Clearpick merchant terms and data processing agreement

Service terms

These terms apply between Fritz Döbel (Clearpick) and the business operating the Shopify store that accepts them. The person accepting confirms authority to act for that business. Clearpick prepares remaining-item pick lists from the Shopify data the merchant authorizes it to read.

The service combines individual items and Shopify-recorded bundle components, offers location and product filters, explains quantities, and supports print and CSV export. It does not reserve stock, change orders, or mark fulfillment complete. Merchants must refresh and check a list before using it. Custom bundle relationships that Shopify does not expose cannot be expanded. Access is limited to data available under the app's granted Shopify scopes and the batch limits described in the app.

Shopify presents and processes subscription prices, trial periods, taxes where applicable, and charge approval. Free includes up to 50 open orders per list with unlimited runs. Pro includes the complete supported batch under the app's safety limits; Shopify's plan approval page controls the effective price and trial. No additional usage fees are configured. Accepting these terms alone does not authorize a charge. A merchant can uninstall at any time; Shopify's billing interface determines cancellation and applicable credits.

Merchants keep ownership of their data and must use the service lawfully, protect their Shopify accounts, and avoid uploading credentials or customer information in support messages. Clearpick may suspend access where necessary to address abuse, a security incident, or a legal requirement, and will explain the reason where permitted. Clearpick depends on Shopify and hosting services and does not promise uninterrupted availability or a particular commercial result. Statutory rights and liabilities that cannot legally be excluded remain unaffected.

Material changes to these terms will be shown in the app before a merchant accepts a new version. Changes to subscription charges require Shopify's applicable approval process.

Data processing agreement

This agreement governs personal data processed on the merchant's behalf for the service. The merchant determines its purposes and acts as controller, or as a processor authorized by its controller. Fritz Döbel acts as processor or subprocessor. The instructions are limited to providing and securing Clearpick, implementing authorized support requests and deletion requests, and complying with law. Clearpick will inform the merchant if an instruction appears unlawful and, unless legally prohibited, before processing required by law outside those instructions.

The subject matter is preparation of Shopify fulfillment pick lists. Processing consists of reading, transmitting, organizing and displaying the authorized fields, exporting lists at the merchant's request, verifying subscription access, storing authentication sessions, and deleting records when no longer needed. Processing lasts while the app is installed and for the limited deletion and backup periods described below. Clearpick also records the shop domain, agreement version and acceptance time while installed; these records are deleted with the shop’s sessions on uninstall or shop redaction.

People concerned can include the merchant's customers and staff. Data can include order identifiers and references, product and variant information, SKUs, fulfillment locations and quantities, bundle relationships, shop domain, permissions, staff session metadata supplied by Shopify, authentication tokens and subscription state. The app does not request customer names, contact details, shipping addresses or billing addresses, nor special-category data. Order references may still be personal data in the merchant's hands.

Clearpick will restrict access to people who need it to provide the service and who are bound to confidentiality. It will maintain appropriate technical and organizational measures, including HTTPS, TLS database connections, authenticated Shopify requests, application encryption of stored access and refresh tokens, restricted hosting access, minimized data queries, and exclusion of tokens and order contents from application logs. These measures are described more fully in the privacy notice and operational security documentation.

The merchant authorizes Cloudflare, Inc. to provide Workers hosting and a private SQLite-backed Durable Object dedicated to Clearpick and restricted to the European Union for app storage and execution. The front Worker, delivery network and provider metadata can process outside that jurisdiction under Cloudflare's applicable data processing and transfer arrangements. The previous Netlify hosting and PostgreSQL store in Ohio, United States may be retained temporarily for migration verification and recovery. Shopify provides platform APIs, authentication and billing under its agreements. Clearpick provides advance notice in the app and by an agreed contact method before appointing new subprocessors or materially changing locations, allows reasonable objections, and seeks an alternative or permits termination where an objection cannot be resolved. Clearpick remains responsible as required by law.

Clearpick will not sell or share merchant personal data for advertising, combine it for unrelated commercial profiling, or use it to make automated decisions about individuals. It will support lawful instructions concerning consent, restrictions, deletion and data-subject requests. Requests received directly from a store's customer will be referred to the merchant without disclosing order records to an unverified requester.

Clearpick will notify the merchant without undue delay after becoming aware of a personal data breach affecting data processed for that merchant. Available information will cover the incident, affected data, likely consequences, containment and remediation, with further information supplied as it becomes available. Clearpick will reasonably assist with relevant data-subject requests, security duties, breach notifications, impact assessments and regulator consultations, taking account of the service and information available.

Order contents and generated pick lists are not stored in Clearpick's database. Authenticated uninstall and shop-redaction notifications atomically delete the shop's live sessions, agreement and review-use records. Downloaded files and printouts remain under the merchant's control. Cloudflare SQLite recovery can retain earlier database states for up to 30 days. Previous Netlify stores and backups have separate residual retention during migration verification. Deleted shop records must be removed before recovery is put into service; deleted accounts must not be reinstated from backup. Data retained by law is isolated for that requirement.

On reasonable request, Clearpick will provide information needed to demonstrate compliance and cooperate with proportionate audits by the merchant or its mandated auditor, subject to confidentiality and protection of other merchants' information. The merchant may request return or deletion of personal data processed on its behalf; the service's lack of stored order contents limits what Clearpick can return.

Mandatory data protection law takes precedence over any conflicting provision. This agreement does not remove either party's independent legal obligations or a data subject's rights.