Data processing terms
These terms apply whenever a merchant uses OrderSpec and form part of the agreement to use the app. Plain language is intended; where a law requires a specific term, that term applies.
1. Roles
The merchant decides what personalisation their shoppers can enter and how orders are handled; the merchant is the controller. We process order data only to provide OrderSpec; we are the processor.
2. What we process and why
The categories of data, purposes and retention are those listed in the privacy policy, which is incorporated here. We process nothing else. We do not process shopper identity data (names, emails, phone numbers, addresses); the personalisation a shopper types is the only shopper data we handle.
3. Instructions
We act only on the merchant's instructions, which are given by installing and configuring the app. We will not use order data for any other purpose, including training AI models, and we will not sell it.
4. Sub-processors
The providers listed in the privacy policy (Vercel, Neon, Inngest, Anthropic, and jsDelivr for PDF fonts) process data on our behalf under their own contractual commitments. We will update the list on that page before adding a provider; merchants who object may uninstall, which deletes their data.
5. Security
TLS in transit, encryption at rest, signed webhooks, server-side secrets, and no personalisation text in logs. Access to production systems is limited to the people who operate the service.
6. Assistance
We respond to Shopify's standard privacy webhooks automatically: an erasure request deletes every order it lists, and a data request records in History which listed orders we hold so the merchant can answer the shopper. Direct merchant requests go to tmanon007@gmail.com within 30 days.
7. Breach notification
If we become aware of a breach affecting a merchant's data we will tell that merchant without undue delay, with what we know and what we are doing.
8. Deletion
On uninstall, and again on Shopify's redaction request, all data we hold for the merchant's store is deleted. Field rules the app saved on the merchant's own Shopify store stay there. Fulfilled and cancelled orders are deleted 90 days after completion in any case.
9. Transfers
Data is processed in the United States by the sub-processors above. Where a merchant's law requires safeguards for such transfers, the sub-processors' standard contractual terms apply.
10. Contact
MD Tariqul Islam Manon, trading as Web-Pex, 102/1, East Basabo, Dhaka, 1214, Bangladesh · tmanon007@gmail.com