lalo-app
TandemData Processing Addendum
Tandem by lalo-app · Last updated: October 8, 2026
This Addendum forms part of the Terms of Service and applies when Tandem processes personal data on your behalf under the EU/UK General Data Protection Regulation (GDPR) or similar laws. It is accepted by installing and using the app; no signature is required.
1. Roles
You, the merchant, are the controller of your store data. lalo-app (“we”) is the processor and processes it only to provide Tandem, following your documented instructions — the settings you choose in the app and these terms.
2. Subject matter and duration
We read your product catalog through the Shopify Admin API to build recommendations, write them into app-owned records in your store, and — if you allow it — read orders for “Bought together” and revenue in Analytics. This lasts for as long as Tandem is installed on your store; data is deleted as described in section 8.
3. Categories of data and data subjects
- Product data — titles, types, tags, prices, availability, images, collections and short product metafields. Normally not personal data.
- Store data — store domain and an access token issued by Shopify.
- Order data, only if you allow access — the products in orders, quantities, amounts, order date and cancelled/test status. Processed in memory; single orders are not stored. No customer names, emails, phone numbers or addresses are read.
- Analytics counters — per product and day: block views, card clicks and add-to-cart actions from your storefront, and, with order access, orders, units and revenue from recommended products. They contain no customer or visitor identifier. For a product with very few orders on a day, a counter may reflect a single order's amount.
- Contact data — only if you write to support: your name, email address and the content of your message.
Data subjects are your store's customers (indirectly, through order amounts in counters, if you allow order access) and the merchant and staff who contact support.
4. Confidentiality
Only people who operate Tandem can access the data, and they are bound by confidentiality.
5. Security measures
- Encryption in transit (HTTPS/TLS) for the app, the Shopify API and storefront requests.
- Least privilege: read access to products; write access only to the app's own records in your store. Orders and inventory are optional permissions you grant and can revoke.
- Store isolation: every request is authenticated through Shopify and data is separated by store.
- Webhook signatures from Shopify are verified before any request is processed.
- Server access is limited to the operator, by key-based login only, behind a firewall; the application runs as an unprivileged user in an isolated container.
- Access tokens are not written to logs; logs are rotated and size-limited.
- Storefront counters are not sent when a visitor has declined analytics in your store's cookie banner (Shopify Customer Privacy API).
- Data on the server's disk is not separately encrypted at rest. We keep no backups of app data: recommendations and settings live in your Shopify store.
6. Subprocessors
You authorize the subprocessors listed on the Subprocessors page. We will announce new subprocessors there at least 14 days before they start processing; you may object by writing to us, and if we cannot address the objection you may stop using the app. We bind each subprocessor to data protection obligations at least as protective as this Addendum.
7. Assistance and breaches
- We help you answer data subject requests and comply with security, impact-assessment and consultation obligations, taking into account the nature of the processing.
- We notify you without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting your data, with the information available to us.
8. Deletion
Analytics counters are deleted automatically after 400 days. When you uninstall Tandem, the access token and your store's analytics counters are deleted immediately; anything still left is erased when Shopify sends the shop redaction request (48 hours after uninstall). Anonymous shared statistics (category pairs without any store identifier, see the Privacy Policy) are not personal data and are kept.
9. Transfers
Data is hosted in the European Union (France). If a subprocessor processes data outside the EEA, we rely on an adequacy decision or the EU Standard Contractual Clauses.
10. Audits
On request we provide the information necessary to demonstrate compliance with this Addendum, such as a description of our security measures and subprocessors.