Data processing agreement
Version 1.0 · November 2, 2026 · Article 28 GDPR
Shops that install the FitScouts app from the Shopify App Store accept this agreement when they install it. Shops that contract directly accept it when they sign the quote. How the data is handled in practice is described in the privacy policy. If the Spanish and English versions differ, the Spanish version prevails.
Parties
- Controller (“the Shop”): the natural or legal person who owns the online shop that installs or contracts FitScouts.
- Processor (“FitScouts”): Albert Moreno, Spanish tax ID 47239092J, Avinguda Corts Catalanes 32, 08172 Sant Cugat del Vallès (Barcelona, Spain). Contact: info@fit-scouts.com.
1. Subject matter
FitScouts provides the Shop with a chat assistant that recommends sizes and answers product questions on its website, and a dashboard with the conversations and their outcomes (sales, returns, surveys). To do so it processes personal data of the people who visit and buy from the Shop, on the Shop’s behalf.
2. Duration
For as long as the Shop uses the service. On termination, clause 10 applies.
3. Nature, purpose and data
| Processing | Data | Data subjects | Purpose |
|---|---|---|---|
| Chat | Message text (may include body measurements and usual size), random session identifier, product being viewed | Visitors who use the chat | Reply and calculate the size |
| Contact form (if the Shop turns it on) | Name, email or phone, consent | Visitors who fill it in | So the Shop can contact them |
| Orders and returns (Shopify app) | Order number, products, size, quantity, amount, return reason, originating conversation | The Shop's buyers | Sales attribution and size accuracy |
| Size survey | Order number, product, size, answer | Buyers who answer it | Size accuracy |
| Order status in the chat | Status, shipping and tracking of the logged-in shopper's orders (not stored) | Logged-in buyers | Tell them where their order is |
| Usage limits | IP address, only as a temporary counter (minutes or hours) | Visitors | Prevent abuse |
FitScouts does not process names, emails, phone numbers or addresses from orders, nor payment details. Body measurements are not special-category data (Art. 9 GDPR), but are handled with the same care.
4. Instructions
FitScouts processes the data only on the Shop’s documented instructions, which are this agreement and the settings the Shop chooses in its dashboard, including with regard to the international transfers in clause 7. If an instruction appears to infringe the GDPR, FitScouts will inform the Shop immediately.
5. Confidentiality
Persons authorised to process the data are bound by confidentiality. Currently only the owner of FitScouts has administrative access, protected by Google sign-in and a list of authorised emails.
6. Security (Art. 32 GDPR)
- Encryption in transit (HTTPS) for all communications.
- Shopify access tokens encrypted at rest (AES-GCM).
- Per-shop isolation: one shop’s dashboard cannot see another’s data.
- Dashboard passwords hashed with PBKDF2 (100,000 iterations) and attempt limits.
- HMAC signatures on Shopify webhooks, survey links and order data.
- Usage limits per IP and per shop.
- Automatic deletion periods (clause 9).
Technical details are available to the Shop on request.
7. Sub-processors
The Shop gives FitScouts general authorisation to engage these sub-processors. FitScouts will give 30 days’ notice of any change to Cloudflare or OpenRouter, and the Shop may object and, in that case, stop using the service. The specific AI model provider is chosen by OpenRouter among those meeting the condition below and may change without prior notice; its list is at trust.openrouter.ai.
| Sub-processor | What it does | Where | Safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Servers, database and storage | EU and US | Cloudflare data processing addendum with Standard Contractual Clauses |
| OpenRouter, Inc. | Sends the chat text to the AI model | US | OpenRouter data processing agreement with Standard Contractual Clauses |
| Model provider via OpenRouter (currently Anthropic, PBC) | Writes the chat replies | US | Under OpenRouter's data processing agreement |
FitScouts imposes on its sub-processors data protection obligations equivalent to those in this agreement (Art. 28(4) GDPR), through their data processing agreements.
No training. Every request to the AI model is sent with OpenRouter’s condition that it may only be handled by providers that do not collect or keep the data for their own purposes. The data is therefore not used to train AI models.
8. Data subject rights
FitScouts will help the Shop respond to requests for access, erasure and the other rights. Shopify’s privacy webhooks (customer data request and customer erasure) are handled automatically. For anything else, the Shop writes to info@fit-scouts.com and FitScouts replies within 10 days at most.
9. Retention
| Data | Period |
|---|---|
| Chat messages, sizes calculated from measurements, contact form data, chat events, topics and ratings | 90 days |
| Orders, returns, surveys and size exchanges | 13 months |
| Product records (not personal data) | While the app is installed |
| Per-IP usage counters | Minutes or hours |
| Contact details stored in the visitor's browser | 90 days |
10. End of the service
When the app is uninstalled, access to the shop is removed at once and, 48 hours later, all of the Shop’s data is deleted: orders, returns, surveys, size exchanges, product records and, if the shop signed up through the app, its conversations. For direct contracts, the Shop chooses whether the data is deleted or returned to it, within 30 days.
11. Anonymous statistics
The Shop authorises FitScouts to produce, before deletion, aggregated and anonymous statistics (for example: number of conversations, share of orders with the adviser or of returns due to size, per month and type of shop), with no data that could identify any person or the Shop. These statistics are not personal data and FitScouts may use them to improve the service and in its marketing. No data about a specific Shop will ever be published without its written permission.
12. Personal data breaches
FitScouts will notify the Shop without undue delay and at the latest within 48 hours of becoming aware of a breach affecting its data, including when a sub-processor reports it. The notice will state what happened, which data and roughly how many people may be affected, and the measures taken, so that the Shop can notify the supervisory authority within its 72 hours.
13. Impact assessments
If the Shop has to carry out a data protection impact assessment or a prior consultation with the supervisory authority (Arts. 35 and 36 GDPR) about the processing FitScouts performs, FitScouts will provide the information it has about it.
14. Audits
FitScouts will make available to the Shop the information needed to demonstrate compliance and will allow reasonable audits, with 30 days’ notice and at the Shop’s expense.
15. Governing law
Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). Courts of Barcelona, unless mandatory law provides otherwise.