DPA — Data Processing Agreement
Last updated: 8 October 2026
App name: INVA
Processor: Inva Labs, a company registered in Israel.
Contact: privacy@inva-app.com
1. Introduction
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you, the merchant (“Controller”), and Inva Labs (“INVA”, “Processor”). It governs the processing of personal data carried out by INVA on your behalf. By installing or using INVA, you enter into this DPA.
2. Definitions
Terms such as “personal data”, “processing”, “data subject”, “controller”, “processor”, and “personal data breach” have the meanings given in the GDPR. “Data Protection Laws” means all applicable laws, including the GDPR and Israeli privacy law.
3. Roles of the parties
- The Controller (merchant) determines the purposes and means of processing.
- The Processor (INVA) processes personal data only on the Controller’s documented instructions.
4. Scope and nature of processing
Details in Annex A. INVA is designed around data minimization: processes aggregate store data; does not collect/store end-customer personal data; does not process payment card data (Shopify handles billing). Personal data is limited primarily to the Controller’s own account and contact details.
5. Processor obligations
INVA will: (1) process only on documented instructions; (2) ensure authorized persons are bound by confidentiality; (3) implement the security measures in Annex C; (4) respect sub-processor conditions (Section 6); (5) assist with data subject requests (Section 7); (6) assist with security, breach-notification, and impact-assessment obligations; (7) delete/return data per Section 9; (8) make available information to demonstrate compliance (Section 10).
6. Sub-processors
The Controller provides general authorization to engage sub-processors (Annex B). INVA imposes data protection obligations no less protective than this DPA, informs the Controller of intended changes (with opportunity to object), and remains responsible for sub-processors’ performance.
7. Data subject rights
INVA will assist the Controller, insofar as possible, in responding to data subject requests (access, rectification, erasure, restriction, portability, objection). Because INVA does not store end-customer personal data, such requests generally require no action by INVA.
8. Personal data breach notification
INVA will notify the Controller without undue delay, and within 72 hours, after becoming aware of a personal data breach, describing the nature, likely consequences, and measures taken.
9. Return and deletion of data
On termination (e.g. uninstall), INVA will delete or anonymize the Controller’s personal data within 30 days, unless retention is required by law. On written request before deletion, INVA provides a copy where technically feasible.
10. Audits
INVA will make available information reasonably necessary to demonstrate compliance and allow for audits, subject to reasonable notice, confidentiality, and frequency limits.
11. International transfers
INVA is operated from Israel (EU adequacy decision — transfers from EU/EEA permitted without additional safeguards). Where a sub-processor is outside the EEA/Israel (Annex B), INVA ensures an appropriate transfer mechanism and relies on the fact that no end-customer personal data is transferred.
12. Liability
Subject to the limitations and exclusions of liability in the Terms of Service.
13. Term
Effective when you begin using the Service; remains in effect as long as INVA processes personal data on your behalf.
Annex A — Details of processing
| Item | Description |
|---|---|
| Subject matter | Inventory management and reorder analytics for the Controller’s Shopify store. |
| Duration | For the duration of the Service, plus the deletion period in Section 9. |
| Nature & purpose | Reading store/analytics data via APIs; computing inventory metrics; generating plain-language summaries. |
| Types of personal data | Controller’s account and contact details (e.g. name, business email). No end-customer personal data. |
| Categories of data subjects | The Controller and its authorized users. |
| Special categories | None. |
Annex B — Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Google LLC (GA4) | Source of aggregate traffic data — read-only; no data is sent to Google | United States |
| Anthropic, PBC (Claude) | AI-generated plain-language summaries (aggregate data only) | United States |
| Amazon Web Services (AWS) | Application hosting and database | European Union — Sweden (Stockholm), eu-north-1 |
Annex C — Technical and organizational security measures
- Tenant data isolation — every record scoped to
shop_id, preventing cross-merchant access. - Access controls — production data restricted to authorized personnel on need-to-know basis.
- Encryption — data encrypted in transit. At rest: merchant API credentials are encrypted at the application level (Fernet) before they are stored; encryption of the underlying storage volume (AWS EBS) is required and will be enabled before the Service is listed on the Shopify App Store.
- Authentication — access via the Controller’s Shopify account.
- Minimization — no end-customer personal data and no payment card data stored.
- Logging and monitoring — operational logs maintained to detect and respond to incidents.