Historical Terms — 29 September 2026

1. Provider and Scope

These Terms of Service (“Terms”) govern the use of the Shopify application Post-Purchase Upsell Hero (the “App”), provided by:

HeroSoftware GmbH
Walramstraße 23, 65510 Idstein, Germany
Represented by the managing director: Calvin Blick
Commercial register: Amtsgericht Wiesbaden, HRB 34094
VAT ID: DE360788620
E-mail: post@hero.software

By installing or using the App, you (“Merchant”, “you”) agree to these Terms. If you do not agree, do not install or use the App.

The App is intended exclusively for business customers (B2B). By installing the App, you confirm that you are acting in the course of your commercial or independent professional activity within the meaning of § 14 BGB (German Civil Code).

2. Description of the Service

Post-Purchase Upsell Hero enables merchants to display one-click upsell and downsell offers to customers after checkout on Shopify stores. Features include unlimited funnels and offers, AI-based product recommendations, analytics and A/B testing, translations for markets, and mobile-optimized offer pages.

We continuously develop the App. Individual features may be added, modified, or removed, provided this does not materially reduce the core functionality of the App for the Merchant.

3. Pricing and Payment

The App is offered under the following plan:

“Upsell revenue” means the gross revenue of orders or order items generated through offers displayed by the App, as measured by the App.

All fees are billed through the Shopify billing system in accordance with Shopify's billing cycles and terms. Prices are stated in USD and, where applicable, exclusive of VAT. We reserve the right to change prices with at least 30 days' prior notice; changes take effect at the start of the next billing cycle. If you do not agree to a price change, you may cancel before it takes effect.

4. Term and Cancellation

The contract runs for an indefinite period. You may cancel at any time by uninstalling the App from your Shopify store or by cancelling your plan through Shopify. Cancellation takes effect in accordance with Shopify's billing terms; fees already incurred (including usage fees on upsell revenue already generated) remain payable. There are no refunds for partial billing periods unless required by law.

We may terminate the contract with 30 days' notice, or without notice for good cause, in particular in the event of a material breach of these Terms, abusive use of the App, or non-payment.

5. Merchant Obligations

You are responsible for:

• the lawful operation of your Shopify store, including compliance with consumer protection, e-commerce, and advertising laws applicable to your store and the offers displayed through the App;
• the accuracy of product data, prices, and offer content configured in the App;
• maintaining the confidentiality of your Shopify account credentials;
• not using the App to display unlawful, misleading, or infringing content.

You may not reverse engineer, decompile, resell, sublicense, or misuse the App, or use it in a way that impairs its operation or security. You may not use the App to send unsolicited communications (spam) or in connection with products or services that are unlawful or violate Shopify's Acceptable Use Policy.

Use of the App is prohibited for Merchants located in, or conducting activities in, countries subject to EU, US, or UN embargoes or sanctions.

No legal advice. Templates, default settings, recommendations, AI-generated product suggestions, example funnels, documentation, and support provided in connection with the App are for informational purposes only and do not constitute legal, tax, or compliance advice. You are solely responsible for ensuring that your use and configuration of the App — including offer design, pricing display, and post-purchase flows — complies with the laws applicable to your store (in particular consumer protection, withdrawal rights, price indication, and tax rules). We do not monitor your store, jurisdictions, or configurations for legal compliance and have no obligation to notify you of changes in laws or platform rules affecting your business.

6. Data Protection and Security

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable German data protection law.

• Hosting: The production application, database and application-log infrastructure are hosted with DigitalOcean in Frankfurt, Germany. Other services used in connection with the App may process data outside Germany or the European Economic Area. Where personal data is transferred internationally, the requirements and safeguards described in Annex 1 apply.
• Encryption: Application data is encrypted in transit and at rest, including the database, application logs and backups. Encryption of employee workstations is a separate measure and is scheduled for completion by 31 December 2026.
• Processing on behalf: Where we process personal data of your store's customers on your behalf, we act as a data processor. This is governed by our Data Processing Agreement (DPA) pursuant to Art. 28 GDPR, which forms part of these Terms (Annex 1; technical and organisational measures in Annex 2).
• Our own processing: For account, billing, usage, and support data relating to you as our customer, we act as an independent data controller. Details are set out in our Privacy Policy.

Details on the categories of data processed, purposes, retention periods, and data subject rights are set out in our Privacy Policy.

7. Availability

We aim for high availability of the App but do not guarantee uninterrupted operation. Maintenance windows, updates, and disruptions caused by Shopify, hosting providers, or other third parties may temporarily limit availability. Where reasonably possible, planned maintenance will be announced in advance.

8. Intellectual Property

The App, including its software, design, texts, and trademarks, is the exclusive property of HeroSoftware GmbH or its licensors and is protected under German and international copyright and trademark law. You receive a non-exclusive, non-transferable, revocable right to use the App for the duration of the contract and solely for operating your own Shopify store(s). All other rights remain reserved.

9. Limitation of Liability

We are liable without limitation for intent (Vorsatz) and gross negligence (grobe Fahrlässigkeit), for injury to life, body, or health, and under the German Product Liability Act (Produkthaftungsgesetz).

In cases of slight negligence (einfache Fahrlässigkeit), we are liable only for breaches of material contractual obligations (Kardinalpflichten), i.e. obligations whose fulfilment is essential for the proper performance of the contract and on whose fulfilment you may regularly rely. In such cases, liability is limited to the foreseeable damage typical for this type of contract.

We are not liable for lost profits, lost revenue (including lost upsell revenue), or indirect or consequential damages, except in cases of intent or gross negligence.

We are not liable for disruptions caused by Shopify, third-party apps, themes, or the Merchant's own configuration.

10. Indemnification

You shall indemnify us against all third-party claims arising from your unlawful use of the App or from content you configure or display through the App, including reasonable costs of legal defence, unless you are not responsible for the breach.

11. Confidentiality

Each party shall protect the other party's confidential information (in particular non-public business, technical, and financial information disclosed in connection with the App) from unauthorized use, access, or disclosure with at least the same degree of care it applies to its own confidential information, and no less than reasonable care. This obligation survives termination for a period of three (3) years. It does not apply to information that is publicly available, independently developed, or required to be disclosed by law.

12. Changes to These Terms

We may amend these Terms with effect for the future. We will notify you of material changes at least 30 days before they take effect (e.g. by e-mail or in-app notice). If you do not object within this period or continue to use the App after the changes take effect, the amended Terms are deemed accepted. We will point this out in the notification. If you object, either party may terminate the contract with effect from the date the changes take effect.

13. Dispute Resolution

We are neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board.

14. Final Provisions

These Terms are governed by the laws of the Federal Republic of Germany, excluding the UN Convention on Contracts for the International Sale of Goods (CISG).

Exclusive place of jurisdiction for all disputes arising from or in connection with these Terms is Wiesbaden, Germany, provided you are a merchant (Kaufmann), a legal entity under public law, or a special fund under public law.

Should individual provisions of these Terms be or become invalid, the validity of the remaining provisions shall remain unaffected.

Contact: HeroSoftware GmbH, Walramstraße 23, 65510 Idstein, Germany — post@hero.software

Annex 1: Data Processing Agreement (DPA)

Data Processing Agreement pursuant to Art. 28 GDPR

This Data Processing Agreement (“DPA”) forms an integral part of the Terms of Service for Post-Purchase Upsell Hero and applies whenever HeroSoftware GmbH (“Processor”) processes personal data on behalf of the Merchant (“Controller”) in connection with the App.

1. Subject Matter and Duration

The Processor processes personal data on behalf of the Controller for the purpose of providing the App as described in the Terms of Service. The duration of this DPA corresponds to the term of the Terms of Service. It ends automatically when the App is uninstalled and all personal data has been deleted or returned in accordance with Section 10.

2. Nature and Purpose of Processing

Processing includes the collection, storage, analysis, and display of order and customer data from the Controller's Shopify store in order to:

• display post-purchase upsell and downsell offers to the Controller's customers;
• generate AI-based product recommendations;
• provide analytics, A/B testing, and reporting;
• calculate usage-based fees (upsell revenue).

3. Types of Personal Data

These categories also cover data processed temporarily via APIs, webhooks or application logs; listing a category does not mean every field is stored permanently.

• Order, shop, product, checkout and funnel data (including order ID, order value, purchased products and timestamps)
• Customer IDs and broad shipping regions
• Read customer segments, order count and language
• Customer data that may be contained in Shopify payloads (name, e-mail address, shipping and billing address, where transmitted by Shopify)
• Technical data that may be processed depending on the API and webhook payloads received and the application logs (IP address, device and browser information, session identifiers)
• Interaction data with upsell offers (views, clicks, purchases, declines)

4. Categories of Data Subjects

• Customers of the Controller's Shopify store
• Staff members of the Controller using the App

5. Obligations of the Processor

The Processor shall:

• a) process personal data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless prohibited by law;
• b) ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• c) implement all technical and organisational measures required pursuant to Art. 32 GDPR (see Annex 2);
• d) respect the conditions referred to in Section 6 for engaging sub-processors;
• e) taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller's obligation to respond to requests for exercising data subject rights (Art. 12–23 GDPR);
• f) assist the Controller in ensuring compliance with the obligations pursuant to Art. 32–36 GDPR (security, breach notification, data protection impact assessments), taking into account the nature of processing and the information available to the Processor;
• g) notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data;
• h) at the choice of the Controller, delete or return all personal data after the end of the provision of services (Section 10);
• i) make available to the Controller all information necessary to demonstrate compliance with Art. 28 GDPR and allow for and contribute to audits (Section 9);
• j) immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

6. Sub-Processors

The Controller grants the Processor a general authorisation to engage sub-processors for the provision of the App. The overview of services used is set out below; questions may be sent to post@hero.software.

Overview of services used: Development services qualify as sub-processors only if they receive personal data we process on behalf of the Merchant. Listing them does not mean that merchant customer data is transferred to them.

• DigitalOcean: hosting of the App, database and application logs in Frankfurt.
• OpenAI API: optional product ranking; according to the developer, product IDs, titles and categories are transmitted.
• DeepL API: translation of offer texts; according to the developer, no directly identifying buyer data.
• GitHub: development service for source code and developer accounts; this listing does not confirm that GitHub processes merchant customer data.
• Cursor / Anysphere: development service for AI-assisted development on the regular Business/Team plan (not Enterprise), with Privacy Mode enabled to the maximum extent. This listing does not confirm that Cursor processes merchant customer data. Privacy Mode is not a guarantee of no data transfer, no storage or EU-only processing.
• Mantle: used through September 2026; not intended for use from October 2026. This does not establish that data from prior use has already been deleted.

Shopify is the platform with a direct relationship with the Merchant and is not categorically classified here as HeroSoftware's sub-processor.

The Processor shall inform the Controller of any intended addition or replacement of sub-processors at least 30 days in advance, giving the Controller the opportunity to object on reasonable data protection grounds. If the Controller objects and no mutually acceptable solution is found, the Controller may terminate the Terms of Service.

The Processor shall impose on each sub-processor the same data protection obligations as set out in this DPA by way of contract. The Processor remains fully liable to the Controller for the performance of the sub-processor's obligations.

7. Place of Processing and International Transfers

The production application, database and application-log infrastructure are hosted in Frankfurt, Germany. Processing by other service providers may take place in other countries. Transfers of personal data outside the European Economic Area are subject to Chapter V GDPR and the applicable sub-processor information and authorisation requirements under Section 6.

8. Data Subject Rights

If a data subject contacts the Processor directly with a request under Art. 12–23 GDPR, the Processor shall forward the request to the Controller without undue delay. The Processor shall not respond to such requests itself unless instructed to do so by the Controller or required by law.

9. Audits

The Controller has the right to verify the Processor's compliance with this DPA. The Processor shall primarily demonstrate compliance by providing suitable documentation (e.g. descriptions of technical and organisational measures, certifications, audit reports). On-site audits may be conducted no more than once per calendar year, during normal business hours, with at least 30 days' prior written notice, and without disrupting business operations, unless a personal data breach or evidence of non-compliance justifies a shorter notice period.

10. Deletion and Return of Data

Upon termination of the Terms of Service (in particular upon uninstallation of the App), the Processor shall, at the Controller's choice, delete or return all personal data processed on behalf of the Controller within 30 days, and delete existing copies, unless Union or Member State law requires further storage. Deletion in accordance with Shopify's mandatory GDPR webhooks (shop/redact, customers/redact, customers/data_request) remains unaffected and is performed within the deadlines set by Shopify.

Access and deletion requests may also arise during use of the App. Uninstallation triggers deletion duties; it does not mean all data is immediately and completely deleted. The obligation to delete or return data within 30 days remains in force.

11. Liability

Liability under this DPA is governed by Art. 82 GDPR and the limitation of liability set out in Section 9 of the Terms of Service, to the extent permitted by law.

12. Precedence

In the event of a conflict between this DPA and the Terms of Service regarding the processing of personal data, this DPA shall prevail.

Annex 2: Technical and Organisational Measures (Art. 32 GDPR)

The following distinguishes existing measures from planned improvements. Where indicated, descriptions of technical implementation are based on management or developer reports.

A. Personnel and access control

• Internal access is limited to the company's own employees in Germany; no freelancers. Only company-owned workstations and personal user accounts are used.
• All employees have written data-protection and confidentiality commitments. Two-factor sign-in is used for DigitalOcean and GitHub; screens lock automatically.
• Access rights are granted according to task requirements and reviewed quarterly. Access is blocked or removed immediately on departure.

B. Infrastructure and encryption

• The production App, MongoDB and OpenSearch are hosted with DigitalOcean in Frankfurt. The hosting provider provides physical protection of the data centres.
• According to management, application data is encrypted in transit and at rest, including the database, application logs and backups. Workstation encryption is planned separately (F).

C. Integrity and logging

• According to the developer, application logging uses Winston/OpenSearch; this does not constitute a commitment to log every access to or change to personal data.
• Production and test/development environments are separated.

D. Availability and recovery

• According to the developer, multiple App instances run with autoscaling; MongoDB currently has a single database node.
• According to the developer, MongoDB backups are taken daily and retained for seven days. Health checks and technical alerts are in place.
• According to management, the entire App including the database was successfully restored in Q1 2026.

E. Incident handling and review

• Team Lead Martin Herd is responsible for technical security incidents; Calvin Blick is his deputy. Martin Herd and the internal development team oversee technical monitoring.
• A written incident procedure has been prepared, covering reporting, containment, evidence preservation, assessment, customer notification, recovery and follow-up. Rollout and staff instruction have not yet been completed.
• A quarterly review of technical and organisational measures is planned. The obligation to inform the affected Controller without undue delay after becoming aware of a personal data breach affecting its data remains in force (Annex 1, Section 5(g)).

F. Planned improvements (not yet implemented)

The following improvements are planned for completion by 31 December 2026:

• full-disk encryption on all company workstations;
• initial data-protection and information-security training for all employees with relevant access.

These measures are planned and are not represented as already implemented. The target date does not suspend applicable data-protection or security obligations.

The Processor may update these measures, provided that the level of protection is not reduced.