installed, subject to the retention periods below. No selling, advertising, independent profiling or reuse for unrelated purposes is permitted.
Merchant responsibilities and choices
The merchant determines the lawful basis, provides required notices and respects applicable customer choices. Do not instruct the app to process data contrary to those choices. RosterSort does not send marketing or change marketing preferences through its own marketing operations. Merge consequences are handled by Shopify; check relevant customer preferences before merging. Contact the operator to restrict or stop processing. The merchant can stop scheduled scans, decline suggested matches and uninstall the app.
Confidentiality and security
Access is restricted to authorized people with a need to know and confidentiality obligations. The app authenticates merchant requests through Shopify, scopes stored data by shop, logs application access without customer contact details or tokens, and uses HTTPS and an encrypted Fly.io volume. Operator procedures require unique strong passwords, multi-factor authentication, access reviews and a documented incident response. These operational controls must be maintained by the operator; this agreement does not claim any independent certification.
Subprocessor and location
Fly.io provides hosting, encrypted storage and volume snapshots in the configured Paris region. Shopify provides the merchant platform and APIs. No customer data is transferred to advertising, analytics or AI services by RosterSort. Additional subprocessors require prior notice and an opportunity for the merchant to object; a material objection may require ending the service. Any international transfer requiring safeguards must be assessed and covered before that transfer is enabled.
Retention, return and deletion
Stored scan results, merge history and application access events are removed after 90 days. Cached names on ignored pairs are cleared after 90 days; minimal pair IDs remain while installed to preserve the merchant’s instruction not to match those people. Completed data access requests expire 90 days after completion; open requests are retained until resolved and reviewed for their 30-day response deadline. Settings, agreement acceptance and minimal session information remain while needed to provide the installed service. Authenticated Shopify erasure webhooks delete or redact the relevant customer data; the shop erasure webhook deletes tenant data. Encrypted snapshots expire after five days and are not used for normal processing. A restoration requires reconciliation of subsequent erasure requests before service resumes.
Assistance and incidents
RosterSort maintains a queue for authenticated Shopify access requests, an export containing only the requesting customer’s stored data, and authenticated deletion handlers. The operator assists merchants with applicable rights requests, security questions, impact assessments and regulatory enquiries. The operator will notify affected merchants of a confirmed personal data breach without undue delay after awareness, communicate available relevant information and provide updates as the investigation progresses. Information demonstrating compliance is available on reasonable request, subject to confidentiality and protection of other merchants’ data.
Contact and termination
Contact distrimanager2026@gmail.com for processing instructions, objections, rights requests or security incidents. The merchant can export data before uninstalling. On termination, retained tenant data is erased through the Shopify shop erasure process and the backup expiry described above, unless a specific legal retention obligation applies and is communicated.