Data & DPA

1. Roles

For Magento order data, refunds, product costs, ad spend, and purchase-pixel events tied to your store, you (the merchant) are the controller and Verid is the processor. For your Verid login and billing identity, Verid is the controller (see Privacy Policy).

2. Categories of store data

• Order and credit-memo financial fields and line items (SKU, name, qty, totals, COGS)
• Store configuration you set (timezone, currency, payment fee rules)
• Ad spend by campaign and day; OAuth tokens for connected ad accounts
• Optional pixel purchase events (order id / campaign identifiers you send)
• Custom expenses you enter

We do not need full customer PII (names, emails, addresses) for core P&L. Magento APIs may expose additional fields depending on your ACL — use a least-privilege integration token.

3. Processing purposes

Compute and display net profit and related analytics; sync and refresh data; attribution / ROAS views when pixel + ads are connected; email alerts you enable; exports you request.

4. Subprocessors

Infrastructure (hosting, database, Redis), Stripe, and transactional email. Contact [email protected] for the current list. We require appropriate data-processing terms with subprocessors.

5. Security measures

• TLS in transit; encrypted credentials at rest
• Workspace isolation and role-based access (owner / viewer)
• Access limited to operating and supporting the service

6. International transfers

Where data leaves the EEA, we use SCCs or equivalent safeguards with providers.

7. Assistance & deletion

We assist with data-subject requests that relate to data we process for you, to the extent technically feasible. You may disconnect integrations and request deletion of workspace data after account termination subject to legal retention.

8. DPA

These Data & DPA terms, together with the Terms and Privacy Policy, form the data processing agreement for store analytics processing. For a signed PDF DPA, email [email protected].