Legal
Data Processing Agreement
Last updated: October 6, 2026.
1. Roles
For storefront customer data, the Merchant is the controller / business and Flokte is the processor / service provider. Flokte processes that data only on the Merchant's documented instructions (the Terms, this DPA, and settings the Merchant configures in the app). The one exception is the shared score in Section 3A, which Flokte operates on its own responsibility as an independent controller / business. Flokte's output is a return-behavior signal for return-abuse prevention; it must not be used to decide anyone's eligibility for credit, insurance, employment or housing.
2. Scope and purpose
- Subject matter: return-abuse detection, the reward / restriction rules the Merchant configures, the order messages the Merchant turns on, and chargeback evidence prepared from them.
- Duration: the term of the Merchant's use of Flokte, plus the deletion period in Section 8.
- Categories of data subjects: the Merchant's storefront customers.
- Categories of personal data: name, email, and address as provided by the platform; phone number, for order messages only; order and return records; replies to order messages, with the IP address and browser used; chargeback details; coarse geography; and the classification and factors Flokte derives.
- Special categories: none requested or knowingly processed.
3. Flokte's obligations
- Process personal data only on documented instructions, and tell the Merchant if an instruction appears to violate applicable law.
- Not sell personal data, and not disclose one Merchant's orders, returns, customer lists or figures to another merchant. The only use of the Merchant's data beyond the Merchant's own store is the shared score in Section 3A, while the Merchant takes part in it.
- Bind personnel with access to confidentiality obligations and limit access to those who need it.
- Implement the technical and organizational measures in Section 5.
- Assist the Merchant with data-subject requests, security, breach notification, and any required impact assessments.
3A. The Flokte network (shared score)
- What it is. A storefront customer matched by email address across participating Shopify stores receives one tier and one score, calculated from that customer's order and return history in all of those stores.
- Instruction and default. Taking part is on by default. While it is on, the Merchant instructs and permits Flokte to use the Merchant's order and return data for the shared score, and receives the shared tier and score for its own customers.
- Opt-out. The Merchant can turn this off in the app's Settings at any time. Flokte then scores the Merchant's customers on the Merchant's data only, and stops using the Merchant's data for any other store.
- What other stores receive. Only the resulting tier and score for their own customers. No other store receives the Merchant's orders, returns, customer lists or figures, or learns that a customer shops with the Merchant.
- Responsibility. Flokte decides how the shared score is calculated and is responsible for it, including answering storefront customers' requests about it and honoring a customer's request to be left out of it.
- Decisions stay with the Merchant. Action rules, reviews and restrictions are the Merchant's own. A shared tier never restricts a customer by itself.
- Disclosure. While taking part, the Merchant uses the shared-score version of the storefront disclosure.
4. Sub-processors
The Merchant authorizes Flokte to use the sub-processors listed at /legal/subprocessors. Flokte will give at least 30 days' notice before a new sub-processor starts processing the Merchant's data, by listing it on that page with the date it takes effect and by emailing Merchants who have asked to be notified. Flokte imposes data-protection terms on each sub-processor that are no less protective than this DPA and remains responsible for their performance. The Merchant may object on reasonable data-protection grounds within the notice period; if the parties cannot resolve the objection, the Merchant may terminate.
5. Security measures
Encryption of personal data in transit and at rest; least-privilege internal access; audit logging; separated test and production environments; and breach-notification readiness.
6. Data-subject requests
If Flokte receives a request from a storefront customer to access, correct, delete, or opt out, Flokte will itself answer the part that concerns the shared score, and will route the part that concerns a store's own data to the relevant Merchant and assist the Merchant in responding, including by correcting or deleting data on the Merchant's instruction. Flokte also honors the platform's data-request, customer-redaction, and shop-redaction webhooks. Requests sent to Flokte directly are acknowledged to the requester and passed to the Merchant promptly, so the Merchant can respond within the period the law allows.
7. Personal-data breach
Flokte will notify the Merchant without undue delay, and within 72 hours of becoming aware, of any personal-data breach affecting the Merchant's data, with the information the Merchant needs to meet its own notification obligations.
8. Return and deletion
When the Merchant uninstalls Flokte, or on the Merchant's written request, Flokte deletes the storefront-customer personal data it holds for that Merchant — customer, order, order message, chargeback, return, score and dispute records — within 30 days, and copies in backups within a further 30 days, except where retention is required by law. The Merchant's data stops counting toward the shared score as soon as the Merchant uninstalls or opts out. Flokte keeps the Merchant's own account, billing and audit records; the audit records hold reference identifiers but no customer names, emails or addresses. If the Merchant reinstalls Flokte before the deletion runs, the deletion is cancelled and processing continues under this DPA. Routine retention limits per data type are enforced on a schedule during the term and are stated in the Privacy Policy.
9. Audits
Flokte will make available the information necessary to demonstrate compliance with this DPA and will contribute to audits, including by providing its then-current security documentation and any third-party reports it holds. On-site audits require reasonable advance written notice and are limited to once per twelve (12) months unless a regulator requires otherwise.
10. International transfers
Flokte stores and processes data in the United States. Where the Merchant, or the customers whose data it sends to Flokte, are in the European Economic Area, the United Kingdom or Switzerland, the transfer is governed by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), and for the shared score in Section 3A Module One (controller to controller), which are incorporated into this DPA by reference; for transfers from the United Kingdom, the UK International Data Transfer Addendum to those Clauses also applies.
For the Clauses: the Merchant is the data exporter and Flokte is the data importer; Section 2 of this DPA describes the transfer; Section 5 describes the technical and organizational measures; the sub-processor list is the list of authorized sub-processors, with general written authorization and the 30-day notice in Section 4; and the Clauses are governed by the law of Ireland, with disputes resolved by the courts of Ireland. If the Clauses conflict with any other part of this DPA, the Clauses prevail.
11. Order of precedence
On any conflict about data protection, this DPA controls over the Terms of Service.