Terms of Service

Last updated: 2026-10-24

These terms are an agreement between Webite d.o.o., Ljubljana, Slovenia ("we", "us") and the merchant who installs SecureBite API Proxy ("you") on a Shopify store. By installing or using the app you accept these terms, including the Data Processing Addendum in Part B. If you do not accept them, uninstall the app.

In short: SecureBite forwards your storefront's requests to APIs you choose and keeps your API keys off the storefront. You decide which APIs it calls and what data goes to them; we process that data only to run the app, keep it as briefly as possible and delete your shop's data on uninstall.

Part A - Terms of service

1. The service

SecureBite receives requests from your storefront through Shopify's App Proxy, adds the secret headers and parameters you configure, sends them to the target APIs you configure, and returns the response. It also offers a theme scan for exposed API keys. Features and plans are described in the app.

2. Fees

Paid plans are billed through Shopify at the prices shown in the app. Charges, renewals, cancellations and refunds follow Shopify's billing terms. We may change prices with at least 30 days' notice; changes apply from your next billing cycle.

3. Your responsibilities

You choose the target APIs, the credentials stored in your routes and the data your routes send. You must have the right to use those APIs and credentials.
You are responsible for your target API providers (for example your email marketing platform). They act for you, not for us.
You must have a lawful basis, and give your customers any notices or obtain any consents required, for the customer data your routes send to target APIs.
You must not use the app to break the law, infringe others' rights, send spam, attack or overload any system, or get around Shopify's or a target API's terms.
Keep your Shopify account secure and tell us promptly if you believe your app configuration has been compromised.

4. Availability and changes

We aim to keep the app available and secure but do not guarantee uninterrupted or error-free operation. We may change or improve features; we will give reasonable notice before removing a feature you rely on in a paid plan.

5. Intellectual property

We own the app and its software. You own your configuration and data. You give us the rights we need to process them to provide the app.

6. Disclaimer and liability

The app is provided "as is" to the extent the law allows. We are not responsible for target APIs, their responses or their availability. Our total liability under these terms is limited to the fees you paid for the app in the 12 months before the claim. Neither party is liable for indirect or consequential losses, including lost profits or lost data. Nothing in these terms limits liability that cannot be limited by law, such as for intent or gross negligence.

7. Term and termination

These terms apply while the app is installed. You can end them at any time by uninstalling. We may suspend or end your use for a serious breach of these terms, with notice where practical. On uninstall your shop's data is deleted as set out in the privacy policy.

8. Changes to these terms

We may update these terms. For material changes we will notify you by email at least 30 days in advance; continuing to use the app after that date means you accept them.

9. Law and disputes

These terms are governed by the law of the Republic of Slovenia. The courts in Ljubljana have jurisdiction, without affecting any mandatory consumer or local-law rights you have.

Part B - Data processing addendum

This addendum applies where we process personal data on your behalf in providing the app. It is intended to meet Article 28 of the EU General Data Protection Regulation (GDPR) and similar laws.

1. Roles

You are the controller of your customers' personal data. We are your processor. We act as controller only for data about you as our customer (for example your account and billing contact), as described in the privacy policy.

2. Details of processing

Subject matter and purpose	Forwarding storefront requests to the target APIs you configure, identifying the logged-in customer where a route is set up to do so, and security troubleshooting.
Data subjects	Your customers and storefront visitors.
Categories of data	Whatever your routes forward (for example names or emails entered in storefront forms); Shopify customer IDs; customer emails read from Shopify for routes using `{{logged_in_customer_email}}` or `{{klaviyo_profile_id}}`; Klaviyo profile IDs looked up for routes using `{{klaviyo_profile_id}}`; request URLs and possibly IP addresses in request logs. No special categories of data are intended.
Duration	Request and response data is passed through in transit and not stored, except that routes with response caching turned on keep copies of responses for the chosen cache time (at most 24 hours). Looked-up customer emails and Klaviyo profile IDs are held in memory for up to 5 minutes. Request logs are deleted after at most 7 days.

3. Our obligations

We process personal data only on your documented instructions, which are these terms and your app configuration, unless the law requires otherwise; we will tell you if we believe an instruction breaks data protection law.
Anyone authorised to process the data is bound by confidentiality.
We apply the technical and organisational measures in our security policy and privacy policy, including encryption in transit, signature verification, restricted access and minimal retention.
We help you, as far as reasonably possible, to respond to data subject requests and to meet your security, breach notification and impact assessment obligations.
We notify you of a personal data breach affecting your data without undue delay and no later than 72 hours after we confirm it, as described in the security policy.
When you uninstall the app we delete your shop's data, as described in the privacy policy. Logs expire on their own schedule.
We make available the information needed to show compliance with this addendum and respond to reasonable audit requests, which can normally be met by written answers and documentation.

4. Sub-processors

You authorise the sub-processors listed in the privacy policy; for customer data this is Cloudflare, which hosts the app. We bind each sub-processor to data protection terms at least as protective as these and remain responsible for them. We will announce new sub-processors that handle customer data at least 30 days in advance; if you object on reasonable grounds and we cannot address the objection, you may uninstall the app. Your target API providers are your own processors, not our sub-processors.

5. International transfers

Cloudflare processes requests on its global network, which may involve countries outside the European Economic Area. Such transfers are covered by Cloudflare's data processing terms, including the EU Standard Contractual Clauses.

Contact

Webite d.o.o., Ljubljana, Slovenia - support@webite.rocks