SD: Less Time Marketing — Processing Schedule
This schedule describes only personal data processed on the merchant's behalf by Less Time Marketing and forms part of the general ShopiDeck DPA. Account administration handled as controller remains governed by the general Privacy Policy.
1. Subject matter, duration, and instructions
The purpose is generating, storing, scheduling, and publishing merchant content from authorized product and brand materials. Processing includes retrieval, temporary media processing, AI generation, storage of campaign metadata and asset links, transmission to chosen social accounts, logging, and deletion. It lasts for the app relationship and documented retention periods. Prompts, selected platforms, campaign settings, individual approvals, and explicitly enabled automatic publishing are documented instructions. They apply only to this app.
2. Data and people concerned
Data may include business contact details, brand and product materials containing personal data, authorized account/channel identity, campaign content and assets, publishing instructions and technical records needed to carry them out. People concerned are merchant staff and authorized account operators, and people lawfully depicted or identified in merchant-supplied materials. Shopify customer, order, and payment datasets, private social messages, follower lists, and sensitive data are outside the intended processing. Do not submit those datasets through prompts or materials. Roles for each operation, including connection administration, are described in the app privacy addendum.
3. Providers, measures, and deletion
Only providers identified for Less Time Marketing in the provider register are used for the relevant operations. Merchant-selected social platforms receive posts on the merchant's instruction and may process them as independent controllers; they are not automatically ShopiDeck subprocessors for all their activities. AI-provider use is restricted to the instructed generation service and its contracted processing terms. Bot Cleaner providers and customer-profile instructions are not incorporated here.
Measures include HTTPS, encrypted stored social tokens (AES-256-GCM), least-privilege access, and audit records. The general DPA governs confidentiality, provider obligations, rights assistance, international transfers, incidents, audits, and return/deletion. Ordinary retention, immediate in-app token removal, local deletion on shop/redact, residual hashes, and Shopify Files/platform-copy limits are detailed in this app's privacy addendum; no universal 48-hour deletion promise applies to every provider copy.