Data Processing Policy

1. Role & Relationship

When a merchant installs Buildora on their Shopify store:

• The merchant is the Data Controller — they decide which products to create pages for and what content to publish
• Buildora acts as a Data Processor — we process store and product data only on the merchant's behalf and per their instructions
• Shopify acts as a platform intermediary — facilitating the connection between the merchant and Buildora

2. Data We Process

2.1 Store Data

2.2 Customer Data

Buildora does not request, access, or store any end-customer data from your Shopify store. We do not access:

• Customer names, emails, or phone numbers
• Shipping or billing addresses
• Order history or purchase information
• Customer accounts or login credentials
• Payment or credit card information

3. Sub-Processors

We use the following third-party services to process data on your behalf:

4. Shopify Mandatory Webhooks

Buildora implements all Shopify-mandated compliance webhooks:

5. Data Security Measures

• Encryption in transit — all data is transmitted over TLS 1.2+
• Encryption at rest — Shopify access tokens encrypted with AES-256; database encrypted by Supabase
• Access control — Row Level Security (RLS) ensures users can only access their own organization's data
• Minimal scopes — we only request Shopify API scopes necessary for product and theme management
• No customer data — we do not request scopes that access customer, order, or checkout data
• Credential security — passwords hashed with bcrypt; tokens never logged or exposed in error messages

6. Cross-Border Data Transfers

Data processed through Buildora may be stored and processed in regions where our infrastructure providers operate (primarily United States). For EU/EEA/UK merchants, appropriate safeguards are in place through our providers' Standard Contractual Clauses (SCCs) and data processing agreements.

7. Data Breach Notification

In the event of a data breach that affects your data, we will:

• Notify affected merchants within 72 hours of becoming aware of the breach
• Provide details of the breach scope, affected data, and remediation steps
• Cooperate with Shopify and relevant authorities as required
• Take immediate steps to contain and remediate the breach

8. Merchant Rights

As a merchant using Buildora, you have the right to:

• Request an export of all data we hold for your organization
• Request deletion of all your data (subject to legal retention requirements)
• Disconnect your Shopify store at any time via Shopify admin
• Audit what data we process — contact us for a detailed data inventory
• Revoke access by uninstalling the app, triggering automatic data deletion

9. Contact & Data Protection Inquiries

For data processing inquiries, data access requests, or concerns about how we handle your data: