1. Parties and roles
This addendum is between you, the merchant who installs a Tidebird app ("Controller"), and [COMPANY LEGAL NAME] ("Tidebird", "Processor"). It applies when Tidebird processes personal data of your staff or your shoppers on your behalf under the GDPR, the UK GDPR, the Swiss FADP and US state privacy laws such as the CCPA. Terms like "personal data", "processing" and "sub-processor" have the meaning those laws give them.
2. Processing details
| Subject matter | Providing the Tidebird apps you install. |
|---|---|
| Duration | While the app is installed, plus the deletion period in section 7. |
| Nature and purpose | Hosting, storing and computing app data to run features such as gift offers and storefront widgets; support; security. |
| Data subjects | Your store staff; your shoppers where an app feature needs them. |
| Personal data | Staff name and email; shopper data an app feature needs [CONFIRM per app: Gift Lift processes cart contents only, no shopper identity]. |
| Special categories | None. Do not send special category data through the apps. |
3. Our obligations
- Process personal data only on your documented instructions, which are these terms and your app settings, unless the law requires otherwise; we will tell you if we think an instruction breaks the law.
- Make sure everyone with access is bound by confidentiality.
- Apply the security measures in the Annex.
- Help you answer data subject requests, including Shopify's customers/data_request and customers/redact requests, and help with impact assessments where reasonable.
4. Sub-processors
You authorise these sub-processors. We bind each one to data protection terms at least as protective as this addendum.
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud (Google Cloud EMEA Ltd. / Google LLC) | Hosting, database, file storage and logs for the apps | [REGION] |
| Google Analytics 4 (Google LLC) | Website analytics on tidebird.io only. App, merchant-customer and shopper data are not sent to Google Analytics. | United States |
Shopify is the platform you contract with directly and is not our sub-processor. We will post changes to this list here at least 30 days before a new sub-processor starts. If you object on reasonable data protection grounds and we cannot resolve it, you may uninstall the app.
5. International transfers
Where personal data leaves the EEA, the UK or Switzerland, the European Commission's Standard Contractual Clauses (Module 2, controller to processor) apply and are incorporated by reference, with the UK International Data Transfer Addendum and the Swiss amendments where relevant. Google LLC is also certified under the EU-U.S. Data Privacy Framework.
6. Personal data breaches
We will tell you without undue delay, and within [48] hours of becoming aware of a breach that affects your data, with what we know, the likely impact and what we are doing about it.
7. Deletion at the end
When you uninstall an app, Shopify sends us a shop/redact request 48 hours later. We delete your store's personal data within 30 days of it, including from backups as they expire, unless the law requires us to keep it.
8. Audits
On written request, once a year, we will answer reasonable security questionnaires and share relevant information, such as Google Cloud's certifications. On-site audits need 30 days' notice, happen at your cost and must not expose other customers' data.
9. US state privacy laws
For the CCPA and similar laws, Tidebird acts as your service provider. We do not sell or share personal information, keep it for any purpose other than providing the apps, or combine it with data from other sources except as those laws allow.
10. Liability and order of terms
Liability under this addendum follows the limits in the terms of service. If this addendum conflicts with the terms, this addendum wins on data protection, and the Standard Contractual Clauses win over both.
Annex: security measures
- Encryption in transit (TLS 1.2+) and at rest (Google Cloud default encryption).
- Access limited to staff who need it, with two-factor sign-in and least-privilege Google Cloud IAM roles.
- Shopify access scopes limited to what each app needs; tokens stored encrypted.
- Logging and monitoring of production systems; logs kept [30] days.
- Automated backups [daily, kept 7 days]; restore tested [quarterly].
- Dependency updates and security patches applied promptly.
Questions about this addendum: [privacy@tidebird.io].