Data processing addendum

1. Roles

For your shoppers’ personal data you are the controller and we are the processor. We process that data only on your documented instructions, which are: these terms, your configuration in the app, and the orders your store sends us. For your own account data — your email, your staff, your billing — we are the controller, and our privacy policy governs it.

If we ever believe an instruction of yours breaches applicable data protection law, we will tell you and may pause that processing.

2. Subject matter, duration, nature and purpose

3. Categories of personal data

Per order, read from your Shopify store through the Admin API:

• recipient name and company;
• shipping address — street lines, city, province or state, postal code, country;
• shipping phone number;
• order line items, quantities and SKUs.

We do not collect your shoppers’ email addresses. Since 15 October 2026 the Shopify order query no longer asks for the order email. An order imported before then may still hold it in the copy of the import kept while the order waits for confirmation; that copy is deleted when the order is confirmed or anonymised.

Since 15 October 2026 Shopify order webhooks are stored as the order’s ids only. Order webhook payloads stored before then contain the customer fields Shopify sent and are retained briefly (section 6).

We process no special-category data. Do not send us any, and do not place artwork orders that require us to process health, biometric or similar data.

4. Sub-processors

You authorise our use of the sub-processors below, named by category except for Google. We remain responsible for their performance. We will give reasonable notice before adding or replacing a sub-processor, and you may object on reasonable data-protection grounds — if we cannot resolve your objection, you may terminate.

You can ask for the current named list of our sub-processors at support@toolboxpod.com. Your Shopify store is your own platform, not our sub-processor: we read your orders from it and write products, fulfilments and tracking back to it on your instructions.

5. Security measures

• Encryption in transit: TLS on all traffic; the application sits behind a network tunnel and the database and file storage are not exposed to the public internet.
• Encryption at rest of the most sensitive secrets: Shopify Admin access tokens and outgoing webhook signing secrets are encrypted with AES-256-GCM using a key held outside the database. Other data is protected by the host, the network boundary and access controls rather than by application-level encryption.
• Access control: role-scoped (Owner, Manager, Viewer) and scoped to individual stores; every API key and client connection is individually revocable, and revocations are retained as an audit record.
• Auditability: an append-only event log of account, store, linking and order events, plus per-key API request logs.
• Incident response: a written procedure covering containment, credential revocation, log preservation, notification and post-incident review.

6. Retention and deletion

These are the retention periods in force today. If we change one, we update this page.

Compliance requests do not wait for these periods — a customers/redact or shop/redact from Shopify is always acted on.

An open order is never anonymised — we cannot ship to an erased address — and an open support request, claim or refund holds it too. It is anonymised automatically once those clear.

7. Assisting you with data subject rights

Shopify’s three mandatory compliance webhooks are the channel. On customers/data_request we assemble everything we hold about that shopper on that shop’s orders and present it to the store’s Owner and Managers inside the app, so that you answer your own customer; nothing is sent to the shopper by us. On customers/redact and shop/redact we erase as described in section 6.

If you receive a request we cannot answer that way, email support@toolboxpod.com and we will assist you, taking into account the nature of the processing and the information available to us.

8. Breach notification

We notify you without undue delay after becoming aware of a personal data breach affecting your shoppers’ data, with the information you need to meet your own notification obligations — what happened, when, which data and data subjects are affected, the likely consequences, and what we have done. As controller, your own regulatory clock (72 hours under the GDPR) runs from when we tell you.

9. Audit

On reasonable written notice, and no more than once a year unless a regulator or a breach requires otherwise, we will make available the information necessary to demonstrate compliance with this addendum and will contribute to an audit conducted by you or an independent auditor you appoint, subject to confidentiality and to the security of other merchants’ data.

10. International transfers

The application, its database and its file storage are hosted in the United States. Where personal data is transferred out of the UK, the EEA or another region with transfer restrictions, it is done under Standard Contractual Clauses (EU SCCs and UK IDTA/Addendum) for transfers of EU/UK personal data to the United States.

11. Return and deletion on termination

On termination you may export your order and design data from the app. After termination we delete or anonymise your shoppers’ personal data in line with section 6, retaining only what we are legally required to keep for accounting purposes.

12. Contact

support@toolboxpod.com, Toolbox Brands LLC, 426 E 1750 N Unit C, Vineyard, UT 84059, USA. See also our privacy policy and terms of service.