StockRecover Data Processing Addendum

Parties, instructions and scope

Alexander Hickman trading as Quiet Yield operates StockRecover. Contact alex@quietyieldhq.com or 415-787-2039. Postal address: 200 N Vineyard Blvd, Ste A325 -270, Honolulu, HI 96817, United States.

This addendum applies between Quiet Yield and the installing merchant that accepts it. The merchant instructs Quiet Yield to process personal data to provide restock alerts, consent and suppression management, support, security and verified privacy-request handling. The merchant is responsible for lawful collection, required notices and consent, and lawful documented instructions. Quiet Yield acts as processor for this service and handles its own service and security records as described in the Privacy Notice. Data subjects are shoppers and authorized merchant staff; data categories are those described in that notice.

Processing safeguards

Quiet Yield processes service personal data only on lawful documented instructions, including applicable transfer instructions, and will inform the merchant if an instruction appears unlawful. Authorized personnel are subject to confidentiality and access is limited to what their work requires. Proportionate safeguards include tenant isolation, verified identity, transport security, provider encryption, encrypted access tokens and controlled exports.

Subprocessors and transfers

The merchant authorizes Vercel for hosting, Neon for database services and Resend for email delivery, under appropriate written safeguards. Shopify is the separate commerce platform. Quiet Yield remains responsible for its subprocessors' relevant obligations, provides notice of material subprocessor changes and a reasonable opportunity to object. Appropriate transfer mechanisms must be in place before a restricted international transfer; using a United States provider alone is not such a mechanism.

Assistance and incidents

Taking account of the processing and information available, Quiet Yield assists with data-subject rights, security, personal-data incidents, impact assessments and regulator inquiries. Quiet Yield notifies the merchant of a personal-data breach without undue delay after becoming aware. A merchant export or acknowledgment is not evidence that the merchant delivered information to a shopper.

Return, deletion and duration

On service end, Quiet Yield returns or deletes personal data under lawful documented instructions and the disclosed retention schedule, except information that must lawfully be retained. Provider backups, independent copies, open duties and verified holds require documented handling; current routine-cleanup status and scope are disclosed in the Privacy Notice. This addendum lasts for the service and necessary lawful wind-down processing.

Accountability

Quiet Yield makes proportionate compliance information available and cooperates with reasonable audit requests while protecting other merchants' information and credentials. The parties cooperate to resolve conflicting instructions or privacy obligations. Acceptance is recorded for the current installation with the document version, content digest, time and a pseudonymous receipt tied to the verified staff identity.