VLink — Shop in Bio

VLink Data Processing Agreement

Last updated 25 July 2026

This Data Processing Agreement ("DPA") forms part of the agreement between Vergenerd Ltd ("we", "us", the Processor) and the merchant installing the VLink Shopify app ("you", the Controller). It applies from the moment you install VLink and for as long as we process personal data on your behalf. Where this DPA and our Privacy Policy differ on the terms of processing, this DPA governs.

1. Roles

You are the controller of the personal data processed through VLink. We are your processor and act only on your documented instructions. Your instructions are: this DPA, the Privacy Policy, and your use of the app's features. If we believe an instruction breaks data protection law, we will tell you and may pause that processing.

2. Subject matter, duration, nature and purpose

Subject matter: providing the VLink link-in-bio sales channel. Duration: from install until 48 hours after uninstall, when Shopify's shop erasure notification triggers deletion. Nature and purpose: storing and rendering the page you build, caching your catalog so the page loads without calling Shopify on every visit, reporting your own statistics to you, and — only if you enable it — attributing sales to blocks on your page.

3. Categories of data subject and personal data

Data subjects	Personal data
You and your staff	Store domain, store name, and the API access token Shopify issues at install. If you create a Vergr account from the app: email address, username, display name
People who submit your contact form	Name, email address, message, and phone number if you ask for one. Collected only if you add a contact form block
Visitors to your page	None. Page statistics are daily counters. We do not store IP addresses, user agents, device identifiers, cookies or visitor IDs, so statistics cannot be tied to a person
Your customers (orders)	No personal data. Where sales attribution is enabled we store a date, an order total, a currency code and the id of the block that earned it. No names, emails, addresses, phone numbers, line items or order numbers. The order number is hashed one way solely to avoid double-counting a repeated notification

We process no special category data as defined by Article 9, and we ask you not to send any through VLink.

4. Our obligations

• Instructions only. We process personal data only as set out above, and never for our own purposes. We do not sell it, share it for advertising, or use it to train machine learning models.
• Confidentiality. Anyone with access is bound by confidentiality obligations.
• Security. We apply the measures in section 7.
• Assistance. We assist you, so far as is reasonable, with data subject requests, security incidents, impact assessments and consultations with regulators.
• Deletion. We delete personal data as set out in section 8.
• Evidence. We make available the information needed to show we meet these obligations, and will respond to reasonable audit requests by written answer. Where a documented on-site audit is legally required, we will cooperate in good faith.
• No automated decision-making. We take no automated decisions producing legal or similarly significant effects about any individual.

5. Sub-processors

You give general authorisation for the sub-processors below. We remain responsible for their performance and impose data protection terms on them no less protective than these.

Sub-processor	Purpose	Location
Google Cloud / Firebase	Hosting, database, authentication	EU (europe-west1)
Cloudflare R2	Storage and delivery of images you upload	EU / global edge
Shopify	Your catalog, checkout and app billing	Per Shopify's own terms

If we add or replace a sub-processor we will update this page and notify merchants in the app before the change takes effect, giving you a reasonable opportunity to object. If you object on reasonable data protection grounds and we cannot offer an alternative, you may uninstall and we will delete your data under section 8.

6. International transfers

Primary storage and processing is in the European Union. Where a sub-processor transfers personal data outside the UK or EEA, that transfer relies on an adequacy decision or on Standard Contractual Clauses (with the UK International Data Transfer Addendum where the UK GDPR applies), together with any additional safeguards required.

7. Security measures

• Encryption in transit: HTTPS/TLS on every connection.
• Encryption at rest: all data is held in Google Cloud Firestore and Cloudflare R2, which encrypt at rest by default. We operate no unencrypted storage of our own.
• Credential handling: Shopify access tokens are stored server-side and never sent to a browser. API keys are stored only as a one-way hash and are displayed once at creation; we cannot recover one.
• Authentication and integrity: admin requests are authenticated with short-lived Shopify session tokens; every incoming webhook and app proxy request is verified against its signature before it is acted on.
• Data minimisation by design: the smallest viable field set is collected. Buyer identity is never requested from the basket, and order data is reduced to aggregates before it is written.
• Access control: production data is reachable only by authorised personnel through authenticated Google Cloud accounts.
• Incidents: on becoming aware of a personal data breach affecting your data, we notify you without undue delay and in any event within 48 hours, with the nature of the breach, the categories and approximate volume affected, the likely consequences and the measures taken.

8. Deletion and return

• Uninstall destroys our access token immediately and takes your page offline.
• Shop erasure (Shopify's shop/redact, sent 48 hours after uninstall) permanently deletes your store record, pages, product cache, statistics, leads and API keys. There is no archive that outlives it.
• Customer erasure (customers/redact) permanently deletes any contact-form lead matching that customer's email or phone.
• Data requests (customers/data_request) are answered with any data held for that individual.
• Return: you can export your leads to CSV from the app at any time, before or instead of deletion.

9. Liability and precedence

This DPA does not limit any rights you have under data protection law. It sits alongside Shopify's own Data Processing Addendum, which governs Shopify's processing as your processor; nothing here alters that. If any provision is held unenforceable, the rest continues in force.

10. Governing law

This DPA is governed by the laws of England and Wales, without prejudice to any mandatory data protection rights available to you or to data subjects in your own jurisdiction.

11. Acceptance and changes

Installing or continuing to use VLink constitutes acceptance of this DPA. If we change it materially we will update the date above and notify merchants in the app. If you need this executed as a countersigned document, or need our Standard Contractual Clauses on file, email support@vergr.app and we will arrange it.

Contact

Vergenerd Ltd — support@vergr.app