Data Processing Agreement
This Data Processing Agreement explains how Brava handles the personal data of your shoppers when you use Brava on Shopify. It forms part of our Terms of Service, and you agree to it by installing a Brava app on your Shopify store.
Last updated: October 15, 2026
1. Who and What This Covers
The parties
This agreement is between Bravatech Solutions Private Limited ("Brava", "we", "us") and the business that installs a Brava app on its Shopify store ("you").
Shopper data
It covers the personal data of your shoppers that Brava receives from Shopify, or from the shopper through your loyalty program, in order to run that program for you ("Shopper Data"). For each order, that means the order number, totals and currency, the products bought, discount codes, refunds, payment status and the reward picked at checkout. For the shopper, it means their email address, first and last name, and the phone number on the shipping address, plus the phone number on their Shopify account when Shopify sends us a privacy request about them. We do not use or store shoppers' postal addresses or payment card details, and we do not keep their IP addresses in our database.
Your role and ours
You decide why your shoppers' data is used: to run your loyalty program. Brava processes Shopper Data on your behalf to provide that program, and you remain responsible for the notice and consent you give your shoppers.
2. Processing Only on Your Instructions
Your instructions
Brava processes Shopper Data only on your instructions. Your instructions are these Terms, this agreement, the settings you choose in the Brava app and your Brava dashboard, and any other written request you send us that is consistent with them.
What we use it for
To credit points or stamps to the right shopper's loyalty card when an order is paid and reverse them when it is refunded, to hold an order's points for a shopper who has not joined yet, to show shoppers their balance and rewards in your store and in their account, to send your loyalty messages to members of your program on your behalf, and to answer privacy requests.
What we never do
We do not sell Shopper Data, use it to advertise for anyone else, use it for our own purposes, or share it with other stores.
3. Subprocessors
Who helps us
Brava uses these subprocessors to handle Shopper Data: Supabase, our database, file storage and sign-in provider; Netlify, which hosts our website, our Shopify app and the servers that process orders; SMTP2GO, which delivers the order emails we send on your behalf; and Apple and Google, which receive a loyalty card's details when a shopper adds it to Apple Wallet or Google Wallet, so the card works on their phone.
AI assistants you connect
If you connect an AI assistant to your Brava account, Brava sends that assistant the information you ask it for, which can include shoppers' names but never their email addresses or phone numbers. The assistant's provider handles it under its own terms. See the "AI Assistants and Connectors" section of our Privacy Policy.
Changes
We update this list on this page before a new subprocessor starts handling Shopper Data. If you object to a change, write to privacy@brava.cards and you may uninstall the app, which starts the deletion described below.
4. Security
Encryption
Shopper Data is encrypted at rest (AES-256) and in transit (TLS 1.2 or later).
Access
Shopper Data can be seen only by your own Brava account and by a small number of Brava administrators who run and support the service. The tables that hold orders waiting to be matched, reward codes and the email queue are reachable only by our servers, never directly from a browser. Every time an administrator views a store's customer data in our admin tools, or opens a store's dashboard on its behalf, we record who, what and when, and keep that record for 12 months.
Our people and policies
Our access policy requires a unique password from a password manager for every account, two-step sign-in on the systems that hold customer data, and the lowest access each person's work needs, removed when they leave. We also follow a written data loss prevention policy and a security incident response policy, both summarised on our Compliance page.
5. Security Incidents
Telling you
If we confirm a security incident that affects your Shopper Data, we will tell you without undue delay by email to your Brava account's address. We will say what happened, which data was affected, what we have done and what you should do, and we will keep you updated as we learn more.
Helping you
You decide whether to notify your shoppers or a regulator. We will give you the information we have to help you do so, and we will send notices to your shoppers for you if you ask.
6. Shopper Privacy Requests
Requests through Shopify
When a shopper asks your store for their data, or asks you to delete it, Shopify tells us. We send you the data we hold about that shopper for your store, or delete it, as the request requires.
Other requests
If a shopper contacts Brava directly, we will pass the request to you, or act on it with your agreement. You can also write to privacy@brava.cards for help with any request.
7. Retention and Deletion
How long we keep it
We delete Shopper Data on the fixed schedule set out in the "Brava on Shopify" section of our Privacy Policy at brava.cards/privacy. An order waiting for a shopper to join is deleted 30 days after the order if they do not join, a held order is deleted 90 days after its points are credited, one-time claim codes after 48 hours, and records of order emails and used reward codes after 180 days. A member's loyalty card and points history are kept while the card exists.
When you uninstall
When you uninstall the app, Shopify tells us 48 hours later and we delete the shopper data we received from Shopify for your store. Billing records we are required to keep are not shopper data and are kept.
8. Changes and Contact
Changes to this agreement
We may update this agreement, for example when we add a subprocessor or a feature. We will publish the new version on this page with a new date before it takes effect.
Contact
Questions about this agreement or about Shopper Data go to privacy@brava.cards.
Related documents
This agreement sits alongside our Terms of Service, Privacy Policy and Compliance page.