Patina Terms of Service

These terms are an agreement between Occam Studio ("we", "us") and the merchant who installs the Patina app on a Shopify store ("you", the "merchant"). They cover your use of Patina in the Shopify admin, in Shopify POS and on your customers' account pages. If you need our company details, contact us at support@occamstudio.io.

By installing or using Patina, you agree to these terms on behalf of your business. If you do not agree, do not install Patina, or uninstall it.

Section 9 is our Data Processing Addendum. It sets out how we handle personal data on your behalf. Our Privacy Policy explains what data Patina collects and why.

1. What Patina does

Patina helps a resale store run buyback, trade-in and consignment: taking items in, making offers, listing items in Shopify, tracking what each seller is owed, and recording payouts.

Patina keeps records. It does not move money. Cash, cheque and bank transfer payouts are records of money you pay yourself. Store credit and gift cards are issued in your Shopify store through Shopify's APIs.

2. Your account and your staff

• You need an active Shopify store to use Patina. Shopify's own terms also apply to your store.
• You decide which of your staff can use Patina and what role each has (Owner, Manager or Staff). You are responsible for what your staff do in Patina.
• Keep payout PINs private. Tell us at support@occamstudio.io if you think someone has misused your account.

3. Plans and billing

• Patina is billed by Shopify, through Shopify's managed app pricing. The plans, prices and free trial are shown when you choose a plan in the app.
• Shopify's billing terms apply to charges, renewals and refunds. You can change or cancel your plan at any time in the app or in Shopify.
• We will give you at least 30 days' notice before we raise the price of a plan you are on.

4. Acceptable use

You agree not to:

• use Patina for anything illegal, including selling stolen goods or breaking consumer, tax or anti-money-laundering law;
• enter data you have no right to process, or sensitive data Patina does not need (for example full bank account numbers, government ID numbers or health data) in free-text fields;
• try to access other merchants' data, break Patina's security, or overload the service;
• copy, resell or reverse engineer Patina.

We may suspend Patina for a shop that breaks these rules or puts other merchants at risk. Where we can, we will tell you first and give you a chance to fix it.

5. Your data

• You own your data. This includes your shop's settings and the records about your sellers, items and payouts.
• You give us permission to use your data only to run Patina for you, as described in the Data Processing Addendum (section 9).
• You are responsible for having a lawful basis to collect your sellers' and customers' data, and for giving them any privacy notice the law requires.
• You can ask us for an export of your shop's data at any time while Patina is installed.

6. Availability and support

• We work to keep Patina available and working, but we do not promise it will never be interrupted. Shopify, our hosting providers and planned maintenance can cause downtime.
• Support is by email at support@occamstudio.io. See the support page.
• We may change or improve Patina. If we remove a feature you rely on, we will tell you in advance where we reasonably can.

7. Liability

• Patina is provided "as is". To the extent the law allows, we disclaim all warranties not written in these terms.
• You are responsible for checking the offers, payouts and reports Patina produces before you rely on them for tax or accounting.
• To the extent the law allows, neither of us is liable for indirect or consequential losses, or lost profits.
• Nothing in these terms limits liability that cannot be limited by law.

8. Ending these terms

• You can stop at any time by uninstalling Patina.
• We may end these terms with 30 days' notice, or straight away if you seriously break them.
• When you uninstall, Shopify sends us a shop redaction request 48 hours later, and we delete your shop's data (section 9.8). Export anything you want to keep first.

9. Data Processing Addendum

This addendum applies when Occam Studio processes personal data for you through Patina. It forms part of these terms. If it conflicts with the rest of these terms, this addendum wins for personal data.

9.1 Roles

• For data about your sellers, consignors and other customers, you are the controller (under the CCPA, the "business"), and Occam Studio is your processor (under the CCPA, a "service provider").
• For data about you and your staff that we need to run our own business (account, billing, support and security records), Occam Studio is the controller. Our Privacy Policy covers that data.

9.2 What we process

9.3 Your instructions only

We process the personal data only on your documented instructions. These terms, your settings in Patina and the actions you and your staff take in the app are your instructions. We do not:

• use it for our own purposes;
• sell it or share it for advertising;
• combine it with other merchants' data;
• use it to train AI models.

If we think an instruction breaks data protection law, we will tell you. If the law requires us to process data in some other way, we will tell you first, unless the law forbids that.

9.4 Confidentiality

Only people who need access to run and support Patina can reach the personal data. Today that is one person at Occam Studio, the operator. Everyone with access is bound to keep it confidential.

9.5 Security measures

We keep technical and organisational measures that fit the risk. They include:

• Encryption in transit (HTTPS/TLS) everywhere, and encryption at rest for the database and its backups.
• Separation: each shop's data is kept separate in every database query, and automated tests check this. Development, staging and production use separate Shopify apps and separate databases. Staging and test systems never use production data.
• Restricted access: production data is read with a read-only database role by default. Any change made on your behalf needs an explicit step and is recorded in an operator audit log. In-app actions are recorded in your audit log.
• Account security: two-step verification and unique, strong passwords on every system that holds or reaches production data.
• Secrets: payout PINs are stored only as salted, peppered hashes. Every commit and pull request is scanned for leaked secrets.
• Monitoring: names, emails, phone numbers and addresses are removed from error reports before they leave our servers.
• Resilience: point-in-time database backups, kept for up to 7 days, with restore tests.

We may improve these measures over time. We will not make them weaker.

9.6 Subprocessors

You agree that we may use these subprocessors:

• We hold each subprocessor to data protection terms at least as protective as this addendum, and we stay responsible for their work.
• We will update this list, and tell merchants who ask to be notified (at support@occamstudio.io), before a new subprocessor handles personal data. You can object on reasonable data protection grounds. If we cannot resolve your objection, you can stop using Patina by uninstalling it.

9.7 Helping with requests from individuals

If a seller, consignor or customer asks to access, correct, delete or port their data:

• Shopify sends us the request (customers/data_request or customers/redact), and Patina handles it as the Privacy Policy describes in section 9: it gathers an export of what it holds, or removes or deletes the person's data.
• If a person contacts us directly, we will pass the request to you and will not answer it ourselves unless you ask us to.
• We will help you with anything else you reasonably need to answer the request, including a data export.

We will also give you reasonable help with data protection impact assessments and with questions from regulators about Patina.

9.8 Deletion when you uninstall

• When you uninstall Patina, Shopify sends us a shop redaction request (shop/redact) 48 hours later. We then delete all of your shop's data, unless you have reinstalled Patina by then.
• Deleted data leaves our point-in-time backups when the backup window ends (up to 7 days).
• Before you uninstall, you can ask us at support@occamstudio.io for an export of your shop's data.

9.9 Security incidents

If we learn of a breach of security that leads to accidental or unlawful destruction, loss, change, disclosure of, or access to personal data we process for you, we will:

1. tell you without undue delay, and in time for you to meet a 72-hour deadline to notify a regulator (for example under the GDPR). We will also tell Shopify where Shopify's terms require it;
2. say what happened, what data and people are affected, the likely consequences, and what we are doing about it. If we do not know everything at first, we will send what we know and follow up;
3. contain the incident, investigate it, and take reasonable steps to limit the harm;
4. help you notify regulators and individuals where needed.

Telling you about an incident is not an admission of fault.

9.10 International transfers

Patina runs in the United States. When personal data from the EEA, UK or Switzerland is handled in the United States, we use appropriate safeguards with our subprocessors. For details, contact us at support@occamstudio.io.

9.11 Audits

• On reasonable request, we will give you the information you need to show that we meet this addendum, for example a written answer to a security questionnaire and a description of the measures in section 9.5.
• If that is not enough, or a regulator requires it, you (or an independent auditor you choose, bound by confidentiality) may audit our compliance. Give us at least 30 days' written notice. Audits are limited to once a year unless there has been a security incident, take place in normal working hours, and are at your cost.
• Audits must not give access to other merchants' data.

10. Changes to these terms

We may update these terms as Patina changes. We will post the updated version on this page. For significant changes, we will tell you in the app or by email at least 30 days before they take effect. If you keep using Patina after that, the new terms apply.

11. General

• For questions about the law that governs these terms, contact us at support@occamstudio.io.
• If part of these terms cannot be enforced, the rest still applies.
• You may not transfer these terms without our consent. We may transfer them to a business that takes over Patina, and will tell you if we do.
• These terms, the Privacy Policy and Shopify's terms are the whole agreement about Patina.

12. Contact

Occam Studio Email: support@occamstudio.io Web: https://occamstudio.io