QueueFront merchant data agreement
Effective date: 2026-10-08
This Merchant Data Agreement (Agreement) supplements the QueueFront Terms of Service between AtlasFlare LLC (QueueFront) and the Shopify merchant using the service (Merchant). It applies when QueueFront processes personal data on the Merchant’s behalf. If this Agreement conflicts with the Terms on that subject, this Agreement controls.
1. Roles and instructions
For Merchant Customer Personal Data, Merchant is the controller, business, or equivalent party that determines the purposes and means of processing, and QueueFront is the processor, service provider, or equivalent party. The Merchant instructs QueueFront to process data only to provide, secure, support, and deprovision QueueFront as described in the Terms, product configuration, Privacy Policy, and this Agreement.
QueueFront will not sell Customer Personal Data, share it for cross-context behavioral advertising, retain/use/disclose it outside the direct business relationship, or combine it with personal data from another source except as permitted to provide the service or required by law. QueueFront will not use Shopify Merchant Data or Customer Data to train artificial-intelligence or machine-learning models.
If QueueFront believes an instruction violates applicable data-protection law, it will notify Merchant unless prohibited and may pause the affected processing.
2. Processing details
| Item | Description |
|---|---|
| Subject | Waiting-room and product waiting-list setup, admission, consent-based notifications, inventory/capacity, checkout validation, reconciliation, privacy, security, support, and deprovisioning services |
| Duration | Installation/pilot term plus the documented deletion, backup-age-out, dispute, and legal-hold periods |
| Data subjects | Merchant staff, shoppers/prospective customers, customers placing protected orders, and support/security reporters |
| Merchant/staff data | Shop identity/configuration; encrypted Shopify session credentials and associated staff ID, name, email, locale, and role; audit/support records |
| Shopper/customer data | Protected customer/order IDs, order-line product/variant/quantity, app-owned purchased-event marker, keyed hashes, queue/admission evidence, privacy-request IDs, and separately consented encrypted Waiting List email/SMS contact data |
| Technical data | Keyed network/session identifiers, request/timing data, inventory observations, stable error codes, service logs, and aggregate metrics |
| Excluded waiting-room fields | Shopper Name, Address, customer tags, raw IP, raw webhook bodies, payment-card data, and reversible customer profiles; email/SMS contact is collected only through a separate Waiting List consent path |
| Frequency | Event-driven and continuous only while the configured service/event requires it |
Shopify compliance payloads can contain contact fields that the waiting-room path has not requested. QueueFront processes the authenticated body in memory to match an applicable channel-specific consent record and does not persist the raw payload.
When the Merchant uses Shopify Sidekick-assisted setup, QueueFront receives the structured suggestions in the setup link that the Merchant opens, validates them against the authenticated store, and prefills its ordinary form. This integration does not request the full Sidekick conversation. Opening the link does not itself save or publish a room, send notifications, change billing or manage an existing room; the Merchant reviews and saves in QueueFront.
3. QueueFront obligations
QueueFront will:
- process personal data only on documented Merchant instructions and for the stated purposes;
- ensure authorized personnel are bound by confidentiality and receive only the access needed for their operational role;
- maintain the technical and organizational measures in Schedule 1;
- apply the documented retention periods and authenticated Shopify privacy lifecycle;
- reasonably assist Merchant with data-subject requests, security, breach-notification duties, and data-protection assessments, considering the nature of processing and information available to QueueFront;
- notify Merchant without undue delay after confirming a security incident affecting Merchant Customer Personal Data, unless law prohibits notice;
- provide information reasonably necessary to demonstrate compliance and address a proportionate audit request without exposing another tenant, secrets, or platform security; and
- delete or return personal data after termination as described below, unless law requires retention.
4. Merchant obligations
Merchant will provide lawful instructions, required storefront notices and consents, accurate configuration and inventory information, and only the data needed for enabled QueueFront features. Merchant will protect Shopify accounts, limit staff permissions, maintain an incident contact, and not send secrets or unnecessary personal data through support.
Merchant is responsible for determining whether QueueFront is appropriate for its products, customers, jurisdictions, and risk profile.
5. Data-subject and Shopify requests
Merchant remains the primary contact for shoppers. QueueFront implements
Shopify’s authenticated customers/data_request, customers/redact, and
shop/redact lifecycle. QueueFront will provide or delete applicable data
within 30 days of a valid request, unless a documented legal obligation
prevents deletion. Reports are encrypted, tenant-scoped, authenticated, marked
no-store, and available for no more than 30 days.
A webhook receipt is not proof that every downstream step has completed. Encrypted report access expires after 30 days; physical purge depends on the implemented access/redaction paths or separately approved maintenance, as described in the Privacy Policy.
6. Subprocessors
Merchant gives general authorization for the providers in QueueFront’s current Subprocessor Disclosure. QueueFront remains responsible for imposing appropriate data-protection and confidentiality obligations on providers it engages for the processing.
QueueFront will identify a material new Customer Personal Data subprocessor on the published disclosure before the change takes effect when reasonably practicable. Merchant may raise a reasonable data-protection objection through the Support channel. The parties will work in good faith on an alternative; if none is reasonably available, either party may end the affected service.
Shopify is the Merchant-selected commerce platform and data source, not a QueueFront-appointed infrastructure subprocessor. Shopify’s own agreement with the Merchant continues to apply.
7. International transfers
QueueFront and its providers may process data outside the data subject’s country. Before processing that requires a separate transfer safeguard, the parties will confirm the applicable contracting entity, processing locations and transfer mechanism. Contact [email protected] to obtain and complete the applicable private annex; business mailing details are provided privately. Where legally required, the parties will execute the appropriate standard contractual clauses or other valid safeguard. Publication or ordinary policy acceptance alone does not execute a separate merchant-specific transfer annex that has not been provided and agreed.
8. Return, deletion, and backup residue
On authenticated uninstall, QueueFront deletes Shopify sessions, quiesces active events, and enables the safe bypass state. Shopify later sends the shop-redaction request. The current path settles metered usage before removing the tenant and cascaded application data, including agreement receipts. It retains privacy-request completion/replay evidence and the separate telecom usage ledger. That ledger includes store and provider/Shopify references, quantities, rates and reconciliation state; it must not be described as anonymous aggregate data. The ledger is subject to the Privacy Policy’s manual retention review. Its current lack of automatic age-based expiry is not an exception to a valid deletion request or a statement that law requires every retained field. QueueFront must resolve any applicable retained personal-data scope and required deletion before representing a request as fully satisfied. Shopify-controlled merchant bills are separate from this app ledger.
Encrypted backups are not selectively rewritten. Deleted records are excluded from active use. Native backup chains and sealed recovery copies require separate retention/deletion handling. Sealed copies have a 30-day lock and a separate 35-day object expiration rule accepted October 4; provider processing can delay removal and actual age-out has not yet been observed. These copies can contain older backup chains, so this is not a 35-day maximum personal-data age. A restored backup remains access-restricted and must reapply applicable deletion instructions before ordinary use. Approved legal/security holds are isolated, tenant-scoped, and removed when no longer required.
9. Liability and term
The Terms’ liability, dispute, and termination provisions apply to this Agreement except where applicable data-protection law requires otherwise. This Agreement ends when QueueFront no longer processes personal data for Merchant, subject to surviving confidentiality, deletion, audit, and legal obligations.
Schedule 1 — Security measures
- tenant-scoped authorization and audit records;
- Shopify session-token authentication and HMAC webhook verification;
- TLS for data in transit and encryption for stored credentials, reports, private signing keys, off-host backups, and the production database volume, transaction logs and retained migration recovery files;
- independent local, staging, Beta, and production environments;
- per-event Ed25519 signing, bounded token validity, and replay evidence;
- fail-closed inventory, position, ETA, admission, and checkout controls;
- loopback-only PostgreSQL with isolated owner/migrator/runtime roles;
- least-privilege Cloudflare, Shopify, database, host, and backup credentials;
- secret exclusion from Git, logs, command arguments, support, and evidence;
- QueueFront-specific logging, health/backup alerts, restore proof, rollback, deprovisioning, and incident response;
- limited staff access using individually controlled, strongly authenticated accounts; and
- documented retention, privacy-request, deletion, and backup-age-out paths.
Schedule 2 — Retention
The retention table in the published Privacy Policy is incorporated here. A shorter valid deletion instruction controls unless law requires retention. A longer product retention period cannot be enabled merely by changing this Agreement; it requires the corresponding implementation and privacy review.
Daily analytics, five email/SMS categories, expired privacy-report and opted-out SMS contact cleanup currently cover the two retained test stores under reviews expiring November 6, 2026. Other installations require enrollment. Categories without automatic expiry are covered by the published manual review periods. The operator must complete the applicable enrollment and contracting checks before broader merchant use. Adoption of this Agreement alone neither enables cleanup nor records a merchant’s acceptance.