DPA

This Data Processing Addendum ("DPA") describes how Stackable processes personal data as part of providing the app to a merchant. It supplements our Terms of Service and Privacy Policy and applies to the limited personal data described below.

For any personal data that passes through Stackable in connection with your store (for example, via Shopify's mandatory compliance webhooks), you (the merchant) are the data controller and Stackable acts as your data processor, processing that data only on your instructions and as needed to provide the service.

Separately, for the limited account data Stackable holds about you as our customer (your shop domain, admin email, and staff names used for the in-app activity log), Stackable acts as controller in its own right, as described in our Privacy Policy.

The subject matter of processing is the provision of the Stackable discount app. Processing continues for as long as the app is installed on your store, and ends per the deletion timeline in our Privacy Policy's retention section (including the shop/redact deletion that follows uninstall).

• Computing and applying discount campaigns you configure, server-side, via Shopify Functions.
• Recording aggregate, order-level analytics (order ID, total, and which discount applied) so you can measure campaign performance.
• Responding to Shopify's mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact) on your behalf, as described in our Privacy Policy.
• Providing optional AI-assisted features (the campaign assistant and Scripts Rescue) by sending the merchant-provided input described in our Privacy Policy - a typed request, catalog names, or a pasted Script - to our AI sub-processors to generate draft campaign suggestions. This input is merchant business data, not storefront customer personal data.

See "Information we collect" and "What we do not collect" in our Privacy Policy for the full list. In short: shop-level and merchant-account data, discount campaign configuration, and order-total/discount-attribution analytics. We do not process storefront customer PII beyond the brief, automatically-purged raw webhook payload described there.

We use the following sub-processors to provide the service. This list is kept identical to the sub-processor list in our Privacy Policy:

Vercel

Hosting and infrastructure for the app and this website (United States).

Supabase

Managed Postgres database - stores the shop, campaign, and analytics data described above (United States region).

Shopify

The platform Stackable runs on - authentication, billing, and the storefront/checkout APIs the discount engine relies on (processed per Shopify's own global infrastructure).

Resend

Transactional email - sends contact-form and waitlist notifications (United States).

Google Analytics

Aggregate website traffic analytics on this marketing site, only after you accept analytics cookies - see our Cookie Policy (United States).

Google (Gemini API)

AI provider for the in-app campaign assistant and Scripts Rescue. When you describe a discount in the assistant, the text you type is sent to draft a matching campaign, along with catalog names from your store (collection titles, product tags, product titles) so the draft targets the right products. When you paste a Shopify Script into Scripts Rescue, the script text is sent so we can rebuild it as a matching campaign. We never send customer personal data - no names, emails, orders, or addresses (United States).

OpenAI

Fallback AI provider for the in-app campaign assistant and Scripts Rescue, used only if the primary provider is unavailable. Processes the same typed request and catalog names (collection titles, product tags, product titles), or the pasted Script text, no customer personal data (United States).

If we add or replace a sub-processor that processes personal data on your behalf, we will update the list above and note the change in our changelog. Continued use of Stackable after such an update constitutes acceptance of the new sub-processor.

Where a sub-processor processes data outside your jurisdiction (for example, in the United States), that transfer relies on the safeguards the sub-processor itself maintains, including Standard Contractual Clauses (SCCs) where applicable. We do not currently execute separate, per-merchant SCCs, but will provide them on request as our merchant base and legal obligations require.

See the "Security" section of our Privacy Policy for the technical and organizational measures we apply: encrypted connections, scoped database credentials, and access limited to the team members who need it.

Anyone with access to personal data under this DPA - our team and our sub-processors - is bound by confidentiality obligations covering that data, whether by employment agreement, contractor agreement, or the sub-processor's own terms with us.

If we become aware of a breach affecting personal data we process on your behalf, we will notify you without undue delay, and in any case within 72 hours of becoming aware of it, with the information we have available at that time. We will cooperate with you in good faith on any follow-up investigation or notification you are required to make.

We assist you in responding to data subject requests by handling Shopify's mandatory compliance webhooks directly, as described in our Privacy Policy, and by responding to any direct request you forward to us within a reasonable time.

This DPA remains in effect for as long as Stackable processes personal data on your behalf. On termination (uninstall), data is deleted per the retention schedule in our Privacy Policy.

Questions about this DPA? Email us - see the Contact page for our support address.