Data processing agreement: Vinyl Lettering Designer for Shopify

Version of 18 October 2026

This data processing agreement ("DPA") applies to every merchant who installs Vinyl Lettering Designer for Shopify ("the app"). It is part of the agreement for the use of the app and takes effect when the app is installed; no signature is needed. If you want a signed copy, write to [email protected].

1. Parties and roles

• Controller: the merchant who installs the app in their Shopify store ("you"). You decide why and how the personal data of your customers is processed.
• Processor: Twilper.com (KvK 98440217), Merelstraat 64, 8916 AX Leeuwarden, the Netherlands ("we"), the provider of the app under the brand Vinyl Lettering Designer. Contact: [email protected].

For data about you as our customer (store details, plan) we are the controller; see the privacy policy for the Shopify app.

2. Subject, nature, purpose and duration

Subject: providing the app, which adds a lettering designer to your product pages, calculates prices, adds designs to the Shopify cart and gives you the production files (SVG cut file; PDF print file on the Pro plan) for each order. Processing consists of receiving, storing, linking, displaying and deleting the data listed below, only for that purpose.

Duration: from installation until all data has been deleted after uninstalling (shop/redact, 48 hours after uninstall), or earlier deletion as described in section 9.

3. Data subjects and categories of personal data

Data subjects are the customers and visitors of your store who use the designer or order a design. Categories of data:

• Design data: texts, font, size, material, colour, quantity and the generated SVG/PDF files. Design text can contain personal data, for example a name on a sign.
• Order references: order name and ID, order date, payment and cancellation status, line quantities and prices.
• References from privacy requests: Shopify customer ID and data request ID, order IDs and design codes.
• A one-way keyed hash of the client IP address, used only for rate limits and only when a client IP is known. Requests through the Shopify app proxy carry no customer IP, so for those no IP hash is stored. The IP address itself is not stored (one exception during the one-time setup of a development store, see the privacy policy).

We do not store customer names, e-mail addresses, phone numbers or addresses. The app only requests protected customer data level 1. No special categories of personal data are requested; customers decide what they type in a design. The full table with purposes and retention periods is in the privacy policy.

4. Our obligations (GDPR Article 28(3))

• We process the personal data only on your documented instructions. Your instructions are this DPA, your settings in the app and your use of the app. If we believe an instruction infringes the GDPR or other data protection law, we tell you. If EU or Member State law requires us to process data otherwise, we tell you first unless that law forbids it.
• Everyone who has access to the data is bound to confidentiality. At present only the operator has access to production.
• We take the security measures in section 7.
• We only use sub-processors under the conditions in section 5.
• We help you, as far as possible with technical and organisational measures, to answer requests from data subjects (access, rectification, erasure, restriction, portability, objection). The Shopify privacy webhooks do most of this automatically, see section 9.
• We help you with security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to us.
• At the end of the service we delete the personal data as described in section 9, unless EU or Member State law requires storage.
• We make available all information needed to demonstrate compliance with Article 28 and allow audits as described in section 10.
• We do not sell the data and do not use it for our own purposes, marketing, profiling or automated decision-making.

5. Sub-processors

You give general authorisation for the following sub-processors:

The app itself sends no e-mail, so no e-mail provider receives your customers' data; notices under this DPA are sent from [email protected]. We impose on each sub-processor data protection obligations that offer at least the same protection as this DPA. We inform you at least 30 days before we add or replace a sub-processor, by updating this page and by e-mail to the contact address of your store. You may object within that period; if we cannot address the objection, you can uninstall the app, which ends the processing.

6. Hosting and transfers outside the EU

The app, its database and the design service run in the EU (Railway, region europe-west4, the Netherlands). We do not transfer personal data outside the European Economic Area ourselves.

Some sub-processors may process data outside the EEA as part of their service: Shopify (the platform you already use) and Google Fonts (the visitor's IP address with each font request). Cloudflare's edge network can also handle requests outside the EEA. These transfers take place under the European Commission's Standard Contractual Clauses (SCCs) in the sub-processor's data processing terms, or under an adequacy decision (such as the EU-US Data Privacy Framework for certified companies).

7. Security measures

Summary of our security policy:

• Minimum data: limited access scopes, protected customer data level 1 only, no customer contact details, client IP addresses only as a keyed hash, and only when one is known.
• Encryption in transit: TLS only. Service-to-service calls are signed with HMAC-SHA256, a timestamp and a single-use nonce.
• Encryption at rest: Shopify access and refresh tokens are encrypted at application level with AES-256-GCM.
• Signed, short-lived download links for production files and signed, short-lived upload and preview tokens.
• Webhooks verified with HMAC and deduplicated; storefront endpoints only reachable through the Shopify app proxy (signature checked), with request limits and rate limits. Per-IP limits apply only when a client IP is known (the app proxy does not pass the customer's IP); otherwise per-store limits and alerts apply.
• Database backups (daily, kept 6 days; weekly, kept 27 days).
• Test and production are separated; production data is never copied to development.
• Access to production only for the operator, with strong unique passwords, two-step verification and an audit log.
• Retention periods enforced by a daily job.

We may change the measures, as long as the level of protection does not go down.

8. Personal data breaches

If we become aware of a personal data breach that affects your data, we notify you without undue delay and in any case within 48 hours, at the contact e-mail address of your store. The notification describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed. We add information as it becomes available. This lets you meet your own 72-hour obligation under Article 33 GDPR. We record every breach.

9. Retention, deletion and privacy requests

• Designs that are never ordered: deleted after 31 days. Ordered designs, their files and order references: deleted 365 days after the order.
• Privacy request references: at most 90 days. Erasure jobs: 30 days after completion. Hashed IP rate-limit data: 2 days.
• customers/data_request: the app lists the orders, design summaries and files it holds for the requested orders, so you can export them for the customer.
• customers/redact: we delete the order references, design summaries, designs and files for the requested orders in both services (an identical design that is also part of another customer's order keeps its data for that order).
• shop/redact: on uninstall the access tokens are deleted immediately; 48 hours later we delete everything we hold for your store, in both services.
• Backups roll over within 27 days, after which deleted data is also gone from the backups.

The complete table is in the privacy policy. If you need data deleted earlier, write to us.

10. Information and audits

On request we give you the information you need to check that we meet this DPA, such as this page, the security policy and answers to written questions. You, or an independent auditor bound to confidentiality, may carry out an audit once a year, or after a breach, with at least 30 days' notice and during office hours, in a way that does not disrupt the service or expose other customers' data. Each party bears its own costs. We have no external certifications so far.

11. Liability, changes and law

• Liability under this DPA follows the terms that apply to the app and Article 82 GDPR.
• We may update this DPA, for example when the law or the app changes; material changes are announced at least 30 days in advance. The version date is at the top.
• If this DPA conflicts with other terms of the app on the processing of personal data, this DPA prevails.
• Dutch law applies. Disputes go to the competent Dutch court, unless mandatory law says otherwise.

Contact

Questions about this DPA or about your data: [email protected].