1. Instructions and purpose
The merchant instructs Serva to process personal data only to provide configured customer-support functionality. Serva will not use protected customer data for its own advertising, sale, unrelated profiling, or significant automated decision-making.
2. Data and data subjects
Processing may concern the merchant's customers and support users. The first live order lookup version uses an order reference and customer email for exact verification, then reads the minimum order, fulfillment, tracking, and refund information needed for the response. Name, phone, and address are outside the approved scope.
3. Confidentiality and access
Protected data is available only to authenticated tenant members with a service need and to the minimum authorized Serva operator. Administrative infrastructure access uses individual credentials, strong passwords or SSH keys, and multi-factor authentication where supported. Access must not be shared.
4. Security measures
Serva maintains TLS, credential encryption, encrypted backups, environment separation, tenant isolation, request-body exclusion from logs, keyed hashes for audit references, access logging, retention controls, vulnerability updates, and incident response procedures. Controls are described at /security.
5. Subprocessors
The merchant authorizes Shopify for commerce data exchange and Alibaba Cloud for hosting and encrypted backup storage. Serva will evaluate new subprocessors, limit their data access, and update its public disclosures before sending protected customer data to them.
6. Requests, deletion, and return
Serva authenticates Shopify mandatory privacy webhooks. Because live order lookup content is not retained, customer access and redaction requests normally return no stored order data. On disconnection or shop redaction, Serva revokes local access by deleting credentials and product projections. Expired audit records and encrypted backups are deleted according to the retention schedule.
7. Incidents and assistance
Serva will investigate suspected compromise, contain access, preserve relevant evidence, and notify affected merchants without undue delay when a personal-data breach is confirmed and notification is required. Merchants can contact 524520968@qq.com for privacy or security assistance.