Data processing
When the paid add-on sends a restock alert, your shop is the controller of that shopper's data and Ounce Works is a processor acting on your instructions. This page is the plain-language summary; the signed agreement is the binding document.
What we process, and why
| Data | Purpose | Kept for |
|---|---|---|
| Shopper email address | Delivering the restock alert that shopper asked your shop for | Until the alert is sent or the request is withdrawn |
| Product and shop identifier | Knowing which alert to send and on whose behalf | Life of the subscription |
| Delivery result (sent, bounced, complained) | Your delivery log, and protecting the sending reputation shared by all shops | 90 days |
The master list of subscribers lives in your own WooCommerce database, under your control, exportable at any time. We hold what is needed to deliver, not a copy of your audience.
What we never do with it
- Sell, rent or share it with anyone outside the sub-processors listed below.
- Build profiles, or match a shopper across different shops.
- Send anything to a shopper other than the alert your shop triggered.
- Use it to train anything, or to build a data product.
Sub-processors
| Sub-processor | Role | Location |
|---|---|---|
| Cloudflare, Inc. | Application hosting, queueing and storage | Global edge |
| Resend (Plus Five Five, Inc.) | Email delivery | United States |
| Polar Software Inc. | Payments and invoicing (merchant of record) | United States / EU |
Subscribers are told by email at least 30 days before a sub-processor is added or changed, so there is time to object.
Security and transfers
Data is encrypted in transit and at rest. Access is limited to one person, on hardware with full-disk encryption, using multi-factor authentication. Transfers out of the EEA and UK rely on the European Commission's Standard Contractual Clauses, which form part of the agreement.
If something goes wrong
You are told without undue delay, and in any case within 48 hours of us becoming aware of a personal data breach, with what we know at that point and what is being done.
Getting the signed agreement
Write to jerry@ounceworks.com and ask for the DPA. It is sent as a countersigned PDF, before you buy — not after you chase it. If your legal team needs it on their paper instead, say so and it will be looked at properly.