Shopify Data Processing Addendum

1. When this addendum applies

This addendum is part of the Stackado Terms of Service. It applies when you connect a Shopify store to Stackado, either with Connect in the Stackado app in Shopify or with Start with Shopify.

You accept it by ticking the box when you connect, or by selecting Start with Shopify. We record the version you accepted and when.

Stackado here means the provider named in the Stackado Terms of Service. Stackado is a brand operated by Micki Kristensen, Allegade 1 E, 1. th, 8700 Horsens, Denmark. This is the person you contract with when you use Stackado. You means the merchant who owns the connected store.

2. Who decides and who processes

For your shoppers' personal data, you are the controller and Stackado is your processor. You decide which features to turn on. Those settings are your instructions to us.

You give your shoppers the privacy notices your law requires, and you stay responsible for your relationship with them.

3. What we process and why

• Your store's products, prices, availability, policies and pages, so your storefront chat can answer shoppers and your website can show your products.
• Shopper order details, read from Shopify when a shopper asks about their own order (Shopify gives apps the last 60 days of orders). Signed-in shoppers are matched by their Shopify customer ID. Guests must give the exact email and order number first.
• A list of your store's orders (number, dates, status, totals and items, with the buyer's name and email encrypted), starting with the last 60 days when you connect and then each new order, so you can see what sold and who bought it. We keep it while your store is connected.
• Shopper names and email addresses, for customer service, for your own sales and customer insights in Stackado, for your customer timeline, and for review requests you approve.
• Order totals by day, so your accounting app can record your store's sales.
• We do not request shopper addresses or phone numbers.

4. What we never do

• Shopify data is never used to train AI models. Stackado does not use data from a connected Shopify store — products, orders, customers, conversations, or anything derived or aggregated from them — to develop, train or improve any AI or machine-learning model. We send it to AI model providers only to produce the answer, summary or draft you asked for, under provider terms and settings that do not allow them to train on it.
• We never sell Shopify data.
• We never send marketing to a shopper who has not agreed to marketing in Shopify.
• We never change your store without your approval. Store edits need your permission in Shopify, and you approve each change.

5. AI and service providers

To answer a question, we send only the data that question needs to an AI model, and only to produce that answer.

We use these providers to run the service. Each is bound to confidentiality, and none may train on your data. We will tell you before we add a provider that processes your shoppers' personal data.

• Supabase: databases that store connection records, the encrypted order list and support conversations.
• Vercel: hosting for Stackado and its apps.
• Upstash: short-lived caches and rate limits.
• Pinecone: the search index behind the store chat's product knowledge.
• Clerk: sign-in and team accounts.
• Resend: notification emails to the merchant.
• OpenRouter and the AI model providers it routes to, OpenAI and Anthropic: AI models that write the answers and summaries you ask for.

6. Security

• Shopify access tokens are encrypted and stay inside Stackado's integration service. Other Stackado apps never receive them.
• Only people who need access to run or support the service get it, with individual accounts.
• If we learn of a security incident that affects your data, we tell you without undue delay, and we help you meet your own notice duties.

7. Shopper requests

When a shopper asks Shopify for their data or for erasure, Shopify tells us. We prepare the data report for you to download in Stackado, or we erase the shopper's data across Stackado.

We prepare a report as soon as Shopify asks, and we show it in Stackado with the date it is due (30 days after the request). If a shopper contacts us directly, we pass the request to you. You can also reach us at hello@stackado.com for help with any request.

8. How long we keep data

• We keep store and shopper data while your store is connected and you use the features that need it.
• Encrypted copies of the messages Shopify sends us expire after 30 days unless erased sooner.
• When you uninstall the app, Shopify asks us to erase the store's data, and we do.
• You can ask us to return or erase your data at any time, unless the law requires us to keep it.

9. Changes and contact

If we change this addendum, we publish a new version here and ask you to accept it before it applies to you.

Questions: email hello@stackado.com.