# Data Processing Addendum > https://storelift.net/legal/dpa/ Last updated: 2026-10-11 This addendum takes effect when you accept the Terms of Service for business use. ## Scope This Data Processing Addendum ("DPA") is part of the [Terms of Service](https://storelift.net/terms) whenever your use of Storelift involves personal data protected by the EU GDPR, the UK GDPR or Turkey's Law No. 6698 (KVKK). Enterprise customers who need a countersigned copy can ask at [hello@storelift.net](mailto:hello@storelift.net); the text is the same as this page. ## Roles You are the controller of the personal data you bring into Storelift: your team members, the reviews of your apps and the reports of accounts you connect. Storelift, operated by Volkan Günay (a natural person in Turkey), processes that data on your behalf as processor. For the data we need to run your account itself — your sign-in email, billing and security logs — Storelift is an independent controller, as described in the [Privacy Policy](https://storelift.net/privacy). ## Whose data, and why We process this data to provide the features you use: measuring and reporting on your apps, drafting replies and suggestions when you use the AI features, sending the alerts and reports you set up, and answering your support requests. That involves storing, reading, combining, sending to the recipients named in this DPA, and deleting the data. The people it can relate to: - Your team: the people you invite to your workspace. - Reviewers: people who posted a public review of your apps on the App Store or Google Play. - Your apps' end users: people whose subscription or purchase events reach us through a RevenueCat or Adapty webhook you set up. - Anyone whose personal information appears in text you send us, such as a question to the AI features or a support message. ## What we process - Team members: name, email address, role and the audit log of their changes. - App store reviews: review text, rating and the reviewer's public display name, and the replies you write. - Connected accounts (App Store Connect, Google Play, Apple Ads, RevenueCat, Google Analytics, AdMob, Adapty): aggregated reports such as downloads, revenue, sessions and campaign spend. - RevenueCat and Adapty webhooks also include subscription and purchase events and user or profile identifiers that can be associated with an app end user, with product, store, country, amount and source or cohort information. Normalised event records receive a 400-day retention setting and user or cohort records an 800-day setting; some user record updates renew that period. Expired records are removed in the background. - AI features: questions, conversation and page context, review text and relevant report data accessed within the user's permissions. Personal information in these inputs may be sent to the AI provider. Ask questions and answers, tool names, the requesting user, model information and feedback are stored in workspace history with a 90-day retention setting; access depends on roles and data permissions. This is separate from retention in the provider's own systems. - Support: the messages you send us. - Duration: the specific periods above apply to those records; other account data is retained while the account remains open, then deletion follows the process below. ## Our commitments - We process the data only on your documented instructions: these terms, your settings and the actions you take in the product. - Everyone with access to it is bound to confidentiality. - We help you answer data-subject requests: team members and connections can be changed and removed in Settings, and we send a copy of the data or delete it on request. - We help with data protection impact assessments and consultations with authorities when you ask, with the information we hold. - At the end of the service we delete the data as described below. ## Security measures - Data is stored in AWS Frankfurt (eu-central-1) and encrypted at rest; every connection uses TLS. - Newly saved connection keys are sealed with AWS KMS and bound to your account. Older encrypted records may still use the previous context until saved again; completion of that migration has not been verified. Authorised processing services that need keys to provide connected features can decrypt them. No screen or API response returns stored connection keys. - API keys are stored only as a SHA-256 hash and shown once. - Workspace roles (viewer, member, admin, owner) limit who can change what; every change is kept in an audit log for 365 days. - Continuous point-in-time backups and KMS key rotation are on. - More detail: [Trust](https://storelift.net/trust/). ## Subprocessors The current list is at [Subprocessors](https://storelift.net/legal/subprocessors/). We tell subscribers to that page at least 30 days before a new subprocessor starts processing personal data. You can object on reasonable data-protection grounds within that period. If we cannot resolve the objection, you can end the affected service before the change takes effect. We impose data protection terms on each subprocessor that are at least as protective as this DPA, and we remain responsible for their work. ## International transfers Storelift's own data stays in the EU (Frankfurt). Where a subprocessor processes personal data outside the EEA, UK or Turkey, the transfer relies on an adequacy decision or on the European Commission's Standard Contractual Clauses, and for Turkey on the standard contracts under KVKK Article 9. ## Personal data breaches We notify you without undue delay, and at the latest within 72 hours of becoming aware of a breach affecting your data, with what we know at that point: the nature of the breach, the categories and approximate number of records, the likely consequences and the measures taken. We add detail as we learn it. ## Audits We answer a reasonable security questionnaire once a year at no cost; send it to [hello@storelift.net](mailto:hello@storelift.net). Enterprise customers can agree further audit terms in their contract. ## Deletion at the end of the service Account deletion has a 30-day recovery window. After that deadline, a scheduled job cleans account and app records from the primary database and requests removal of sign-in records. A minimal deleted-account marker has a further 30-day expiry setting; expired records are removed asynchronously. Backups expire under their own retention policy. Anonymous totals and shared caches of public store data are separate. Financial records required for accounting are retained separately by Storelift and Polar for the periods required by their applicable obligations. Email suppression records are retained to prevent unwanted email from being sent again. Copies already sent to destinations you connect follow those recipients' retention settings. See the [Privacy Policy](https://storelift.net/privacy) for the account deletion process and how to contact us about your data. If you want a copy of the data before it is deleted, ask at [hello@storelift.net](mailto:hello@storelift.net) while the account is open or during the recovery window. ## Contact Questions about this DPA: [hello@storelift.net](mailto:hello@storelift.net). ## What changed - 2026-10-11 — Clarified that account-bound encryption applies to newly saved connection keys; migration of older records is not verified. - 2026-10-10 — Added whose data is processed and for what purpose, and how to ask for a copy before deletion. - 2026-10-09 — Clarified webhook identifiers, AI inputs and history, authorised key access, and account deletion exceptions. - 2026-09-28 — First version published.