Who processes the data
The Notify for Upgates add-on is provided and operated by Apptiary s.r.o., Tylova 1043/15, 831 04 Bratislava, Slovakia, company ID (IČO) 57 466 408 ("we"). Contact: [email protected].
This page applies to this add-on only. How we process data on the AddonHive website and in our other add-ons is described in the general AddonHive privacy policy.
Controller and processor
The e-shop operator is responsible for the data in its e-shop as the controller within the meaning of the GDPR. The data about buyers that Upgates sends us in an order notification is processed only to the extent necessary to carry out your instructions, that is, to send a notification, and we act as a processor for it. This processing is governed by the Data processing terms under Article 28 GDPR.
We process the e-shop contact email, the channel settings and the data about the installation and the subscription as a controller, because we need them to provide the add-on, for invoicing and for support.
What data the add-on stores
The identifier and address of the e-shop, its time zone and language.
The access data for the Upgates API, which Upgates issues to us at activation. It is encrypted in the database with the AES-256-GCM algorithm.
The e-shop contact email, which the add-on takes over from Upgates and to which it sends service notices, for example that a channel has stopped working.
The channel settings that you enter: webhook addresses, chat identifiers, recipient email addresses and the API key of your email service. These are also encrypted, and the administration interface never returns them.
Your other settings: the time of the summaries, the message rules and templates, and the history of their changes.
Records of notification delivery: the time, the type of event, the order number and the result of the delivery.
From order notifications only what the statistics in the administration need: the order number, the total amount and currency, the payment and shipping method, the status and the paid flag, and the time of creation. From this we calculate daily totals, which we keep longer.
For a paid plan, the customer and subscription identifier in Stripe, the plan, the number of paid e-shops, the subscription status and, for a card, the brand, the last four digits and the expiry date, so that we can warn you before it expires. You enter the billing details and the card details directly in the Stripe payment gateway. The full card number never reaches us.
Customers of your e-shop
From an order notification we never store the name, address, email or phone number of the buyer, nor the list of items. The name of the buyer appears in the text of a message only if you expressly switch this on for the given channel. Even then it is not stored: the message is sent and only the fact of its delivery, without the text, remains in our records. We discard the other data immediately after processing.
However, once sent, the message remains in the service you chose (Slack, Telegram and the like), where you manage it.
Purpose and legal basis
We use the data so that the add-on works: so that it can send notifications and summaries, show statistics, handle the subscription and send you service notices. The legal basis is the performance of the contract with you (Article 6(1)(b) GDPR). We keep operational and security logs on the basis of our legitimate interest (Article 6(1)(f) GDPR) and invoices because of a legal obligation (Article 6(1)(c) GDPR).
Where and for how long
The data is stored in the EU (Hetzner Online GmbH, Helsinki data centre, Finland). Communication takes place exclusively over HTTPS, and we verify notifications from Upgates by their signature.
We keep the technical envelope of a received Upgates notification (the identifier of the event, the e-shop and the order) for 7 days as protection against duplicate processing.
We keep the notification delivery records for 30 days. We keep the order data for statistics for 400 days. The daily totals that arise from it, and that contain nothing about individual buyers, are kept for as long as the add-on is activated.
After the add-on is deactivated, we stop notifications immediately and cancel the subscription at the end of the paid period. We delete all data of the e-shop, including the encrypted access data and the channel settings, within 30 days. If you activate the add-on again within that period, the settings are restored. The data remains in database backups until their automatic deletion, for at most 6 months. We use a backup only to restore the whole database after an outage, and after such a restoration we delete the data of deactivated e-shops again immediately.
We keep invoices for the period required by the accounting and VAT regulations.
To whom we disclose the data
We send notifications exclusively to the services you choose and manage (Slack, Discord, Telegram, Microsoft Teams, Google Chat, Google Sheets, ntfy, your email service, your webhook). You are responsible for the terms of those services as their user.
Processors: Hetzner Online GmbH (hosting, EU), Stripe Payments Europe, Limited (payments and invoices for paid plans, Ireland), Resend, Inc. (sending service emails to the e-shop contact email; a company based in the USA, emails are sent through its EU region in Ireland, and any transfer to the USA is based on the standard contractual clauses of the European Commission), Cloudflare, Inc. (R2 storage in the EU for encrypted database backups), Functional Software, Inc. (Sentry, error tracking, EU region, without personal data).
Upgates receives no data about your customers from us: the add-on reads data from its interface, does not change orders, and writes to it only the webhooks through which Upgates notifies you about orders. We do not provide or sell data to any other party.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Write to [email protected]; we will reply within 30 days. You may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk).
The terms of use of the add-on are set out in the document Add-on terms.