Last updated: October 29, 2026
This Data Processing Addendum is between the merchant who uses the DropStart app (the "Merchant", the controller) and Bizamatics, LLC, a Washington limited liability company doing business as DropStart, 601 W 1st Ave Ste 1437, Spokane, WA 99201, USA ("DropStart", the processor). It forms part of the terms of use of the DropStart app. The Merchant accepts it by accepting the terms of use; no separate signature is required.
- Subject matter and duration. DropStart processes personal data of the Merchant's customers ("Shopper Data") only to provide the app features the Merchant enables (digital-download delivery verification and AI store assistants), for as long as the Merchant uses them.
- Nature, purpose and data. DropStart reads order records from the Merchant's Shopify store: order identifier, status, line items and totals, and, only for features that need them and only when enabled, the customer's name, e-mail and shipping address. The data subjects are the Merchant's customers.
- Instructions. DropStart processes Shopper Data only on the Merchant's documented instructions (the features the Merchant turns on) and not for its own purposes, advertising, profiling or sale.
- Confidentiality. Personnel with access are bound by confidentiality. Access is limited to what the role needs and is logged.
- Security. Encryption in transit and at rest, access control and logging, separate storage for Shopper Data, daily encrypted backups, and an incident response plan.
- Sub-processors. The Merchant authorises the sub-processors listed at https://chat.dropstart.app/subprocessors. DropStart gives notice of changes and passes these obligations down to them.
- Assistance. DropStart helps the Merchant answer data-subject requests and honours Shopify's customers/data_request, customers/redact and shop/redact requests, normally within days and at most 30.
- Breach. DropStart notifies the Merchant without undue delay, and within 72 hours of confirming a breach affecting Shopper Data. Privacy matters: privacy@dropstart.app. Security matters and breach reports: security@dropstart.app.
- Return or deletion. On termination, or on a shop/redact request, DropStart deletes Shopper Data (it keeps none beyond 90 days) and the Merchant's Shopify credentials. Backups are daily and kept for 7 days, so deleted data leaves them within 7 days.
- Audit. DropStart makes available the information needed to show compliance and allows reasonable audits on notice.
- International transfers. Data is hosted in Google Cloud, region us-west1 (Oregon, USA), and stays in the United States.
- Governing law and venue. The laws of the State of Washington, USA; the courts of Spokane County, Washington.
Questions: privacy@dropstart.app.