Policies

Data Processing Addendum

Effective October 31, 2026

This Data Processing Addendum is part of the Merchant Terms. It is written to meet the service provider and processor contract requirements of US state privacy laws, including the California Consumer Privacy Act and similar laws in other states.

1. Roles

The store is the business (controller) for its customers' order information. 2Sides is its service provider (processor) for that information.

2. Purpose

2Sides processes customer data only to send review requests, publish reviews, show order facts to the people involved, run disputes, keep the platform secure, and as the law requires.

3. Limits

2Sides will not:

• sell the data, or share it for cross-context behavioral advertising;
• use it outside the purposes above, or outside its direct business relationship with the store;
• combine it with data from other stores or other sources, except as the law allows for these purposes;
• use it to train AI models.

2Sides will tell the store if it can no longer meet these obligations, and the store may take reasonable steps to stop unauthorized use.

4. Data types

Customer name and email, order number, products, dates, tracking events, delivery photos, refunds, returns, chargeback status, fraud analysis, reviews, responses and evidence files.

5. Staff

People at 2Sides who handle the data are bound by confidentiality and get access only as needed.

6. Subprocessors

Current subprocessors:

2Sides is in early access and is not yet processing live store data. Before it does, and before adding any new subprocessor, this list will be updated and stores will get 30 days' notice and a chance to object.

7. Security

2Sides uses encryption in transit and at rest, access controls, activity logs and digital fingerprints on uploaded files.

8. Breach notice

2Sides will notify the store without undue delay, and within 72 hours of confirming a breach affecting its data.

9. Privacy requests

2Sides will help the store respond to customers' access, correction and deletion requests, and will pass on requests it receives directly.

10. Shopify privacy requests

2Sides will complete Shopify's required customer data request, customer redaction and shop redaction requests within 30 days.

11. Retention and deletion

Review-request data is deleted 30 days after the last reminder if no review is posted. After a store uninstalls, its data is deleted within 30 days of Shopify's shop redaction request, except records 2Sides must keep for an open dispute or by law.

12. Audits

On reasonable request, 2Sides will provide information showing it meets this addendum.

Questions about this policy? Email info@get2sides.com.