OpenLift Cart Merchant Terms and Data-Protection Agreement

PART A — MERCHANT TERMS 1. Who provides the app OpenLift Cart is provided by Ojasvy Dixit, trading as Urban Lalten, a sole proprietorship in India ("OpenLift", "we", "us"). The Fullstack Guys is the developer brand used for the app. Business address: Ajay Housing Society Ke Pass, 3/B, Jawahar Ki Nadi, Ward No. 11, Daurai, Ajmer, Rajasthan 305003, India. Support and privacy contact: info@thefullstackguys.us. "Merchant" means the business operating the Shopify store that accepts these terms. The person accepting must have authority to bind that business. 2. Acceptance and permitted use These terms, Part B and its schedules form the agreement when an authorized merchant expressly accepts them in the app. The merchant receives permission to use OpenLift for its connected Shopify store while its subscription or eligible trial is active. Shopify's own agreements continue to govern Shopify services. These terms do not replace or alter them. 3. What the app provides The Cart package provides a configurable cart drawer and product upsells. Complete includes Cart plus product-page bundle offers, milestones, scheduled countdowns, existing selling-plan selection, and discount tools. Features depend on Shopify APIs, a compatible Online Store theme, merchant settings and the chosen plan. Installation does not automatically enable the theme embed or place app blocks. The merchant must save the app settings and the relevant Shopify theme changes. Compatibility with every theme or other app is not guaranteed; support is available for specific issues. 4. Prices, trial and billing All app charges are approved and processed through Shopify. Amounts below are USD per 30-day app billing cycle; any applicable taxes and Shopify billing treatment are shown by Shopify. • Cart: $20, up to 500 qualifying OpenLift cart-upsell orders per cycle. • Cart Growth: $50, without that order-count cap. • Complete: $35, up to 500 qualifying OpenLift cart-upsell orders per cycle. • Complete Growth: $65, without that order-count cap. Complete includes the additional features for $15 above the corresponding Cart plan. There is no separate $40 plan or continuing free plan. Eligible merchants receive a seven-day trial with access to all features. After the trial, only the selected plan's features remain available and its approved charges apply. The Shopify approval screen controls the actual trial eligibility, trial dates and charge authorization. Reinstalling does not promise another trial. 5. How the 500-order allowance works A qualifying order is a paid, non-test Shopify order containing an OpenLift-attributed cart-upsell item. Each qualifying order counts once, using the order creation date within the app billing cycle. Ordinary store orders, bundle-only orders and test orders do not count. A later refund does not reverse a recorded count. At the cap, new cart upsells pause until the next cycle or an approved Growth upgrade. Ordinary cart checkout remains available. OpenLift does not silently switch a merchant to a higher-priced plan. Use Manage plan to request a change through Shopify; approval, proration and timing follow Shopify's displayed billing flow. Contact support if the count appears incorrect. 6. Merchant responsibilities and offer accuracy The merchant controls products, pricing, inventory, promotion wording, discount rules, shipping offers and the store's customer policies. Test saved changes on the storefront and in checkout, including mobile devices. Milestones display progress; they do not independently grant free shipping, gifts or discounts. Codes are subject to Shopify eligibility. Automatic campaigns use cart-value rules within the merchant's selected limits; they do not predict an optimal discount or guarantee increased sales. Other independently configured promotions may offer a larger discount. Countdowns must describe a real offer deadline. Bundles add the displayed products as separate cart lines and do not create a new inventory SKU. Subscription options use existing Shopify selling plans; the subscription provider and Shopify manage contracts, renewals, cancellation and customer payment methods. Do not use OpenLift for misleading claims, unauthorized content, unlawful data processing or interference with another store. Keep store access secure and do not send passwords or tokens to support. 7. Cancellation and existing promotions The merchant may uninstall through Shopify to end the app subscription. Merely disabling the drawer or hiding a block does not cancel billing. Shopify's billing flow governs any final charge, credit or proration; this agreement does not promise automatic refunds. Contact support about an incorrect app charge, without limiting any mandatory refund rights. Discounts created in Shopify remain there until paused, expired or removed in Shopify. They can continue after a trial, plan change, drawer deactivation or uninstall. Review and deactivate unwanted promotions before uninstalling. Existing subscription contracts belong to their subscription provider and are not cancelled by removing OpenLift. Check the theme's normal cart after removal. 8. Support, availability and changes Email info@thefullstackguys.us with the store domain, affected feature and steps to reproduce an issue. No fixed response time or uninterrupted-availability commitment is included. We may maintain or update the app and will communicate material changes to these terms before they take effect, except urgent legal or security changes. A new app charge requires Shopify's applicable approval process. We may suspend affected functionality where reasonably necessary to address misuse, a security incident, an unpaid subscription or a binding legal requirement. Where practicable, we will explain the reason and a route to resolve it. 9. Data and ownership The merchant retains its rights in its store data and content. OpenLift receives only the rights needed to provide the service and follow lawful instructions. Our app code, branding and documentation remain our property or that of their respective owners. Personal-data handling is described in Part B and the published OpenLift privacy policy. For merchant data processed on the merchant's behalf, Part B takes precedence over conflicting general terms. 10. Responsibility and liability To the extent permitted by applicable law, the service is provided without a promise of a particular sales result. Neither party is responsible to the other for indirect or consequential loss, including lost anticipated profits. Each party's total liability arising from this agreement is limited to the greater of (a) the app fees paid or payable for the affected store during the preceding 12 months and (b) USD 100. This limit does not exclude fraud, wilful misconduct, payment obligations, liability that cannot lawfully be limited, or mandatory rights and remedies under applicable data-protection law. Third-party and customer statutory rights are not waived. 11. Applicable law and disputes Indian law governs this agreement, subject to overriding mandatory laws. The parties will first try to resolve a dispute through the support contact. Courts with jurisdiction in Ajmer, Rajasthan, India will hear disputes, except where applicable law requires another forum. If a provision cannot be enforced, the remaining provisions continue to apply to the extent permitted by law. PART B — DATA-PROTECTION AGREEMENT 1. Roles and instructions For store personal data handled on the merchant's behalf, the merchant is controller and OpenLift is processor. If the merchant acts for another controller, it must be authorized to appoint OpenLift. The service configuration, this agreement and verified support requests form the merchant's documented instructions. OpenLift will not use this data for advertising, resale or unrelated customer profiling, and will flag an instruction it reasonably believes unlawful. Legally compelled processing will be disclosed unless prohibited. For its own merchant account administration, app billing, support and legal obligations, OpenLift determines its processing purposes and explains them in its privacy policy. This role distinction does not remove privacy rights. 2. Confidentiality, security and assistance OpenLift will restrict access to authorized people subject to confidentiality duties, maintain proportionate technical and organizational safeguards, and assist with applicable privacy requests, impact assessments and regulator enquiries. It will notify the merchant without undue delay after becoming aware of a personal-data breach affecting the merchant's data, provide available material facts and cooperate in mitigation. Notification may be supplemented as facts become known; it is not an admission of liability. The merchant controls lawful collection, notices and any required consent. Shopper requests are routed to the merchant unless law requires another response. OpenLift will provide reasonable information and allow proportionate compliance audits under confidentiality safeguards that protect other merchants' data. Such safeguards do not obstruct statutory oversight. 3. Service providers and transfers The merchant authorizes the providers listed in Schedule 2 for their stated functions. OpenLift will impose applicable data-protection duties on subprocessors and remains responsible for their contracted processing obligations. It will give at least 30 days' notice before adding or replacing a subprocessor, allowing a reasoned data-protection objection and discussion of an alternative or termination of affected processing. Data may be processed in the countries listed below. Where restricted international-transfer rules apply, an appropriate lawful transfer mechanism and any required supporting assessment must be completed before that transfer. Provider transfer safeguards are described in the linked provider terms. This agreement does not represent an adequacy finding or a certification of compliance in every jurisdiction. 4. End of processing On verified instruction or termination, OpenLift will return or delete processor-held personal data as applicable, unless retention is legally required. The routine periods in Schedule 1 are maximum operational windows, not a reason to ignore an earlier valid deletion instruction. Any legally retained data must be isolated from ordinary use. The current Supabase Free project has no scheduled provider database backups enabled by this app. OpenLift does not create separate routine database backup copies. Provider security, disaster-recovery and service records follow the relevant provider terms; legally retained records must not be restored to ordinary use after a valid deletion request. Shopify-held data remains subject to the merchant's instructions and Shopify's lifecycle. SCHEDULE 1 — PROCESSING DESCRIPTION AND CURRENT RETENTION Purpose and operations: authenticate the store, configure storefront features, process limited upsell-order notifications for plan enforcement, provide privacy-request exports, display optional aggregate trust toasts and resolve merchant support requests. Operations include receipt, validation, retrieval, limited storage, export and deletion. People concerned: authorized merchant staff; shoppers whose qualifying order identifiers appear in usage records; active storefront browser visits where analytics processing is allowed; people who contact support. Data handled: • Store domain, installation/session identifiers, access scopes, encrypted Shopify access/refresh credentials and expiry information. Shopify authentication may also provide authorized-user information. • Merchant settings and product/collection information. App settings are stored in Shopify app-owned metafields. Agreement records contain the store domain, agreement version, acceptance time and authority confirmation, recorded through the authenticated Shopify admin. • Reduced paid-order notifications: order identifier, creation date, payment/cancellation/test status, and line-item quantities/properties. The retained usage record contains store domain, order identifier and creation timestamp only. • Optional trust toasts: aggregate paid-order counts from Shopify; a store-scoped keyed hash of a random browser identifier and last-seen timestamp. No customer identity, page paths or browsing history is collected for this feature. The merchant controls whether to enable it and must provide appropriate notices and consent settings. • Privacy-request identifiers and matching order identifiers/timestamps in merchant-accessible exports. Redaction requests remove matching records. • Support sender information and whatever the sender supplies. Merchants must avoid unnecessary customer information, credentials and payment data. No customer names, customer contact fields, addresses or payment details are requested for the upsell counter. Full carts and full orders are not stored in OpenLift's separate database. Cart updates and checkout operate through Shopify. No special-category data is intended or required. Duration and routine deletion: • Session records: while necessary for access; deleted upon successful handling of uninstall or shop-redaction notifications. • Visitor activity: excluded after 90 seconds of inactivity; a once-per-minute cleanup deletes server records older than two minutes. Browser storage has a 30-minute inactivity expiry and is removed on observed consent withdrawal. No customer-to-visitor mapping exists. Order-count aggregates are cached in memory for up to one minute. • Upsell usage: daily cleanup removes records older than 90 days; applicable redaction removes records sooner. • Privacy exports: daily cleanup removes records older than 30 days; applicable redaction removes them sooner. • Privacy receipts without customer payloads: daily cleanup after 90 days. • Operational AWS logs: seven days. • Merchant acceptance record: stored with the app installation in Shopify and subject to Shopify’s app-data lifecycle; no separate indefinite acceptance archive is maintained. • Support correspondence: only while necessary for the issue and required business records. The operator reviews resolved support cases monthly and deletes unnecessary correspondence within 90 days of resolution, unless a documented legal or unresolved-dispute reason requires longer retention. Current technical safeguards: HTTPS traffic; encrypted stored Shopify session payloads; backend-only database access; verified Shopify admin sessions and webhook signatures; limited webhook fields; shop-scoped privacy exports and deletion; daily retention cleanup. These statements describe implemented app controls, not a security certification or a claim that every business control has been audited. SCHEDULE 2 — SERVICE PROVIDERS Amazon Web Services (AWS): app compute and operational logs in Stockholm, Sweden (eu-north-1). AWS's applicable service terms include its Data Processing Addendum and relevant transfer safeguards: https://aws.amazon.com/compliance/gdpr-center/ . The AWS contracting entity is the entity specified by the account's AWS agreement. Supabase: encrypted session, minimal usage and privacy-record database in the United States (us-east-1). Supabase Pte. Ltd's Data Processing Addendum supplements its service agreement: https://supabase.com/legal/customer-resources/data-processing-addendum . The current Free service has no automatic database backups configured by OpenLift. Operator access: Ojasvy Dixit / authorized support in India, restricted to the processing needed for operations and support. Hostinger: receiving infrastructure for info@thefullstackguys.us, used only when someone emails support. Its applicable service agreement and Data Processing Addendum govern its covered mail services: https://www.hostinger.com/legal/dpa . Mail infrastructure and authorized support access may involve international processing. Merchants should send only the information necessary to resolve the issue. Cloudinary: public instructional-video hosting and delivery. The media contains development-store demonstrations, not real customer records. Playback is optional and involves viewer connection information processed under Cloudinary's service/privacy terms: https://cloudinary.com/privacy . OpenLift does not send its order-usage database or authentication credentials to Cloudinary. Shopify: merchant platform, installation records, cart, checkout and app billing, governed by Shopify's own agreements. Shopify is not automatically characterized as OpenLift's subprocessor by this agreement.