Data Processing & Sub-processors

Last updated 22 July 2026

This page supplements our Privacy Policy and sets out how Leira (operated by Navid Asgharzadeh, 147 71 Grödinge, Sweden) processes store data on behalf of merchants, and the sub-processors we rely on. For merchant store data, the merchant is the controller and Leira is the processor.

1. Subject-matter & duration

We process the store configuration data described in the Privacy Policy for as long as the App is installed, plus the short deletion window after uninstall. We do not process orders, customers or any shopper personal data.

2. Nature & purpose

Processing is limited to backing up, verifying, storing, exporting and restoring the store resources Leira supports, and providing the related dashboard.

3. Location & transfers

All processing and storage takes place within the European Union. There is no transfer of store data to the United States or other third countries in the ordinary operation of the service.

4. Sub-processors

We will give notice of new sub-processors before they begin processing store data, giving controllers the opportunity to object.

5. Security & sub-processor obligations

We impose data-protection obligations on each sub-processor no less protective than those in our agreement with merchants. Backups and tokens are encrypted at rest with AES-256-GCM. Technical and organisational measures are described in the Security overview.

6. Deletion & assistance

On uninstall we irreversibly delete the store's records and backup blobs within 48 hours, and we assist controllers with data-subject requests and with Shopify's shop/redact / customers/redact compliance webhooks.

7. Contact

Data-processing enquiries: support@leira.app.