Merchant data-processing terms

Version 2026-09-29. Provider: Seeking Zen IK. Contact: hzandovskis@gmail.com.

Parties and instructions

These terms describe Seeking Zen IK’s data-processing commitments to merchants using Seeking Bundles and supplement our privacy policy. The merchant acts as controller of customer data, or as a processor authorized by its controller. Seeking Zen IK processes that data on the merchant's documented instructions to provide Seeking Bundles. Configuring and using the app supplies operational instructions for the requested features. We will notify the merchant if an instruction appears to breach applicable data-protection law.

Scope and purpose

Processing includes receiving, organizing, storing, retrieving and deleting store and order identifiers, purchase dates, currencies, line quantities, discounts, bundle attributes, payment status and refund or cancellation information. Data subjects are store customers and authorized merchant users. The purposes are operating bundle offers, applying discounts, reporting offer performance, calculating app usage fees, reconciling refunds and responding to support and privacy requests. Order webhooks can carry additional customer information in transit; order snapshots exclude names, email addresses, phone numbers, addresses and payment credentials. Merchant authentication information is processed for secure access. Product images are processed only when the merchant requests image editing. Do not provide sensitive personal data that is unnecessary for these purposes.

Use restrictions and confidentiality

We will not sell customer data, use it for advertising, or combine it with other merchants' data for unrelated purposes. Access is limited to authorized persons who need it for these services and are subject to confidentiality obligations. We will process data only on documented instructions unless law requires otherwise; where permitted, we will inform the merchant of that requirement.

Providers and international transfers

The merchant authorizes Railway for application and database hosting and Photoroom for product images the merchant elects to send for background removal. Shopify operates the connected commerce platform and app billing. We will use written provider terms with appropriate data-protection obligations and remain responsible for our subprocessors' performance of those obligations. We will notify merchants of proposed subprocessor additions or replacements in the app at least 30 days before access begins. Merchants may object on reasonable data-protection grounds by contacting us; if we cannot resolve the objection, the merchant may stop using the affected service. Data may be processed outside the merchant's country. Where required, appropriate transfer safeguards must be established, such as applicable standard contractual clauses; these terms do not themselves constitute completed transfer clauses.

Security and incidents

We will maintain appropriate safeguards including authenticated merchant access, store-scoped data operations, encrypted network connections, access restrictions and deletion controls. Infrastructure security is supported by hosting-provider safeguards. We will notify the merchant without undue delay after becoming aware of a personal-data breach affecting its data, provide available information about the incident and mitigation, and cooperate with the merchant's notification obligations.

Customer rights and assistance

We will assist merchants with access, correction, deletion, consent, security assessments and regulator inquiries as relevant to our processing. Shopify privacy requests are available in the app; customer-redaction requests are processed automatically. We will provide information reasonably necessary to demonstrate compliance and permit proportionate audits by the merchant or its authorized auditor, subject to confidentiality and measures protecting other merchants. Customers should contact their merchant; we will forward or assist with requests as appropriate.

Duration and deletion

Processing continues while the app provides services, subject to the retention schedule in the privacy policy. On termination, we will delete app-held customer data or provide a requested export before deletion, unless law requires retention. Uninstall and Shopify redaction workflows apply. Merchant-owned Shopify orders and saved files remain under the merchant's control. Provider backups and operational records follow the applicable provider lifecycle; on restoration, expired or redacted records must be removed before normal processing resumes.

Merchant responsibilities and changes

The merchant is responsible for its lawful basis, customer notices, consent configuration and authority to instruct processing. We will publish material changes with an updated version and notify merchants where required. Contact us for questions, additional contractual safeguards or a copy of these terms.