Data Processing Agreement

Last updated October 2026.

This Data Processing Agreement ("DPA") forms part of the agreement between the merchant using the DueFox app ("Controller", "you") and Packsaddle Software, LLC ("Processor", "we"), governing how we process personal data on your behalf as a Shopify app provider. If your business is subject to the GDPR, UK GDPR, or similar data protection law, this DPA applies automatically by using the app — no separate signature needed, consistent with how most Shopify apps handle this. If you need a counter-signed copy for your own records, email support@packsaddlesoftware.com.

1. Subject matter and duration

We process personal data on your behalf for as long as DueFox is installed on your store, for the sole purpose of providing the app's functionality (wholesale account approval, invoicing, AR tracking, and related buyer communication). See our Privacy Policy for the full description of what's collected and why.

2. Categories of data subjects and personal data

• Data subjects: your wholesale buyer contacts (applicants and approved companies' contacts).
• Personal data processed: contact name, email, phone (optional), and order/invoice data tied to that contact (order totals, due dates, payment status, PO numbers). We never process payment card data — that stays entirely within Shopify's own checkout.

3. Our obligations as Processor

• We process personal data only to provide the app's functionality, on your instructions as expressed through your use of the app — never for our own independent purposes, and never for advertising.
• We keep personal data confidential and limit access to what's needed to operate and support the app.
• We use reasonable technical and organizational measures to protect it (encrypted connections in transit, access-controlled production infrastructure).
• We assist you in responding to data subject requests (access, deletion) — see the Privacy Policy's description of how the mandatory Shopify compliance webhooks handle this.
• If we become aware of a personal data breach affecting your data, we'll notify you without undue delay.
• We delete all app data tied to your store when Shopify sends the shop redact request, 48 hours after uninstall, as described in the Privacy Policy.

4. Sub-processors

We use three sub-processors, all strictly to operate the app:

• Shopify — the platform the app runs on; all store and order data passes through Shopify's API.
• Resend — sends payment reminder and notification emails on your behalf.
• Railway — hosts the app and the database where the data is stored.

We don't add a new sub-processor that materially changes how your data is handled without updating this page and, where required, giving you the opportunity to object.

5. International transfers

Our infrastructure and sub-processors may process data in the United States and other regions where they operate. Where this involves a transfer of personal data originating in the EEA, UK, or Switzerland, we rely on the data protection safeguards those sub-processors themselves maintain (Shopify, Resend and Railway each publish their own data processing terms covering this).

6. Your obligations as Controller

You're responsible for having a lawful basis to collect your wholesale buyers' data and for giving them any notices required under applicable law before they submit a wholesale application.

A note on this document

This DPA is a standard template covering how DueFox actually handles data, matching our Privacy Policy. It isn't a substitute for your own legal advice — if your business has specific compliance requirements, have your counsel review it alongside your use of the app.

Contact

Questions about this agreement: support@packsaddlesoftware.com.