Data processing agreement

This data processing agreement (DPA) sets out how ReverseSignal handles personal data for the businesses that use the ReverseSignal Service. It is part of our terms of service.

Last updated: October 20, 2026

How this DPA works

• This DPA is made of two parts: the Cover Page below, and the Common Paper DPA Standard Terms, Version 1.1. The Standard Terms are incorporated by reference and are not changed. Where the Cover Page and the Standard Terms differ, the Cover Page controls.
• You accept it by accepting our terms of service, for example by installing the app or signing an order form. No separate signature is needed.
• If you want a copy signed by both of us, email privacy@reversesignal.com and we'll send this Cover Page for signature.
• Words with capital letters, such as Provider, Customer, Security Incident and Subprocessor, have the meanings given here or in the Standard Terms.

Cover Page

Parties and agreement

Changes to the Approved Subprocessors

This replaces the 10 business days' notice in Section 2.6.1 of the Standard Terms with a longer period. Provider will add any new Subprocessor to Annex III at least 30 days before it receives any Customer Personal Data, and email Customer at the address on its store's account. Customer may object by emailing privacy@reversesignal.com within those 30 days. The rest of Section 2.6.1 applies as written.

Vendors that work for Customer, not for Provider

The following are not Provider's Subprocessors. They work for Customer under Customer's own agreements with them, and the data they hold for Customer is Customer's data:

• Customer's commerce platform, such as Shopify. It sends Provider the orders that Customer's customers look up, and receives the returns and exchanges Provider records in Customer's store.
• Customer's shipping provider and carrier. Return labels are bought in Customer's own shipping account. For each label, Provider sends Customer's shipping provider the customer's name, the order's ship-to address and phone, Customer's return-to address, and the package's weight and size.

US state privacy laws

For personal data covered by the California Consumer Privacy Act (CCPA) or a similar US state law, such as the Texas Data Privacy and Security Act, Provider is Customer's "service provider" or "processor". Provider will:

1. not sell or share Customer Personal Data, as those laws define "sell" and "share";
2. not keep, use or disclose it for any purpose other than providing the Service under the Agreement, including for any commercial purpose of its own;
3. not keep, use or disclose it outside its direct business relationship with Customer;
4. not combine it with personal data Provider receives from anyone else, except as those laws allow;
5. give it the same level of privacy protection those laws require of Customer;
6. tell Customer if it decides it can no longer meet these obligations; and
7. let Customer take reasonable steps to stop and fix any use of the data that these terms don't allow.

Provider certifies that it understands and will comply with these restrictions.

Restricted transfers

All Customer Personal Data is stored and processed in the United States (AWS's N. Virginia region). Where Customer sends data from the EEA, the UK or Switzerland, Section 3 of the Standard Terms applies the EEA SCCs (Modules Two and Three), the UK Addendum and the Swiss provisions.

Governing Member State for the EEA SCCs: Ireland. For the UK Addendum: the laws of England and Wales, and the courts of England and Wales.

Security Incidents

Under Section 4 of the Standard Terms, Provider will notify Customer without undue delay, and no later than 72 hours after becoming aware of a Security Incident.

Annex I: Details of the processing

Categories of Data Subjects

• Customer's customers who look up an order, or start a return or exchange.
• Customer's staff who use the Service.

Categories of Personal Data

Special Category Data

None. Customer will not submit special category data, payment card numbers, bank details or government ID numbers. The Service doesn't need them.

Frequency of Transfer

Continuous, for as long as Customer uses the Service.

Nature and Purpose of Processing

Provider processes Customer Personal Data only to:

1. let Customer's customers find their order and start a return or exchange under Customer's policy;
2. show Customer's staff each return, so they can approve it and record the outcome;
3. create return shipping labels in Customer's own shipping account, and track the packages;
4. send Customer's customers the email and text updates Customer turns on, such as "your label is ready" and changes to their return's status, on Customer's behalf. Texts go only to customers who agreed to receive them;
5. record the return or exchange in Customer's store;
6. protect the Service from abuse, such as repeated order lookups; and
7. keep the Service fast and reliable, and fix problems.

Provider does not use Customer Personal Data for marketing, advertising, profiling or to train AI models, and does not sell or rent it.

Duration of Processing

For the term of the Agreement, then until the data is deleted as Annex II describes.

Competent supervisory authority

For the EEA SCCs, the Irish Data Protection Commission. For the UK Addendum, the UK Information Commissioner's Office.

Annex II: Technical and organisational security measures

• Encryption. All connections, the database, its backups and its logs are encrypted. Customer's platform access key is encrypted again, with a key unique to Customer's store.
• Separation. Each store's data is kept separate, so no store can see another's. Every store that uses the Service runs on the live Service and is protected the same way, including Customer's development, test and staging stores. Provider's own development and test systems run in separate AWS accounts, use only made-up test data, and never hold Customer Personal Data.
• Network. The database isn't reachable from the internet. The returns portal is protected against abusive traffic.
• Access. Staff in Customer's store see only the pages their role allows. Provider's own staff access live data only when they need it to run or support the Service.
• Logs. Logs record which page was requested, whether it worked and how long it took. Names, emails, phone numbers, addresses, access keys and payment details are kept out of them.
• Monitoring. An on-call engineer is paged when something breaks.
• Data minimisation. Each Subprocessor gets only the data its job needs. Message delivery gets only the customer's name, email or phone, and the message.

Limited data retention

• Customer's customers' contact details (name, email, phone, street address and comments, and the return label that shows them) are erased 6 months after the customer's last return, or 30 days after an order lookup that never became a return. Only the state or province and the country are kept, for Customer's return reporting.
• On a deletion request from Customer's platform, such as Shopify's customer data erasure request, the customer's personal details are deleted as soon as the request arrives, and always within 30 days. The return record (items, reason and outcome) stays, without those details.
• After uninstall, Customer's access key is deleted at once, and all of Customer's customers' personal details are deleted when Customer's platform sends its shop erasure request (for Shopify, 48 hours after uninstall).
• Logs and backups. Request and app logs are kept up to 30 days; security logs of blocked requests, which include the IP address, 1 year; database backups 7 days, so deleted data is gone from backups within a week.

Helping Customer with its customers' requests

Customer's customers send requests to see or delete their data to Customer, which passes them to Provider through its platform. Provider deletes the data, or sends Customer a copy of everything it holds about the customer, within 30 days. If a customer writes to Provider directly, Provider passes the request to Customer.

Annex III: Approved Subprocessors

Our website host, Vercel, serves this website and our help site only. It receives no Customer Personal Data.

Contact us

Questions about this DPA, or to request a signed copy: privacy@reversesignal.com.

This DPA uses the Common Paper Data Processing Agreement (Version 1.1), free to use under CC BY 4.0.