SweepSpot merchant terms
and data processing.

Adopted by Steven Vining on October 16, 2026. This version takes effect for a Merchant only upon its authorized representative’s affirmative in-app acceptance. Publication alone does not create a merchant contract.

1. Parties and acceptance

This agreement is between Steven Vining, operating SweepSpot in Jenks, Oklahoma, United States (SweepSpot), and the business operating the Shopify store identified in the authenticated acceptance record (Merchant). The person accepting must be authorized to bind that business. Once this version is adopted and offered, the agreement takes effect when that representative affirmatively accepts it in SweepSpot. A Shopify install or use before that acceptance is not recorded as acceptance of this version. The current merchant launch scope is United States only.

2. Service and merchant responsibilities

SweepSpot supplies Shopify sweepstakes administration tools: configured entry calculations, order adjustments, alternative-entry review, referrals, customer-visible totals, exports and selection evidence. Availability of placements depends on Shopify plans and configuration. The Merchant supplies lawful official rules, dates, eligibility, prizes, notices, any required no-purchase route, and fulfillment. SweepSpot does not sponsor promotions, provide prizes, verify every participant’s eligibility or guarantee that a promotion complies with law. The Merchant must review its rules and final prize administration, correct inaccurate inputs and arrange human review of disputed outcomes. It must obtain any registrations, permissions and required promotion-specific review before a live promotion.

3. Plans, changes and ending service

Shopify presents subscription prices, trial terms, billing periods and approval steps. Only terms expressly approved through Shopify determine the subscription charge; this agreement does not itself create a charge. Plan and usage in the app describes entitlements. The Merchant may change plans through Shopify or uninstall to revoke app access. Effective billing dates and any credits/refunds follow the applicable Shopify approval terms and law. Ending access does not certify immediate erasure of every retained copy. SweepSpot may restrict affected processing when reasonably necessary for security, an unlawful instruction or material misuse, and will provide notice where lawful and practicable. Export needed records before ending service; lawful privacy requests remain available through support.

4. Data processing instructions

The Merchant determines the purposes of participant processing; SweepSpot processes on documented instructions to provide the service. Each party remains responsible for independent processing it controls. Authenticated settings and support instructions are instructions only within this agreement and law. SweepSpot will notify the Merchant of an apparently unlawful instruction and suspend affected processing pending resolution.

Data subjects include customers, participants and authorized staff. Necessary data includes store/customer/staff identifiers; names, email and phone; relevant order, product, discount and refund facts; entry/adjustment/referral records; eligibility attestations; winner evidence and minimized service metadata. Processing consists of collection, matching, calculation, storage, display, review, export, security and erasure for service provision and documented deletion periods. Payment-card credentials and unnecessary sensitive data are not required; do not include them in notes or ordinary support messages.

5. Confidentiality and safeguards

SweepSpot limits use to lawful service instructions, restricts access to authorized people who need it and are bound by confidentiality, and maintains proportionate safeguards. It will not sell participant data, share it for targeted advertising, use it for unrelated marketing, or train general-purpose AI models with it. Safeguards include authenticated tenant access, HTTPS, protected server credentials, private exports, application encryption for tokens/privacy payloads/erasure journals, minimized access logs and monitored cleanup. Not every database column is application-encrypted. Neither absolute security nor an independent certification is promised.

6. Providers and locations

The Merchant authorizes Vercel Inc. for hosting/configuration and encrypted independent erasure journals; Supabase Pte. Ltd. for database/private exports; Upstash Inc. for pseudonymous rate limiting; and Functional Software Inc. d/b/a Sentry for sanitized monitoring. Shopify supplies the connected platform under its own applicable terms. Primary application functions and database are in the US; provider networks/support may operate elsewhere, and applicable authorities may access information under local law. No exclusive US-residency guarantee is given.

SweepSpot requires contractual protection for delegated processing and remains responsible for its subcontracted obligations. It will give advance notice of material provider additions and a reasonable opportunity for substantiated privacy/security objections, resolving them before affected new processing, including ending affected service if necessary. The provider list supplies operational details; a material change in contractual duties requires a new agreement version and affirmative acceptance.

7. Requests, incidents and evidence

The Merchant supplies required notices and lawful permissions, verifies instructions, handles campaign questions and controls downloaded files. SweepSpot assists with applicable access, correction, deletion and other privacy requests, promptly routes requests to the responsible Merchant where appropriate, and uses proportionate verification and secure delivery. Privacy lead: Steven Vining, reachable through temporary contact laziz@cogotulsa.com. Do not send identity documents, secrets or full exports initially.

SweepSpot will notify affected Merchants without undue delay after awareness of a personal-data breach, with known scope, effects, containment and contact information and updates as facts develop. Each party determines its own applicable notification duties and cooperates; no contractual timing postpones a legal duty. Where legally permitted, SweepSpot notifies the Merchant of authority demands affecting entrusted data and limits disclosure to what is required. It supplies reasonable compliance evidence and cooperates with proportionate confidential audits that protect other merchants and security material.

8. Retention, return and erasure

On verified instruction or termination, SweepSpot returns or deletes entrusted information under applicable law and the documented schedule, unless a limited legal obligation requires retention. Exceptions must have a recorded basis, restricted access and review/end date. Ordinary targets include campaign data 12 months after close, standard exports 24 hours, privacy archives seven days, failed webhook payloads 14 days, terminal operational metadata 90 days, support 12 months after resolution and minimized completed compliance evidence 24 months. Verified erasure takes precedence over ordinary targets, subject to limited lawful exceptions. Required statutory incident registers are distinct.

Current implementation status and remaining provider/global-record expiry limits are stated in the privacy notice; no universal 30-day all-copy deletion guarantee is made. Generated files are deleted as well as invalidated. Restricted anti-recreation records remain while a backup/replay could recreate erased information, and erasures must be reapplied before restored data serves traffic. Merchant-downloaded copies require Merchant action. Acceptance evidence is minimized to store identifier, authenticated staff identifier, version/digest, server time and affirmative authority/US-business confirmations; it is subject to lawful erasure and limited compliance retention.

9. Rights, limitations and changes

The Merchant retains its rights in its data and gives SweepSpot only the permissions necessary to provide and secure the service under this agreement. This agreement does not waive non-waivable rights, impose an agreed damages cap, select arbitration or require indemnification. Applicable law governs rights and remedies. Promotion outcomes, third-party availability and uninterrupted/error-free service are not guaranteed; these statements do not exclude obligations that law does not permit to be excluded. Material agreement changes require a new version and affirmative acceptance; no consent is inferred from a prechecked box or silent replacement of this document.