Data Processing Agreement

01Who this agreement is between

This agreement is between Pay Tech Payments LLC (303 South Water Street, Ste 200, Henderson, NV 89015), which operates Covr, and each store that installs or uses Covr (“the store” or “you”). It forms part of the Covr Terms and applies from the moment a store installs the Covr app or otherwise sends us order data. Where this agreement and the Terms disagree about personal data, this agreement wins.

“Shoppers” means your customers. “Personal data” means information about an identifiable shopper. “Applicable privacy law” means the data protection laws that apply to the processing, including US state privacy laws and, where they apply, the GDPR and UK GDPR.

02Roles

For the order data your store sends us, you are the controller (the business that decides why the data is processed) and Covr is your processor (the service provider that processes it for you). We process it only to provide package protection to your store, as described here, and on your documented instructions. Installing the app, approving its permissions, and choosing its settings are your instructions.

When a shopper files a claim with us, we also deal with that shopper directly: we decide the claim, pay it, and keep the financial record. For that part we act on our own account, and our Privacy Policy governs it.

03What we process, and why

• Shoppers’ data: name, email address, phone number, shipping address, the order (items, amounts, and whether protection was bought), carrier tracking and delivery scans, and, if they file a claim, what they tell us and the photos and messages they send.
• Your staff’s data: the name and email of the people at your store who use Covr.

We use it only to:

• price and offer package protection on your orders;
• track each protected shipment to delivery;
• receive, investigate, and settle claims, by replacement, store credit, or refund;
• detect duplicate and fraudulent claims, including by comparing a claim with the shopper's earlier claims made through Covr at other stores;
• bill your store and keep the financial records the law requires.

We do not sell personal data, share it for advertising, or use it to market to shoppers. We do not use one store’s shopper data for anything other than the purposes above.

04Our people

Only Covr staff who need shopper data for one of the purposes above can see it, and each sees only what their role needs: claims staff see claims work and no financial information. Everyone with access is bound to keep it confidential.

05How we protect it

• Encryption in transit (TLS) on every connection, and encryption at rest for the database, file storage, and backups.
• Your store's access token for Shopify is additionally sealed with a key held only in our production environment.
• Role-based staff access, strong passwords (at least 12 characters), and a log of which staff member viewed which shopper's data.
• Only the Shopify permissions the service needs, and no order data kept from a store we have not approved.

06Sub-processors

We use these service providers to run Covr. Each receives only what it needs for its part, is bound by contract to protect it and use it for nothing else, and may not sell it.

• Vercel (US): application hosting and storage of claim photos.
• Neon (US): the database.
• Resend (US): email to shoppers about their claims.
• Twilio (US): text messages about a claim, only to shoppers who agree to be texted.
• Sendblue (US): text messages a store chooses to send its own customers through Covr, only for stores that switch this on, and only to shoppers who agreed.
• Smarty (US): checking that shipping addresses are deliverable.
• Slack (US): alerts to our staff when a shopper needs a person, which can include the shopper’s message.
• Clerk (US): sign-in for your staff. Clerk receives your staff’s names and emails, not shoppers’ data.
• Anthropic (US): an AI-assisted summary of the evidence on a claim for our claims staff, the drafting of the replies a store’s texting assistant sends, and reading the texts a store’s customers send its texting line to pick out the questions they ask, so the store can answer them; the texting jobs run only for stores that switch texting on. A person makes every claim decision.
• Stripe (US): collecting payment from and paying your store. Stripe receives your store’s business and bank details, not shoppers’ data.

We post any change to this list here, with a new date at the top, before the new provider receives personal data. If you object to a change, tell us; if we cannot address the objection, you may stop using Covr and we will delete your shoppers’ data as described in section 9.

07Where the data is

Personal data is stored and processed in the United States. Where applicable privacy law requires a transfer mechanism for data from outside the US, the parties agree to rely on the standard contractual clauses that law recognizes, which are incorporated by reference.

08Shoppers' requests

When a shopper asks to see or delete their data, Shopify sends us the request on your behalf. We answer it within 30 days: a request to see data is exported and sent to you to pass on, and a request to delete it is carried out automatically. If a shopper contacts us directly about data your store controls, we tell you and help you respond.

Deletion removes the shopper’s name, contact details, address, messages, and photos. We keep the amounts of premiums and claim payments, without the person attached, because the law requires financial records. We also keep a record that a phone number asked not to be texted, because forgetting it would let texting start again.

09How long we keep it, and when you leave

For stores using the Covr Shopify app, shopper data is kept for 13 months after the order, then deleted as described in section 8. If your store uninstalls the app, we stop receiving its orders immediately, and when Shopify asks us to erase your store’s data (48 hours after uninstalling) we delete it within 30 days, keeping only the financial records described above.

10If something goes wrong

If we become aware of a breach of security that leads to the accidental or unlawful loss, disclosure of, or access to your shoppers’ personal data, we will tell you without undue delay, and within 72 hours of confirming it. We will tell you what happened, what data was involved, what we have done about it, and who to contact, and we will help you meet any duty you have to notify shoppers or regulators.

11Information and audits

We will answer your reasonable written questions about how we protect personal data, and give you the information you need to show that this agreement is being followed, once a year or after a breach.

12Everything else

Liability under this agreement is subject to the limits in the Terms. This agreement is governed by the laws of the State of Nevada. If this agreement changes in a way that matters, we change the date at the top and post the new version here. Questions about any of it go to support@covrprotection.com.