SharedStock Data Processing Addendum

Version: 2026-10-05.v1. Published: 5 October 2026.

This Addendum forms part of the SharedStock Terms of Service at https://www.7afidi.com/sharedstock/terms between the merchant and Anas Hafidi, an individual developer using 7afidi as a brand, established in Morocco. Contact: contact@7afidi.com. Postal address where required: Lotissement lwahda n152 - Bouarfa. It takes effect through explicit acceptance of the published Terms and this incorporated Addendum, with the same recorded version and publication date.

Roles and documented instructions

For merchant-controlled Shopify store personal data, the merchant is the controller and 7afidi is the processor where those roles apply. If the merchant acts for another controller, 7afidi acts as its authorized subprocessor. The merchant supplies lawful documented instructions, notices and permissions. Processing is limited to delivering SharedStock, the merchant's supported configuration and instructions, privacy fulfillment and lawful safety/security requirements. An instruction believed to infringe applicable data-protection law will be raised with the merchant. Required legal disclosures will be notified where legally permitted. Independent support/account administration is described in the Privacy Policy and is not automatically controller-instructed processing.

Processing description

Subject matter: shared-component inventory and safe lifecycle/recovery for an eligible Shopify Online Store at one Shopify-managed location. Duration: authorized service use plus necessary return/deletion, privacy, safety and restricted backup periods. Nature: authenticated collection from Shopify, organization of reduced identifiers, configuration, inventory verification, restricted storage, limited export, redaction and deletion.

Data subjects: merchant/store staff and customers whose orders are linked to inventory identifiers. Data types: shop/install and session identifiers; staff identity associated with Shopify authentication; product/variant/location/inventory IDs; quantities and ratios; limited order/refund/edit references; reduced notification/activity context; privacy request metadata; incidentally identifying merchant free text. Buyer name, email, telephone and postal address are neither required nor requested. Complete buyer profiles and webhook/order payloads are not persisted as app records.

Confidentiality and security

Access is restricted to authorized persons bound to confidentiality. Public traffic uses HTTPS/TLS; Railway databases are encrypted at rest according to its DPA; private application/database traffic uses WireGuard-encrypted Railway networking. Database TLS is required but does not independently authenticate the server certificate in that private-network configuration. Backups use TLS transport, Backblaze AES-256 server-side encryption for current uploads, and application AES-256-GCM archive encryption before upload. Secrets and complete payloads are excluded from application logs. Sensitive management uses verified online store-owner access and canonical entitlement. Journal, revision, uncertain-write and privacy restore fences are preserved. Controls are proportionate measures, not a guarantee that incidents cannot occur.

Subprocessors

The merchant authorizes the following service providers for these stated purposes: Railway Corporation for application/database/private-volume hosting, with configured production application/database storage in EU West, Amsterdam; Backblaze, Inc. for private encrypted production backups in EU Central. Their own subprocessors and administrative operations follow their published provider terms; configured EU storage is not a guarantee of exclusively EU processing.

Before adding or replacing a subprocessor with access to merchant-controlled data, 7afidi will notify merchants with sufficient advance notice to allow a reasonable data-protection objection. The notice will identify the provider, purpose and relevant locations. We will seek a reasonable resolution; if no suitable solution is available the affected merchant may terminate the affected service. Subprocessors must be subject to appropriate contractual data-protection obligations. 7afidi remains responsible for its processor obligations under applicable law. Provider processing is governed by the applicable service and data-protection terms, available at https://railway.com/legal/dpa and https://www.backblaze.com/company/policy/dpa-for-eea-eu-residents. No provider contractual coverage beyond those applicable terms is represented.

Assistance, incidents and review

We assist with applicable access, correction, erasure, restriction and other rights through authenticated Shopify privacy requests and restricted owner/operator handling. Applicable Shopify privacy requests are handled within 30 days. Generation of an export is not proof of delivery; authority and recipient verification are required. Pending requests remain actionable after uninstall and without paid access.

We will notify the merchant without undue delay after becoming aware of a personal-data breach affecting data processed on its behalf, supply available facts in stages and reasonably assist with the merchant's notification, risk-assessment and mitigation obligations. The merchant remains responsible for its own authority/data-subject notification duties. No fixed response SLA or unverified incident certification is promised.

We will make reasonably necessary information available to demonstrate these obligations and cooperate with proportionate audits, taking account of confidentiality and other merchants' security. Audits must not expose other merchants' data or disrupt inventory safety. Statutory audit and regulator rights remain unaffected.

Return, deletion and retention

On termination, the merchant may request return of available limited store-related personal data followed by deletion, or deletion without return. We assist subject to applicable law and necessary, documented safety dependencies. Authentication access is revoked on uninstall; uninstall alone does not unwind Shopify-native inventory relationships. Applicable shop erasure is installation-fenced and removes local shop records. Shopify's own orders and native resources remain governed by Shopify and the merchant.

Routine completed notification context/activity follows a 90-day cleanup policy. Minimal replay identities and required original-order/pool associations remain until their dependency can be retired. Pending privacy requests remain until fulfilled; reduced completed proof follows 365 days from completion. Uncertain writes, conversion and active recovery dependencies remain until resolved and retired; confirmed detached adjustments follow 365 days after resolution. Active conversion/ownership evidence persists with the managed pool. Deletion must not manufacture certainty about an ambiguous write.

Production backups follow a maximum 30-day policy with scheduled all-version deletion and no newest-set exception. Failures are escalated; provider physical deletion and external copies require operational verification. Application-controlled export files expire within seven days after confirmed delivery; external downloads/copies require operator/recipient enforcement. A restricted independent deletion ledger and its existing key remain while affected recoverable copies or replay/safety dependencies require them, preventing erased data from returning through restore. Restore filtering is not physical expiry. The Privacy Policy explains provider logs and support correspondence separately.

International transfers and applicable law

Processing includes Railway application/database storage in Amsterdam, EU, Backblaze B2 backup storage in EU Central, and access by the individual operator in Morocco. Provider administrative processing and support may occur elsewhere as described in their terms. International processing and transfers are handled according to applicable privacy law and the providers' applicable contractual and data-protection terms. These terms do not replace obligations that apply to the merchant or 7afidi. If additional arrangements are required for a merchant's processing, the parties will address them before the affected processing proceeds; the merchant may contact contact@7afidi.com to discuss its requirements.

This Addendum does not represent independent legal certification of compliance in every jurisdiction, a government authorization, an adequacy decision or a separately executed transfer instrument. No lawyer review or approval is claimed. Mandatory data-protection law and other applicable mandatory rights prevail over inconsistent Terms. Moroccan law governs this Addendum subject to those mandatory rights.