Merchant data processing · Updated 15 September 2026

Processing on your instructions.

These terms supplement the Merchant terms between the store using Upproof and Yusuf Alperen ÖZ, Meltem Mahallesi, 3834 Sokak, Özgün Sitesi C4 No: 14, Muratpaşa, Antalya, Türkiye. They apply to customer personal information processed for your store and take precedence over the Merchant terms for that processing.

Purpose, scope, and instructions

You determine the purposes of processing your customers’ data; Upproof acts as your processor or service provider, as applicable. For the duration of the service and the retention described in our Privacy notice, we collect, store, retrieve, display, transmit and delete artwork, order identifiers, notes, proof specifications, decisions and associated records to support your design approval workflow. People concerned include your customers and people whose information appears in the content you supply.

Your use of the app and documented support requests are your instructions. We process this data only to provide and secure the agreed service, follow those instructions, or comply with a legal requirement. We will tell you if an instruction appears unlawful or if a legal requirement prevents us from following it, unless notification is prohibited. You are responsible for lawful collection, necessary notices, and instructions you are entitled to give.

We do not sell or share this information for targeted advertising, use it to train AI models, or use it for unrelated commercial purposes. We do not combine it with another merchant’s customer data for those purposes. Merchant account administration and direct support or security records processed for the operator’s own purposes are addressed separately in the Privacy notice.

Access, security, and assistance

Access is limited to people who need it for the service and who must keep it confidential. We maintain proportionate technical and organizational measures, including encrypted web connections, store-scoped access, private customer links, and file validation and integrity checks. Merchants must control their staff access and the distribution of customer links.

We will notify the affected merchant without undue delay after becoming aware of a personal data breach affecting its data, share available information as the investigation progresses, and assist with containment and required notices. We provide reasonable assistance with data rights requests, security assessments and applicable impact assessments. On request, we will provide available information about our safeguards and cooperate with a reasonable, confidential audit of our processing, while protecting other customers’ information and service security.

Providers and international processing

You authorize Microsoft Azure for hosting and Resend for requested email delivery. The app’s hosting is in Belgium; operator access is from Türkiye; Resend stores email data in the United States. Shopify supplies the store platform under your Shopify relationship. Google’s Gmail processes correspondence you send to our support address; avoid sending customer content there unless needed to resolve the request.

We remain responsible for the processing we entrust to subprocessors and require appropriate data protection obligations for that work. We will give merchants notice before adding or replacing a subprocessor that handles customer data, allowing a reasonable opportunity to raise a data protection objection. Contact us for current provider information or an objection so we can assess an alternative or ending the affected processing.

Where an international transfer requires additional safeguards or a processing agreement, contact us to arrange them before sending the affected data. Any required arrangements must be in place before that processing begins.

Return, deletion, and retained records

You may download available files while installed and contact us for help returning or deleting data. We delete data automatically on this schedule: a job closes on completion, on recorded cancellation, or after 365 days without activity; its files are deleted 90 days after closure and its remaining records 180 days after closure; uploads never attached to an order are deleted within nine days. Download anything you must keep for longer before those dates. Customer redaction removes content earlier but can leave linkable order and line identifiers, status, timestamps and usage counts until the job’s record is deleted. Details are in the Privacy notice.

On termination or a valid instruction, we will work with you to return or delete personal information, including reviewing residual identifiers and separately held recovery copies. Shopify shop-redaction requests remove the store’s live app data and sessions. Any data legally required to remain will be limited to that purpose and protected; deletion instructions must be reapplied before recovery data returns to live use. Merchant exports and messages held by your own providers remain under your control.

Email upproofsupport@gmail.com.