← Back to Tiger Echo
Data Processing Agreement
Agreement between the Merchant (“Controller”) and Tiger Echo (“Processor”) for Data Protection Compliance
Last Updated: October 11, 2026 | Effective Date: July 27, 2026
Note: This DPA forms part of the
Terms of Service.
If you are a merchant using Tiger Echo to process customer reviews, this Agreement applies to you.
It governs how Tiger Echo processes personal data on your behalf when you use our service.
Tiger Echo is operated by Han Hui, an independent developer based in China, with application servers located in Hong Kong SAR, China.
1. Parties and Roles
This Data Processing Agreement (“DPA”) is entered into between:
- Controller (You / the Merchant): The Shopify store owner who determines the purposes and means of processing personal data of their customers (e.g., names, email addresses, review content) through Tiger Echo.
- Processor (Tiger Echo): Tiger Echo, operated by Han Hui (an independent developer), at tigerecho.com, who processes personal data only on the documented instructions of the Controller in connection with the review management services provided.
Both parties acknowledge that, with respect to the processing of EU/UK/Swiss personal data under this DPA, Tiger Echo acts as a Data Processor and the Merchant acts as the Data Controller, as defined under the GDPR (EU) 2016/679, UK GDPR, and the Swiss FADP. For data subjects in other jurisdictions (Brazil, the Middle East, Hong Kong, etc.), the parties' roles are determined under the applicable local law, with the Merchant as Controller and Tiger Echo as Processor.
2. Scope and Purpose of Processing
Tiger Echo processes personal data only for the following limited purposes:
- Review Collection: Collecting, storing, and displaying customer reviews submitted on the Merchant’s Shopify store (provided by the Merchant, e.g., via CSV import).
- AI-Powered Summaries: Generating AI reply/email drafts of reviews using a third-party AI provider (currently DeepSeek API), in real time only.
- Email Review Reminders: Sending automated email reminders to customers requesting review submissions.
- Analytics and Insights: Providing review analytics and sentiment analysis to the Merchant.
- Data Export: Enabling the Merchant to export review data in CSV format.
No AI/ML Training: Tiger Echo does not use any Controller or customer data — including reviews, names, or email addresses — to train, fine-tune, or improve any artificial intelligence or machine-learning model. Data sent to the AI provider (DeepSeek) is used solely to generate a draft and is never retained for training. This complies with Shopify’s API Terms, which prohibit using Merchant or Customer Data to develop or train AI/ML systems without authorization.
3. Types of Personal Data Processed
| Data Category | Examples | Processing Activity |
|---|
| Identity Data | Customer name, email address | Review attribution, email reminders |
| Review Content | Review text, star rating, photos | Storage, display, AI summarization |
| Order Data | Order number, product purchased, date | Review request matching |
| Communication Data | Email headers, delivery status | Email campaign management |
| Technical Data | IP address (if logged), device info | Security, fraud prevention |
| Consent Records | Opt-in timestamp, method, scope | Compliance verification |
Tiger Echo does not process special categories of sensitive data unless explicitly provided by the Controller.
4. Controller Obligations
The Controller shall:
- Ensure all personal data submitted to Tiger Echo is collected and processed lawfully under Articles 6 and 9 GDPR.
- Obtain all necessary consents from data subjects before their data is submitted for review collection.
- Provide and maintain a clear, accessible privacy notice on their Shopify store informing customers that reviews may be processed by third-party services including Tiger Echo.
- Notify Tiger Echo promptly (within 48 hours) if the Controller becomes aware of a personal data breach or receives a data subject request relating to data processed by Tiger Echo.
- Ensure that the transfer of personal data to Tiger Echo is lawful under Chapter V GDPR.
5. Processor Obligations (Tiger Echo)
Tiger Echo, as Data Processor, shall:
- Process lawfully: Process all personal data only on the documented instructions of the Controller.
- Confidentiality: Ensure all authorised personnel are subject to binding confidentiality obligations.
- Security: Implement appropriate technical and organisational measures per Article 32 GDPR, including encryption, access controls, regular security assessments, and incident response.
- Sub-processors: Engage sub-processors only with the Controller’s prior written consent. See Section 8 for the current sub-processor list.
- Assist Controller: Assist the Controller in fulfilling obligations under Articles 32–36 GDPR.
- Data subject requests: Where feasible, assist the Controller in responding to data subject requests (access, rectification, erasure, portability, objection).
- Delete or return data: At the Controller’s choice, either delete or return all personal data after the end of the provision of services.
- Demonstrate compliance: Allow for and contribute to audits conducted by the Controller.
6. International Data Transfers
Tiger Echo’s application servers are located in Hong Kong SAR, China. Depending on the feature used, personal data may also be transferred to and processed by the following sub-processors in other jurisdictions (see Section 8):
- Hong Kong SAR (Alibaba Cloud OSS): Review images stored in the Hong Kong region.
- People’s Republic of China (DeepSeek API): Review/email text processed on DeepSeek servers in the PRC to generate AI drafts in real time.
- Canada / Singapore (Shopify Inc.): Platform data processed by Shopify.
- United States (Resend Inc.): Email delivery.
For transfers of personal data from the EEA, the United Kingdom, or Switzerland to these third countries, Tiger Echo relies on Standard Contractual Clauses (SCCs, Module Two — Controller-to-Processor) and/or the UK International Data Transfer Addendum, together with the data-processing agreements in place with each sub-processor and transfer impact assessments where required. Where a destination benefits from an adequacy decision (e.g., Canada, the UK, Switzerland), transfers rely on that basis.
Controller’s responsibility: The Controller is responsible for ensuring that its use of Tiger Echo’s AI feature is consistent with its own data-protection obligations, including documentation in its records of processing activities (RoPA).
7. Data Security Measures
| Measure | Description |
|---|
| Encryption in Transit | TLS 1.2+ for all data transmissions. |
| Encryption at Rest | Personal data encrypted at rest where technically feasible. |
| Access Controls | Role-based access control (RBAC); access on a need-to-know basis only. |
| Network Security | Firewalls, IDS/IPS, and DDoS protection at network perimeter. |
| API Authentication | HMAC signatures and OAuth 2.0 tokens for all API requests. |
| Vulnerability Management | Regular vulnerability scanning and patching. |
| Backup and Recovery | Automated daily backups; tested restoration procedures; 30-day retention. |
| Incident Response | Documented security incident response procedure with defined escalation timelines. |
8. Sub-Processors
The Controller provides general written authorisation for all sub-processors by accepting this DPA. The current approved sub-processors are:
| Sub-Processor | Purpose | Location | Safeguards |
|---|
| Shopify Inc. |
E-commerce platform providing store/product data via API and billing |
Canada / Singapore |
Shopify DPA + Adequacy decision (Canada) |
| Resend Inc. |
Transactional and marketing email delivery |
United States |
DPA + EU Standard Contractual Clauses |
DeepSeek
Hangzhou DeepSeek Artificial Intelligence Basic Software Technology Co. Ltd. |
Real-time AI reply/email draft generation (no training on data) |
People’s Republic of China |
Controller consent for AI feature + SCCs where applicable |
Alibaba Cloud (OSS)
Alibaba Cloud Computing Co. Ltd. |
Object storage for review images and attachments |
Hong Kong SAR |
Adequacy decision (HK) + DPA |
Tiger Echo will notify the Controller of any intended sub-processor changes with 14 days’ prior written notice. The Controller may object, and the parties will work in good faith to find an alternative.
9. Data Breach Notification
In the event of a personal data breach, Tiger Echo shall:
- Notify the Controller without undue delay, and in any event within 48 hours of becoming aware of the breach.
- Provide: the nature of the breach, categories and number of data subjects concerned, likely consequences, and measures taken or proposed to address the breach.
- Assist the Controller in notifying the relevant supervisory authority and affected data subjects where required.
10. Data Retention and Deletion
- Active data: Retained for as long as the Controller maintains an active subscription.
- Post-termination: Within 30 days of account termination, Tiger Echo shall delete all personal data from active systems, except where required by law to retain.
- Backups: Personal data in backups retained for up to 30 days, then securely overwritten.
- Anonymous statistics: Aggregated, anonymised statistical data may be retained indefinitely and does not constitute personal data.
11. Audit Rights
The Controller may audit Tiger Echo’s compliance by:
- Requesting a copy of Tiger Echo’s most recent security audit or certification report (e.g., SOC 2 Type II) within 30 days of written request.
- Conducting an on-site audit, subject to: (a) 30 days’ prior written notice, (b) Tiger Echo’s availability, and (c) the Controller bearing its own costs.
12. Liability and Indemnification
- Tiger Echo’s liability is subject to the limitations in the Terms of Service.
- Tiger Echo shall not be liable for claims arising from the Controller’s failure to comply with its obligations as Data Controller.
- Each party shall indemnify the other against claims from supervisory authorities or data subjects arising from the indemnifying party’s breach of this DPA.
13. Supervisory Authority and Complaints
As a Processor established outside the EEA/UK, Tiger Echo is not directly subject to a single EU lead supervisory authority under Article 56 GDPR. EU/EEA Controllers may lodge complaints with their local supervisory authority (the authority of the Controller’s establishment): EDPB Members List.
UK-specific matters: Information Commissioner’s Office (ICO): ico.org.uk. Swiss matters: Federal Data Protection and Information Commissioner (FDPIC): edoeb.admin.ch. Hong Kong: PCPD pcpd.org.hk. Brazil: ANPD gov.br/anpd. Middle East: UAE u.ae / SDAIA (Saudi) sdaia.gov.sa.
13.1 Global Data Protection Laws
In addition to the GDPR and UK GDPR, this DPA is intended to comply with other applicable data protection laws, including Brazil’s LGPD (Law 13.709/2018), the UAE Federal Decree-Law No. (45) of 2021 and DIFC/ADGM regimes, the Saudi PDPL (Royal Decree M/19), the Egyptian PDPL No. 151 of 2020, Hong Kong’s PDPO, and Switzerland’s FADP. Where a local law imposes stricter or additional requirements on the Processor, those requirements apply to the relevant processing.
14. Governing Law and Jurisdiction
This DPA is governed by the same governing law as the Tiger Echo Terms of Service (laws of the People’s Republic of China). Nothing in this DPA reduces or limits a data subject’s rights under the GDPR, UK GDPR, FADP, LGPD, or any other applicable data protection law, and such rights are enforceable against the relevant party notwithstanding the governing law clause.
15. Amendments
Tiger Echo reserves the right to amend this DPA. Material amendments will be communicated at least 30 days before the effective date. Continued use of the Service after the effective date constitutes acceptance.
16. Contact Information