Data Processing Addendum

Effective March 2, 2026 · Updated November 12, 2026

This Data Processing Addendum (“DPA”) applies between the Merchant (“Controller”) and SDG (“Processor”) for processing personal data through Wishlist Stack. Any separately executed agreement governs where its terms differ.

1. Scope and Purpose

Processor processes personal data to deliver the wishlist service on the Controller’s instructions, including authentication, list and group management, product hydration, sharing, imports, aggregate analytics, operational communications, and security.

2. Categories of Data

Merchant data: store and installation identifiers, Shopify session details, authentication credentials, contact details used for operational communications, and subscription and usage records.

Customer data: Shopify customer IDs, wishlist and group contents, notes, descriptions, custom properties, quantities, sharing settings, product metadata, activity timestamps, and data included in merchant uploads or Shopify privacy requests. Technical request information is also processed to deliver and secure the service.

3. Processor Obligations

Processor shall process data on instructions, ensure confidentiality, implement security measures, and not use the personal data for advertising or resale.

4. Service Providers and Subprocessors

• Vercel: application hosting, background processing, and private import-file storage.
• Neon: application database.
• Upstash: Redis caching and rate limiting.
• Cloudflare: DNS, content delivery, and traffic security.
• PostHog: app usage analytics and error monitoring, including customer and wishlist identifiers in feature events.
• Postmark: operational emails, including responses to merchant privacy requests.
• Netlify: this public marketing website; it is separate from application hosting.

5. International Transfers

Primary application and database infrastructure is in the United States; service providers may process information in other locations. Processor will implement Standard Contractual Clauses or equivalent safeguards where required.

6. Data Subject Rights Assistance

Processor will reasonably assist Controller with applicable data-subject requests, including Shopify’s customer-data request, customer-redaction, and shop-redaction workflows.

7. Deletion

Wishlist data is retained while the app is installed so merchants can provide the service. Uninstallation disables the installation and invalidates cached access; it does not immediately erase every record. Merchant-data cleanup is scheduled after Shopify sends its shop-redaction request, with safeguards against deleting a reinstalled store. Customer-redaction requests remove the relevant customer’s active wishlist records and related import data.

Unconfirmed import uploads have a 24-hour expiry. Confirmed imports have a seven-day retry window; source files are scheduled for deletion when an import completes, is canceled, or expires. Processing and cleanup retries can affect the time deletion finishes. Operational logs, telemetry, and managed backups follow their separate retention schedules; deletion from active app storage does not mean immediate removal from all backups.

8. Breach Notification

Processor will notify Controller without undue delay upon becoming aware of a personal-data breach.

9. Contact

For DPA inquiries, contact [email protected].