TopRow terms of service and data processing addendum

App: TopRow: Market Collection Sort ("TopRow", "we", "us")

Provided by: Marvel Labs

Contact: info@marvel-labs.com

Effective date: 4 November 2026

Part A: Terms of service

1. Agreement

These terms apply between us and the business that installs TopRow on its Shopify store ("you"). By installing or using TopRow you accept them. If you install on behalf of a business, you confirm you may bind it. Part B (data processing addendum) forms part of these terms.

These terms sit alongside Shopify's own terms, which also apply to your use of Shopify and the Shopify App Store.

2. What TopRow does

TopRow is an admin-only app. It:

• checks the top positions of your collections against each market's sales and stock, and shows a health report per market;
• shows your collection compared with Shopify's Most relevant sort;
• shows what AI agents can read per country (availability, price and description);
• on your click, writes one "safe" base order to a collection; and
• restores a collection's original sort, per collection or for all collections.

Shoppers in every market see the same base order you apply: this is what Shopify stores and shows on your collection page. AI agents may sort products their own way. Per-market ordering for shoppers is not part of this version.

3. Price

TopRow is free. There are no plans, charges or usage fees in this version. If we introduce paid plans later, we will tell you in advance, they will be billed only through Shopify, and you will not be charged unless you choose a paid plan.

4. Changes to your collections and restoring them

• TopRow only changes a collection's order when you click "Apply". To apply an order, TopRow sets that collection's sort to Manual.
• Before it first changes a collection, TopRow saves the original sort and product order. "Restore Shopify's sort" puts these back. Products added to the collection since then go to the end.
• If you change a managed collection's sort yourself, TopRow stops managing it and discards its saved original.
• Uninstalling cannot restore your sorts automatically, because Shopify removes TopRow's access before we are told you have uninstalled. Use Restore before you uninstall if you want your original sorts back.

5. Your responsibilities

• Check the proposed order before you apply it. You decide what is applied to your store.
• Keep your store, its products and its own customer-facing privacy policy accurate and lawful.
• Make sure you have a lawful basis to let TopRow process your store's order data as described in Part B.
• Do not misuse the app, attempt to access other shops' data, or interfere with the service.

6. Our responsibilities

We will provide TopRow with reasonable care and skill, process data only as described in the privacy policy (https://toprow.marvel-labs.com/privacy) and Part B, and tell you in the app about material changes.

7. Reports and suggestions

Reports and proposed orders are calculated from your store's data (sales, stock, availability and prices) at the time of the last sync. They are information to help you decide, not advice, and we do not promise any particular sales result. Data can be out of date between syncs.

8. Availability and changes to the app

TopRow is provided "as is" and "as available". We may change, suspend or withdraw features, or the app, and will give reasonable notice in the app where we can. We may suspend access if you breach these terms or if needed for security.

9. Liability

• Nothing in these terms limits liability for death or personal injury caused by negligence, fraud, or anything else that cannot be limited by law.
• We are not liable for loss of profit, sales, revenue, business or goodwill, or for indirect or consequential loss.
• As TopRow is free, our total liability under these terms in any 12 months is limited to £100.
• If you are a consumer, these limits do not affect your statutory rights. (TopRow is meant for businesses.)

10. Ending these terms

You can stop at any time by uninstalling TopRow. We can end these terms with 30 days' notice in the app, or at once if you seriously breach them. When they end, your data is deleted as described in Part B, section 8.

11. Changes to these terms

We may update these terms. We will change the effective date and tell you in the app at least 30 days before a material change takes effect. If you continue to use TopRow after that, the new terms apply.

12. General

• These terms are governed by the law of England and Wales, and its courts have exclusive jurisdiction.
• If any part is found unenforceable, the rest still applies.
• You may not transfer these terms without our consent. We may transfer them to a successor of the TopRow business, and will tell you.
• Contact: info@marvel-labs.com.

Part B: Data processing addendum

This addendum (the "DPA") applies when TopRow processes personal data on your behalf. It is meant to meet Article 28 of the UK GDPR and the EU GDPR. "Personal data", "controller", "processor", "data subject", "processing" and "personal data breach" have the meanings in those laws.

1. Roles

You are the controller of the order data in your Shopify store. We are your processor for that data. For your own account data with us (shop domain, settings, use of the app), we are a controller, as set out in the privacy policy.

2. Details of the processing

3. Our obligations as processor

We will:

1. process the personal data only on your documented instructions, which are these terms and your use of the app's settings, unless the law requires otherwise (in which case we will tell you first, unless the law forbids it);
2. make sure anyone authorised to process it is bound by confidentiality;
3. apply the security measures in Annex 1 (Article 32);
4. use sub-processors only as set out in section 4;
5. help you, as far as reasonably possible given what the app holds, respond to data subject requests;
6. help you meet your duties on security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36), taking into account the nature of the processing and the information available to us;
7. delete the personal data at the end of the service, as set out in section 8;
8. make available the information needed to show we meet this DPA, and allow for and contribute to audits, as set out in section 9; and
9. tell you at once if we think an instruction breaks data protection law.

4. Sub-processors

You give general authorisation for us to use sub-processors. The current list is in Annex 2. We will tell you in the app at least 30 days before adding or replacing one. You may object on reasonable data protection grounds; if we cannot address the objection, you may stop using TopRow by uninstalling it. We will put a written contract in place with each sub-processor with data protection terms no less protective than this DPA, and we remain responsible for them.

5. International transfers

TopRow and its database run in Railway's EU West region in Amsterdam, the Netherlands. Railway Corporation is a US company and says its primary processing takes place in the United States, so some processing by Railway can happen there. Those transfers rely on the EU-US Data Privacy Framework and its UK extension where the recipient is certified, or otherwise on the EU Standard Contractual Clauses and the UK Addendum, as set out in Railway's data processing addendum. Any other transfer outside the UK or the European Economic Area will go only to a country with an adequacy decision or under one of these safeguards.

6. Personal data breaches

We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data. We will give you the information we have to help you meet your own notification duties, and update it as we learn more.

7. Data subject requests

TopRow does not keep personal data at order or customer level, so there is normally nothing to return or delete for an individual customer. When Shopify forwards a customers/data_request or customers/redact request, we acknowledge it. If a data subject contacts us directly, we will pass the request to you without undue delay.

8. Deletion at the end of the service

• When you uninstall TopRow, its access tokens are deleted straight away.
• When Shopify sends its shop/redact request (48 hours after uninstall), we delete all data held for your shop, including the order totals. If that request never arrives, we delete it 30 days after uninstall.
• While installed, order totals older than 90 days are deleted at every nightly sync.
• As raw orders are never stored, there is no order-level data to return. Your order data remains in your Shopify store.

9. Audits

We will answer reasonable written questions about our compliance with this DPA. If that is not enough to show compliance, you may ask for an audit, on at least 30 days' notice, no more than once a year (unless a regulator requires it or after a breach), at your cost, and subject to confidentiality.

10. Order of precedence

If this DPA conflicts with Part A, this DPA wins on data protection matters.

Annex 1: Security measures

• HTTPS (TLS) for all traffic to Shopify and to the app.
• Shopify and Storefront access tokens encrypted at rest with AES-256-GCM; the key is held only in server environment settings.
• HMAC signature verification of every Shopify webhook.
• Database, backup and environment settings encrypted at rest with AES-256 by the hosting provider.
• Data minimisation: no customer name, email, phone or address fields requested; orders aggregated in memory and not stored.
• Logs exclude tokens and customer data.
• Production access limited to Marvel Labs staff who run TopRow.
• Data of each shop is separated by shop in the database and deleted on shop/redact.

Annex 2: Sub-processors

Not used in this version: Anthropic (Claude) or any other AI provider. No personal data is sent to an AI provider.