Data Processing Addendum

Roles and instructions

The merchant is the controller or business responsible for its customer data, and Bliss acts as its processor or service provider. Bliss processes personal data only to provide, secure, support, and maintain Production Guard, on the merchant's documented instructions, or as required by law. Shopify remains subject to its own terms with the merchant.

Processing details

Processing covers order and line identifiers, product and variant identifiers, SKU and titles, quantities, line-item custom attributes, fulfillment relationships, assigned locations, and app-owned hold information. Custom attributes can contain personalization text. The app does not request buyer names, email addresses, phone numbers, postal addresses, or payment details. Processing lasts while work is open and for the retention periods described in the Privacy Policy.

Confidentiality and security

Bliss restricts access to authorized personnel, uses Shopify-authenticated roles, separates each merchant's data, encrypts data in transit, relies on encrypted managed storage, records security-relevant actions, minimizes diagnostic data, and maintains deletion and recovery controls appropriate to the service.

Personnel

Bliss limits personal-data access to people who need it to operate or support the service and who are subject to confidentiality duties. Bliss remains responsible for directing those people to process data only for the purposes described in this Addendum.

Subprocessors and transfers

Bliss uses Shopify to provide commerce and authorization data and Railway to host the app and PostgreSQL database. The merchant authorizes those subprocessors for the described service. Bliss will require subprocessors to protect personal data and will remain responsible for its obligations under this Addendum. Data may be processed where these providers operate, subject to their applicable transfer safeguards.

Bliss will provide reasonable notice of a material new subprocessor through the service or merchant contact information. A merchant with a reasonable data-protection objection may contact Bliss before the change takes effect so the parties can seek a practical resolution.

Requests, incidents, and assistance

Bliss will reasonably assist the merchant with customer privacy requests, security inquiries, and legally required assessments relating to the service. Bliss will notify the merchant without undue delay after confirming a personal-data breach affecting merchant data and will provide available information needed for the merchant's response.

Compliance information

On reasonable request, Bliss will provide information necessary to demonstrate compliance with this Addendum. Any review must protect other merchants' confidentiality and avoid unreasonable disruption. Each party is responsible for complying with the laws that apply to its role. Bliss does not sell merchant personal data or use it for cross-context behavioral advertising.

International transfers

If applicable law requires a transfer mechanism for personal data processed outside its originating jurisdiction, the parties will use the legally recognized mechanism that applies to the transfer, including applicable standard contractual clauses, and will cooperate on reasonably necessary supplementary measures.

Deletion and return

Production Guard handles Shopify's mandatory customer and shop redaction requests. Personalization is minimized after completed work and snapshots expire according to the Privacy Policy. On uninstall or a valid deletion request, tenant-owned data is deleted or de-identified except where limited retention is required by law or necessary to document the deletion itself.

Contact

Send data-protection questions or requests to hello@blissits.com. Also review the Merchant Terms and Privacy Policy.