Data Processing Agreement

Effective August 16, 2026 · Advanced Binary Operations LLC

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Advanced Binary Operations LLC ("ABO", "we") and the merchant using FileSteward ("Merchant", "you"). It governs personal data that ABO processes on your behalf. Where this DPA conflicts with the Terms of Service on the subject of processing personal data, this DPA controls.

1. Roles

For personal data relating to your buyers that FileSteward processes to fulfil your orders, you are the controller and ABO is the processor. ABO processes that data only on your documented instructions, which for these purposes are your use of the App and this DPA. ABO acts as an independent controller for data it processes for its own service administration, security, and legal compliance.

2. Subject matter, duration, nature and purpose

Subject matter: delivering digital files that your buyers have purchased, and recording whether each delivery was sent. Duration: for as long as the App is installed, plus the deletion periods in section 7. Nature and purpose: receiving paid-order notifications from Shopify, matching order line items to files you have attached, generating download links, and sending those links to the buyer by email.

3. Categories of data and data subjects

Data subjects: your customers who purchase a product that delivers a file.

Personal data: the buyer’s email address, plus the order id, order number, and the product ids on the order. ABO does not receive or store buyer names, postal addresses, phone numbers, or payment details. FileSteward requests access to the email field only.

4. Sub-processors

You authorise the sub-processors listed in the Privacy Policy section 4 — currently Cloudflare (R2) for file storage, Resend for delivery email, and DigitalOcean for hosting and database. Shopify is the platform and the source of order data. ABO remains responsible for its sub-processors’ acts and omissions. We will give notice before adding or replacing a sub-processor; if you object on reasonable data-protection grounds, you may terminate the App.

5. Security measures

ABO maintains the following technical and organisational measures. These describe what is in place today, not aspirations:

Encryption in transit — all traffic over TLS.
Encryption at rest — file contents in object storage, and the application database on encrypted-at-rest block storage.
Encrypted backups — the database is backed up nightly and encrypted with AES-256 before leaving the host.
Access logging — access to protected customer data is recorded in an audit log that does not itself store buyer email addresses.
Tenant isolation — every database query is scoped to a single shop.
Authenticated webhooks — order notifications are verified by HMAC signature before any payload is read.
Least privilege — storage credentials are scoped to a single bucket; host access is SSH-key only, with no password authentication.
Download links — 256-bit tokens with a download limit, redirecting to storage URLs that expire after five minutes, and revocable.
Separation — test and production data are kept in separate environments and databases.

6. Assisting you

ABO will assist you, taking into account the nature of the processing, with: responding to buyer rights requests; the security obligations in Articles 32–36 GDPR; and data protection impact assessments. FileSteward implements Shopify’s mandatory customers/data_request, customers/redact and shop/redact webhooks, which is the primary mechanism for these requests.

7. Deletion and return

On customers/redact, the buyer’s email is anonymised in our records and their download links are revoked. On shop/redact — which Shopify sends approximately 48 hours after uninstall — all data for that shop is deleted, including file contents in object storage. You may also request deletion directly at any time. Encrypted backups age out on their retention schedule.

8. Personal data breach

ABO will notify you without undue delay after becoming aware of a personal data breach affecting your buyers’ personal data, with the information reasonably available, so that you can meet your own notification deadlines as controller. ABO maintains a written security incident response procedure.

9. International transfers

FileSteward processes data in the United States. Where your use is subject to the GDPR or UK GDPR, transfers rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable), which are incorporated into this DPA by reference and completed with the details in sections 2–4. ABO will not transfer your buyers’ personal data to a country lacking an adequacy decision except under such a mechanism.

10. Audit

On reasonable written request, and no more than once in any twelve-month period unless required by a supervisory authority, ABO will make available the information reasonably necessary to demonstrate compliance with this DPA. Given the scale of the service, this will ordinarily take the form of written responses and documentation rather than an on-site audit.

11. Contact

Data protection enquiries: admin@advancedbinaryoperations.com.