Data Processing Addendum.

1. Background and scope

You operate a store on the Service. To run it, we process personal information about your customers: names, email addresses, phone numbers, shipping and delivery addresses, order history, saved payment tokens, and loyalty accounts. You decide the purposes and means of that processing; we process it only to deliver the Service to you under the Terms.

This DPA governs that processing. It takes effect on the date your account is created and stays in effect for as long as we process that information.

2. Roles and instructions

For end-customer personal information, you are the controller (or, where an equivalent state law term applies, the business), and we are the processor (service provider).

We process that information only on your documented instructions, which are the actions needed to operate the Service: hosting your storefront, managing orders and inventory, calculating tax, dispatching deliveries, processing tokenized payments through your processor, emailing receipts you choose to send, and supporting you.

We will tell you if an instruction appears to us to violate privacy law, and we will not act on it while the question is open.

We will not process end-customer personal information for our own purposes, sell it, or retain or use it outside the direct business relationship with you.

3. Categories of data and processing

• Customer records you create or shoppers provide: name, email, phone, addresses, order history, notes, and tags.
• Payment references: opaque tokens, card brand, and last four digits issued by your payment processor. Full card numbers never reach our systems.
• Delivery details passed to dispatch partners for delivery orders: name, address, phone, and order contents as needed for delivery.
• Loyalty program data: account, points, and transaction history.
• Operations: audit logs and transaction records tied to your store.

4. Confidentiality and security

Our personnel who can access your data are bound by confidentiality obligations and access is limited to those who need it to do their jobs.

We maintain the security measures described in our Privacy Policy, including an isolated database per merchant, encryption in transit, tokenized card handling, and access controls. We update those measures as reasonably appropriate for the risk.

5. Sub-processors

We engage other companies, called sub-processors, to help deliver the Service. Each is bound by written obligations at least as protective as this DPA for the data it touches. Current sub-processors for end-customer data:

• Railway: hosting and the isolated database holding your store data.
• Clerk: shopper accounts and sign-in for storefronts that use accounts.
• Shipday: local delivery dispatch (customer name, address, phone, order details).
• EasyPost: shipping rate quotes (addresses).
• Google: address lookup for delivery distance checks (addresses).
• Ziptax: sales tax rates (ZIP codes).
• Resend: emailed receipts you choose to send (recipient email and receipt content).

6. Consumer requests and assistance

If one of your customers asks you for access to, deletion of, or correction of their information, you can handle most requests yourself with the tools in the Service, such as customer lookup, editing, and deletion. If you need our help with a request you cannot fulfill in the Service, send it to us and we will provide reasonable assistance.

We will not respond directly to your customers' requests; we will route them to you, because the customer relationship and the decision are yours.

7. Security incidents

If we learn of a confirmed breach of security that leads to the accidental or unlawful destruction, loss, or disclosure of your end-customer personal information processed by us, we will notify you without undue delay. The notice will describe what happened, what data was involved to the extent we know, what we are doing about it, and what you may need to do. We will take reasonable steps to contain and remediate the incident.

8. Deletion on termination

When your account terminates, we follow the Terms: your store data is kept for 30 days so you can export it, then permanently deleted. On your written request during that window we will delete earlier. We retain only what the law requires us to keep (such as transaction and billing records tied to legal obligations), and we keep it only for the period required, with processing limited to that purpose.

9. Audit rights

We make information about our security practices and sub-processors available on this site and will answer reasonable security questionnaires from current merchants.

If you have a good-faith security concern that published information does not address, contact us and we will work with you. Where state law entitles you to an assessment of our compliance with this DPA, we will satisfy it through that cooperation and our published documentation rather than on-site audits, unless we agree otherwise in writing.

10. United States state law terms

This DPA is intended to satisfy the processor and service provider contract requirements of the state privacy laws that apply to the Service, including the California Consumer Privacy Act as amended (for which we certify that we are a service provider: we do not sell or share the personal information, and we do not retain, use, or disclose it for any purpose other than performing the business purposes you instructed), and the processor contract terms of Colorado, Connecticut, Virginia, and Minnesota law.

If a law requires a specific additional term to make this DPA compliant that this document does not already contain, contact us and we will enter the required amendment.

Liability under this DPA is subject to the liability cap in the Terms, and this DPA is governed by the same governing law as the Terms.

11. Contact

Questions about this DPA: [email protected].