NativTap
This addendum forms part of the Terms of Service between the merchant who uses Nativtap (the "Merchant") and Nativtap ("Nativtap"). It applies to personal data of the Merchant's customers that Nativtap processes to provide the service ("Customer Data"). Where data protection law such as the GDPR applies, the Merchant is the controller and Nativtap is the processor.
1. Scope and instructions
Nativtap processes Customer Data only on the Merchant's documented instructions, which are these terms, the Merchant's configuration of the service and the Merchant's use of its features. Nativtap tells the Merchant if it believes an instruction breaks data protection law. Nativtap does not sell Customer Data, does not use it for advertising and uses it for its own purposes only to keep the service secure and reliable, and does not use it for automated decisions with legal or similar effects.
2. Details of the processing
| Item | Description |
|---|---|
| Purpose | Running the Merchant's iOS shopping app: serving its configuration, delivering push notifications, measuring app usage and attributing app orders, and processing shopper account deletion requests. |
| Duration | While the Merchant has Nativtap installed, plus the deletion periods in section 7. |
| Data subjects | Shoppers who use the Merchant's app. |
| From Shopify (protected customer data level 1) | Order ID, order total, currency and attribution of app orders; the Shopify customer ID of a shopper who asks to delete their account (together with the request status). |
| From the app on the shopper's device | A random device identifier (UUID), push token, notification permission status, app version, time zone, last-active time and app usage events (app open, add to cart, checkout started and completed, notification opened). Events carry product and variant IDs, quantities, a cart identifier and, where an event is linked to a notification, the campaign ID, but no names, emails, phone numbers, customer IDs or order IDs. |
| Cart reminders | A hashed cart identifier, whether the cart is empty and the time of the last cart change, kept for up to 7 days in a short-lived cache. |
| Technical request data | IP address and request details in server logs and short-lived rate-limit counters. |
| Crash reports | Device model, iOS version, app version and stack trace, sent to Sentry from the app (see section 5). |
| Data Nativtap does not store | Shopper names, email addresses and shipping addresses (protected customer data level 2). They go directly from Shopify to the shopper's device and are not stored by Nativtap. Shopify's privacy webhooks (customer data requests and erasure) can carry such fields, for example an email address or phone number, to our API; we drop them before processing. Nativtap does not use the advertising identifier (IDFA). |
3. Confidentiality
Nativtap makes sure that the people it authorizes to access Customer Data are bound by a duty of confidentiality, and lets them access it only when they need it to provide the service.
4. Security
- Traffic between shoppers' devices, Shopify and our public services is encrypted in transit with TLS.
- Our Managed PostgreSQL database is encrypted at rest by DigitalOcean, and our Cloudflare R2 file storage is encrypted at rest by Cloudflare.
- Apple keys and signing certificates are additionally encrypted by the application with AES-256-GCM.
- Development and testing run in separate environments from production: a separate Shopify app and separate local databases with sample data. Nativtap has no process that copies production data into them.
- Shopify's compliance webhooks are verified with HMAC and rejected if the signature is wrong.
5. Subprocessors
The Merchant authorizes Nativtap to use the subprocessors below. Nativtap is responsible for its subprocessors. When we add or replace a subprocessor we update this list and the one in the Privacy Policy. Merchants should check this list for changes. The Merchant may object by writing to support@nativtap.com; if the objection cannot be resolved, the Merchant can stop using the service.
| Subprocessor | Purpose | Data involved | Location |
|---|---|---|---|
| Shopify | Store data, product catalog, customer accounts, checkout and orders; delivers the compliance webhooks (data requests, erasure, uninstall). | Merchant store data; shopper account data stays between Shopify and the shopper's device. | Provider-managed |
| Apple | App Store distribution, TestFlight, code signing and push notifications (APNs). | App binaries and listing details; push tokens and notification payloads. | Provider-managed |
| DigitalOcean | Application hosting, managed databases and queues. | All data described in the Privacy Policy except what stays on shoppers' devices. | Singapore |
| Cloudflare | Website hosting; sending transactional email to merchants; file storage (R2) with a content delivery network for published app content and uploaded images. | Website requests; merchant email address and message content; published app configuration and images merchants upload. | Provider-managed |
| Sentry | Crash reports and app health data (sessions, app start timing and a small sample of performance traces) from the iOS apps built with Nativtap. | Device model, iOS version, app version, stack trace, a short trail of app actions, and the app and store identifiers. The app is set not to send personal data and scrubs events before they leave the device. | Provider-managed |
| PostHog | Lifecycle events about merchants' use of Nativtap (for example installed, first preview, app live, uninstalled). | Usage events identified by a random shop identifier; no shopper data. | United States |
| PostHog (app analytics) | Usage analytics of the merchant's app (app opens, cart and checkout steps, push opens, website banner taps). | Events identified by a random device identifier, or the store for banner taps; no names, emails, IP addresses or order IDs. | United States |
| GitHub (GitHub Actions) | Builds and packages the iOS apps that merchants publish. | Build inputs for each app in the run: app configuration, images, the code-signing material for that build and the App Store Connect key used to upload it. One build run can include apps from several merchants, built one after another. | Provider-managed |
| Slack | Operational alerts for our team (errors, queue and uninstall notices). | Identifiers and counts only; no shopper data. | Provider-managed |
6. International transfers
Nativtap's databases are hosted in Singapore; file storage is hosted on Cloudflare R2. Some data is processed by subprocessors in other countries (see section 5). Where Customer Data is transferred across borders, Nativtap relies on the transfer mechanisms its providers make available where the law requires them.
7. Deletion and return of data
- Uninstall: when the Merchant uninstalls Nativtap, Shopify sends a shop erasure request about 48 hours later and Nativtap deletes all the Merchant's data, including Customer Data in its databases and file storage. If that request never arrives, deletion happens about 30 days after the uninstall. This does not cover a short log of operator actions (who did what and why, for example a store lock), lifecycle events already sent to PostHog under the random shop identifier, crash reports already sent to Sentry, and alerts already sent to Slack; those are kept by those providers under their own retention. Anonymous app usage events already sent to PostHog (identified by a random device identifier, or by the store for website banner taps) are not deleted per shop, because they cannot be linked to a shopper; PostHog keeps them under its own retention. Backups are not edited and expire as they rotate (the managed PostgreSQL database keeps a point-in-time recovery window of 7 days).
- Shopper deletion requests: when a shopper deletes their account in the app, Nativtap asks Shopify to erase the shopper's personal data and deletes its own record of the request 30 days after it completes (30 days after the last change for failed or cancelled requests).
- Usage events: individual event records are kept by our analytics provider under its own retention (see the Privacy Policy) and cannot be linked to a shopper; daily counts are kept while Nativtap is installed and deleted on shop erasure.
- Return: a Merchant may ask for a copy of its data by emailing support@nativtap.com, and Nativtap will consider reasonable requests in good faith.
8. Helping with data subject requests
Nativtap processes Shopify's customer data request and customer erasure webhooks. For a data request, Nativtap tells the Merchant which order records it holds for the customer; for an erasure request, it removes the customer's order IDs from its order records. On reasonable request, Nativtap helps the Merchant answer access, correction, deletion, restriction and objection requests from shoppers, to the extent the Customer Data is held by Nativtap, and provides information the Merchant reasonably needs for a data protection impact assessment. If a shopper contacts Nativtap directly, Nativtap will direct the shopper to the Merchant.
9. Personal data breaches
Nativtap notifies the Merchant without undue delay, and within 72 hours, after confirming a personal data breach affecting Customer Data, and provides what it knows: the nature of the breach, the data and number of people concerned, the likely consequences, and the measures taken or proposed. Nativtap follows a written process to detect, classify, contain and fix security incidents and to notify affected Merchants, and keeps a record of each incident.
10. Audits
On written request, Nativtap provides information reasonably needed to show compliance with this addendum. Any audit beyond that is agreed in advance, at the Merchant's cost, no more than once a year, with reasonable notice, during business hours and without exposing other merchants' data.
11. Liability
Liability under this addendum is subject to the limits in the Terms of Service.
12. Contact
Nativtap: support@nativtap.com. Data protection contact: support@nativtap.com.