1. Roles
The merchant is the controller (or "business") of the personal data its store and its customers provide through an App. Dixon App Studio is the processor (or "service provider") and processes that data only to provide the App to the merchant, on the merchant's documented instructions. Installing the App, choosing its settings and using its features are those instructions. If we think an instruction breaks data protection law, we will tell the merchant.
2. Scope, purpose and data
We process data only to run the App's features for the merchant's store, to apply its plan limits, to answer support requests and to meet Shopify's requirements. We never sell or rent it, share it for advertising, use it to build profiles, or combine it with data from other stores. What each App processes:
Spanwise: Coverage Calculator
Shopify access: read_products, write_products
Data: The store's myshopify.com address and access token, the coverage rules the merchant saves, and anonymous daily counters per product (calculator uses, add-to-carts, units). No customer or shopper personal data.
Retention: Counters are deleted after 400 days; the token at uninstall; everything else at shop/redact. Full privacy policy
Cratebird: Reorder & POs
Shopify access: read_products, read_inventory, write_inventory, read_locations, read_orders
Data: The store's address, name, currency and access token; suppliers the merchant enters (company name, order email address, lead time, notes); purchase orders and receipts; order line quantities (order ID, date, variant ID, quantity, never the customer); settings and the digest email address.
Retention: Order line quantities and daily digests are deleted after 100 days; suppliers and purchase orders when the merchant deletes them or at shop/redact; the token at uninstall. Full privacy policy
Gaugely: Part Size Finder
Shopify access: read_products, write_products
Data: The store's address and access token, a size index of the store's own products, the merchant's mapping settings and anonymous daily counts of sizes searched. No customer or shopper personal data (the logged_in_customer_id Shopify adds to storefront requests is ignored).
Retention: Search counts are deleted after 400 days; the token at uninstall; everything else at shop/redact. Full privacy policy
Quotewell: B2B Quotes
Shopify access: read_products, write_draft_orders
Data: Quote requests buyers send from the storefront: name and email (required), and the company, phone and message the buyer chooses to add, with products and quantities; the quote the merchant builds and the ID of the draft order made from it; the store's address, access token and settings.
Retention: A quote is deleted 180 days after it is accepted or expires, and an unanswered request after 180 days; customers/redact deletes every quote with that buyer's email; the token at uninstall; everything else at shop/redact. Full privacy policy
Data subjects are the merchant's staff and, for Quotewell, the buyers who send quote requests, and for Cratebird, the supplier contacts the merchant enters. None of the Apps processes payment card data or special categories of personal data.
3. Sub-processors
- Cloudflare, Inc. (Workers and D1): hosts every App and stores its data. All four Apps.
- Shopify: the platform the Apps run on. It delivers webhooks, handles plan billing (we never see card details) and, for Quotewell, emails the draft order invoice to the buyer.
- Resend (email delivery): Cratebird only, and only if email delivery from the app is turned on. By default Cratebird sends no email; a purchase order opens in the merchant's own email app.
Each sub-processor is bound by its own data processing terms with protections at least as strong as this DPA. We will update this list and its date at least 30 days before adding a new sub-processor; a merchant that objects can uninstall the App, which deletes its data as described below.
4. Confidentiality and access
Only the developer at Dixon App Studio has access to the Cloudflare account that holds App data, protected by two-factor authentication, and accesses data only to run the App or answer the merchant's support request. Each store can reach only its own data.
5. Security measures
- Data is stored in Cloudflare D1, encrypted at rest, and all traffic uses HTTPS (TLS).
- Every admin request is authorised by a verified Shopify App Bridge session token for that store; every webhook is checked against Shopify's HMAC signature; storefront requests to Quotewell and Gaugely must carry a valid Shopify app-proxy signature.
- Shopify access tokens never leave the server and are deleted at uninstall.
- Each App stores only the data listed in section 2; Quotewell's request form drops every field other than those listed.
- Test and development stores are kept apart from production data.
6. Data subject requests
Each App answers Shopify's mandatory privacy webhooks. customers/data_request: Quotewell reports the quotes held for that email; the other Apps hold no customer data and confirm that. customers/redact: Quotewell deletes every quote with that buyer's email; the other Apps have nothing to delete. We will help the merchant with any other request from a data subject within 30 days of the merchant emailing support@dixonappstudio.com, and pass on any request we receive directly.
7. Deletion and return
On uninstall the App deletes its Shopify access token at once. When Shopify sends shop/redact (48 hours after uninstall) the App deletes every record it holds for that store. Before uninstalling, a merchant can delete individual records in the App (for example a quote, supplier or rule), export what the App offers (for example Quotewell's CSV on the Plus plan), or email us for a copy of the store's data. Data a merchant chose to save into its own Shopify store (such as Spanwise rule metafields) stays there until the merchant deletes it.
8. Personal data breach
If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to the merchant's personal data, we will notify the merchant by email at the address on its Shopify account without undue delay and within 72 hours, describe what happened, the data affected and the steps taken, and help the merchant meet its own notification duties.
9. International transfers
Dixon App Studio is in the United States and Cloudflare processes data on its global network, so personal data from the European Economic Area, the United Kingdom or Switzerland may be processed outside those regions. For those transfers the parties agree to the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), incorporated by reference, with the merchant as data exporter and Dixon App Studio as data importer; Clause 7 (docking) applies, Clause 9 option 2 (general authorisation, 30 days' notice) applies, Clause 11's optional wording does not, and Clauses 17 and 18 are governed by and resolved in Ireland. Annex I is section 2 of this DPA, Annex II is section 5 and Annex III is section 3. For UK transfers the UK International Data Transfer Addendum applies, and for Swiss transfers references to the GDPR are read as the Swiss FADP.
10. Audits and information
We will answer a merchant's reasonable written questions about how its data is processed and give the information needed to show compliance with this DPA, once a year or after a breach.
11. Term and precedence
This DPA lasts while we process the merchant's data through an App. If it conflicts with the Terms of Service or a privacy policy, this DPA wins on personal data, and the Standard Contractual Clauses win over both where they apply. We may update this DPA to reflect changes in an App or the law; the date above changes when we do, and we will not reduce the protections in it.
12. Contact
DixonAppStudio LLC, South Carolina, USA · support@dixonappstudio.com