Data Processing Addendum
This addendum is part of our Terms of Service, the terms on which PRS CLOUD TECH PRIVATE LIMITED ("we", "us", the Processor) provides Lyrakart Customer Mobile App ("Lyrakart") to a merchant ("you", the Controller), on any store platform we support. You accept it by installing Lyrakart or signing up for it. It applies to the personal data of your shoppers and staff that we process for you. Our privacy policy describes the data in more detail; if the two differ, this addendum governs for data you control.
1. Roles
- For shopper data (customer and order summaries, devices, app activity, forms, community and chat content) you are the controller and we are the processor. We process it only to provide Lyrakart to you and only on your documented instructions. Your instructions are your use of Lyrakart's settings and these terms.
- For your staff accounts and billing contact data we act as controller, to run the service, keep an audit trail and keep it secure.
- If we believe an instruction breaks the law, we will tell you.
2. What we process
| Category | Data | Purpose |
|---|---|---|
| Shopper summary | Platform customer ID, email stored as a one-way hash, tags, marketing-consent flag, order count, total spent, last order date. We do not copy names, phone numbers or addresses from your platform's customer records. | Push audiences, automations, linking an app install to a customer |
| Order summary | Order number, totals, currency, payment and delivery status, discount codes, whether the order came from the app | Attribution, reporting, order-status messages |
| Shopper-supplied | Email, name and phone typed into appointment, quote, contact or newsletter forms; community posts, live chat, assistant questions, prescription uploads (only if you switch the feature on) | Providing that feature for you |
| Store session (Odoo only) | The store's Odoo website session cookie for each app install (stored encrypted), the cart's Odoo order, the signed-in customer's Odoo ID, and the email and country entered for the cart | Keeping the cart and opening your checkout page |
| Device and activity | Install ID, platform, model, OS and app version, language, country, push token, notification permission, screens viewed, taps, searches | Push delivery, analytics, fixing problems |
| Staff | Name, email, role, sign-in and change history; a scrypt password hash where staff sign in with a Lyrakart password | Accounts, roles, audit trail |
Data subjects are your shoppers and your staff. We do not process payment card data: checkout runs on your store platform.
3. Sub-processors
You authorise these sub-processors. We will update this list before adding one that handles shopper data, and you may object by writing to us before the change takes effect.
| Sub-processor | What it processes | When |
|---|---|---|
| A hosting provider in India (our app server, 160.250.204.8, in Delhi) | All data held by Lyrakart: database, uploaded files, backups before they are copied | Always |
| Contabo GmbH (EU data centre) | Encrypted backup files. They are encrypted before they leave our server, and the key that opens them is not on Contabo's server | Always |
| eWebGuru (email, SMTP) | Recipient address and text of account, sign-in, billing and notification emails | Always, for emails we send |
| Apple and Google (push and app stores) | Push token and notification content; your app and its store listing | When you publish an app and send push messages |
| Shopify | Store, customer and order data, our billing, staff sign-in | Shopify merchants only |
| Expo (EAS Build) | Your app design, app settings and signing credentials, to build the app. No shopper data | When we build your app with it |
| A third-party AI model provider | We send only what the feature asks for: for drafting app content and push messages, the merchant's brief and a summary of its catalogue; for the shopping assistant, the shopper's message, the last few turns of that chat, the store's FAQ answers and details of matching products. | Only when you use AI features (drafting app content, the shopping assistant) |
Tools you connect yourself, such as AppsFlyer, Branch, Mux, Cloudflare, or a reviews, loyalty, email-marketing or export tool, run under your own account with that tool. They are your processors, not ours.
For Shopify, Odoo SA, Apple, Google, Expo and the AI model provider we rely on their standard terms. We remain responsible to you for our sub-processors.
4. Our duties
- We will make sure the people who can access personal data are bound by confidentiality and see only what their work needs.
- We apply the measures in our security overview and will not lower the level of protection during the term.
- We help you answer shopper requests (access, export, correction, deletion). A shopper can delete their account inside the app, or on the app's deletion web page after confirming a code sent to their email. On Shopify, data-request and redact requests are answered automatically (see the annex).
- On reasonable request, we help with your impact assessments and regulator questions.
- We let you check that we meet this addendum by answering reasonable written questions and sharing the information needed to show it.
5. Retention and deletion
- Shopper data is kept while you use Lyrakart. When a shopper deletes their account, the data we hold about them is deleted straight away, except business records that are made anonymous (quotes, appointment bookings).
- Contact messages are deleted after 400 days. Data request reports are deleted after 30 days.
- When you leave, see the annex for your platform.
- Backups are kept 7 days on our server and 14 days on the encrypted backup server, so deleted data leaves the backups within 14 days after it is deleted from the live system.
- Copies you exported to your own tools are yours and we cannot recall them. If the law requires us to keep something, we say so and keep only that.
6. Personal data breach
If we become aware of a personal data breach affecting your data, we tell you without undue delay and in any case within 72 hours of becoming aware of it, by email to your account owner. The notice says what happened, which data and stores are affected, what we have done and what we advise. We send more detail as we learn it.
7. Your duties as controller
You are responsible for having a lawful basis and any consent needed for the shopper data you ask us to process, for the notices you give your shoppers, and for the features you switch on. You must not send us special-category data except in features designed for it (the prescription feature), and then only with the shopper's consent.
8. International transfers
Our company is in India and our app server is in Delhi, India. Our encrypted backups are stored with Contabo GmbH in its EU data centre; they are encrypted before they leave our server. Other sub-processors above may process data in other countries. Where the law of your shoppers' country requires a transfer mechanism, we will sign standard contractual clauses with you on request.
9. Term and law
This addendum lasts as long as we process data for you. Liability under it follows the limits in our Terms of Service. It is governed by the laws of India, and the courts at Delhi, India have exclusive jurisdiction.
10. Platform annex
Shopify
- Connection: Shopify OAuth install. The access token expires, is refreshed automatically and is stored encrypted. Customer and order data is read only as far as Shopify approves our access to protected customer data.
- Webhook messages are stored encrypted, deleted after 7 days when handled (customer and order topics) and in any case after 30 days.
- customers/data_request: we build a report of the shopper's data, email the store owner and show a notice in the dashboard. You pass the report to the shopper. The report is deleted after 30 days.
- customers/redact: we delete or anonymise the shopper's data, starting when the request arrives and finishing within 30 days.
- shop/redact: Shopify sends it 48 hours after uninstall, and we then delete your store's data. If it never arrives, we delete the data 30 days after uninstall anyway. On uninstall we stop syncing at once and pause campaigns, automations and scheduled exports.
- In-app account deletion also asks Shopify to erase the customer record. Shopify accepts this only if you have granted the customer-data-erasure permission.
- Billing goes through Shopify's billing.
Odoo
- Connection: our Odoo module creates a separate "Lyrakart Connector" user with limited rights (sales, inventory, contacts, and billing if Accounting is installed) and an API key for it. It sends us your Odoo address, database name and database ID, the connector login and API key, the module and Odoo versions, and the name, email, company name, country and currency of the Odoo user who connects it. We store the API key encrypted.
- We read changed products, categories, stock, orders (confirmed, done or cancelled, with invoice and payment status) and their customers about once a minute, and keep summary copies. We write carts and orders from the app, order notes, shopper sign-ups as portal users, shopper profile and address changes, marketing opt-outs and password-reset requests.
- Shopper passwords pass through our server to your Odoo login and are not stored.
- Disconnecting Odoo in the dashboard deletes the stored API key, stops reading, and starts a 30-day clock, after which we delete your store's data unless you connect again. If you uninstall the module, the app stops serving your store and the data stays until you disconnect or ask us to delete it.
- In-app account deletion deletes what we hold, including the store sessions and saved address choice. It does not delete the customer record in your Odoo; you handle that as controller.
- You buy the module once on the Odoo Apps Store. Odoo SA takes the payment and holds the payment details; we do not receive them. AI features are not included for Odoo stores, so no data is sent to the AI model provider for them.
Other platforms
For any other platform we connect (for example WooCommerce, CS-Cart or Magento), the connection uses the platform's official API with credentials you grant, and we read and write only what the app needs. We will add an annex for the platform before we connect it.
11. Contact
PRS CLOUD TECH PRIVATE LIMITED, registered office Jain Road, Jai Jawala Mandir, Near Hanuman Properties, Delhi 110059, India · office H-65, Sector 63, Noida, India 201301 · info@lyrakart.com
Terms of Service · Privacy policy · Data Processing Addendum · Security overview