---
title: GDPR Compliance for Shopify Merchants
description: How Tacey processes personal data under the GDPR: lawful basis, data subject rights, transfers and retention, for Shopify merchants in the EU.
canonical: https://tacey.app/gdpr
---
# GDPR Compliance for Shopify Merchants

**Last updated: 2026-09-02**

## 1. Our commitment and the scope of this page

Tacey is an order-editing and address-validation app for Shopify. In plain terms: we check the shipping address on every order a merchant receives, let the merchant’s customer fix that address themselves (or make a small edit to their order) on Shopify’s own order-status page, and keep a record of what changed and whether any money moved.

Doing that job well means we handle personal data, shipping addresses, order details, and email addresses, that belongs to real people who never signed up for Tacey directly. This page explains, in one place, what we do with that data, why, for how long, who else sees it, and what rights the people it concerns can exercise.

This page covers:

- **Shopper data**, the personal data of a merchant’s customers that reaches Tacey because their order was checked or edited.

- **Merchant account data**, the personal data of the merchant themselves (an owner’s name, a business email address, a store’s country and timezone) that Tacey collects when the app is installed.

- **Website and marketing data**, the personal data of anyone who visits `tacey.app`, requests a demo, or subscribes to updates from us.

It does not restate our Privacy Policy or Terms of Service in full; where this page and those documents overlap, this page is the more detailed technical and legal account, written for merchants, their customers, and anyone conducting a data-protection or security review.

Tacey is built and operated by ONDUTYOPS LLC, a Delaware limited liability company with a registered address at Coastal Highway, Lewes, Delaware 19958, United States, the developer of record for the Tacey app on the Shopify App Store.

## 2. Who we are and how to contact us

Tacey is built and operated by ONDUTYOPS LLC, the developer of record for the Tacey app on the Shopify App Store, with a registered address at Coastal Highway, Lewes, Delaware 19958, United States.

For any question about this page, a data-subject request, or a security review, contact:

- **Email:** hello@taceysupport.app (routes to our support inbox; see Section 9 for response times).

- **Help centre:** help.tacey.app

We do not yet have a dedicated Data Protection Officer.

## 3. Our two roles: controller and processor

Under GDPR, the same company can be a controller in one relationship and a processor in another, and Tacey is exactly that split:

**We are a PROCESSOR when it comes to shopper data.** When a merchant installs Tacey, they decide to check their orders’ addresses and let their customers edit them. We act on the merchant’s instructions: we validate the address they send us, we let their customer make the edit they authorised, and we do not decide, on our own initiative, what to do with a shopper’s data beyond running the service the merchant configured. The merchant is the **controller** of their own shoppers’ personal data, the same relationship that exists between a merchant and Shopify itself.

**We are a CONTROLLER for the data we collect about the merchant’s own business**, our website visitors, and anyone who contacts us directly. When a merchant installs Tacey, we collect account information about that merchant (Section 6) to run their billing, support them, and communicate with them about the service, decisions about that data are ours to make, subject to this page and our Privacy Policy.

**We are a CONTROLLER for our own website and marketing activity**, `tacey.app` visitors, demo requests, and anyone who subscribes to updates from us directly (not through a merchant’s store).

**Shopify is a separate, independent controller and processor relationship, and Shopify’s own compliance does not transfer to us.** A merchant who has satisfied themselves that Shopify is GDPR-compliant has not thereby satisfied themselves that any app installed on their store, including Tacey, is. Each app a merchant installs is its own processor relationship, with its own data flows, its own subprocessors, and its own obligations. This page exists precisely because that distinction matters.

## 4. Our Article 28 processor obligations

Where we act as a processor for a merchant’s shopper data, Article 28 GDPR requires us to:

- Process personal data **only on the merchant’s documented instructions**, which, in practice, means only in the ways the merchant configured Tacey to behave (which countries to validate, whether customers can edit line items, how long the edit window stays open) and never for our own separate purposes.

- Ensure the people who process this data on our behalf (our own personnel, and the subprocessors listed in Section 13) are bound to confidentiality.

- Implement appropriate technical and organisational security measures (Section 16).

- Engage subprocessors only with the merchant’s general authorisation, and give merchants the ability to object to a new subprocessor (Section 13).

- Assist the merchant in responding to data-subject rights requests (Section 8, Section 9) and in meeting their own Article 32–36 obligations (security, breach notification, impact assessments) to the extent the request relates to Tacey’s processing.

- Delete or return all personal data at the end of the relationship, subject to any legal retention requirement, described concretely in Section 14 and Section 15, including the one honesty gap we are not papering over.

- Make available the information necessary to demonstrate compliance with these obligations, and allow for audits (Section 18).

These obligations are ordinarily formalised in a signed Data Processing Agreement between Tacey and each merchant. Section 21 states where that document stands today.

## 5. Lawful bases for processing

The lawful basis differs depending on whose data it is and in what capacity we are processing it.

**Shopper data (we are the processor):** the merchant, as controller, establishes their own lawful basis for processing their customers’ data (typically **performance of a contract**, fulfilling the sale, or **legitimate interests** in operating their store efficiently and preventing misdelivered orders). Our processing is lawful because it is carried out under the merchant’s instructions and documented processor agreement, per Article 28(3).

**Merchant account data (we are the controller):** we process this under **performance of a contract**, we cannot provide the Tacey service, bill for it, or support a merchant without their account and business details.

**Website and marketing data (we are the controller):** where someone requests a demo or subscribes to updates, our basis is **consent** for marketing communications, and **legitimate interests** for operating the site itself (security logging, abuse prevention) and responding to direct enquiries.

**Emails sent to a shopper about their own order (we are the processor):** these are transactional, not marketing, a confirmation that an order was edited, or a reminder that an edit window is closing. The lawful basis for sending them sits with the merchant’s own basis for the underlying order relationship; we send them because the merchant instructed us to, as their processor.

## 6. The categories of data we process and where it comes from

We deliberately hold less than most apps in this category, because our job is narrower than most apps in this category.

| CATEGORY | WHAT IT IS | WHERE IT COMES FROM | ROLE WE PLAY |
| --- | --- | --- | --- |
| **Shipping addresses** | Street, city, state/region, postal code, country of an order’s shipping address | The Shopify `orders/create` webhook | Processor |
| **Order metadata** | Order number, line items, quantities, totals, currency, fulfillment status | The Shopify `orders/create` webhook and Admin API reads | Processor |
| **Customer email address** | The shopper’s email, used to send them a link to check or edit their order | The Shopify order payload | Processor |
| **Raw order webhook payloads** | The complete, unmodified JSON Shopify sends for `orders/create`, archived for reprocessing | Shopify webhook delivery, archived to Cloudflare R2 | Processor |
| **Merchant account data** | Owner name, business contact email, store name, shop domain, country, city, business phone, currency, timezone, locale, Shopify plan | The Shopify OAuth install flow (shop address, shop settings) | Controller |
| **Usage and analytics events** | App installs, feature usage, error diagnostics, keyed to the shop, never to a shopper | Our own application code | Controller |
| **Website and marketing data** | Name, email, company, and anything submitted through a contact or demo-request form | Directly from the visitor | Controller |

**We never see or store payment card data.** Shopify handles payment entirely, end to end, card numbers, CVVs, and payment tokens never reach any Tacey system. This is a genuine and significant reduction in scope compared to a typical checkout or payments app, and it takes an entire category of regulatory obligation (PCI DSS) off the table for us.

**Addresses sent to our validation vendors carry no name or email.** When we call Google’s Address Validation API or Geocodio to check a shipping address, we send only the address fields, street, city, state, postal code, country, never the customer’s name or email address alongside it. Those vendors validate a string of address text; they do not receive a profile of the person who typed it.

## 7. Special category data and criminal offence data

**We do not process any special category data** (Article 9: data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, or data about a person’s sex life or sexual orientation), and we do not process criminal offence or conviction data (Article 10).

Nothing in Tacey’s design asks for, infers, or stores any of these categories. A shipping address and an order line item are the entirety of what the product needs, and that is the entirety of what it collects.

## 8. Your data subject rights

If GDPR (or an equivalent regime, per Section 20) applies to you, you have the following rights over your personal data:

- **Access**, to be told whether we (or, where the merchant is the controller, whether the merchant, with our help) hold your personal data, and to receive a copy of it.

- **Rectification**, to have inaccurate personal data corrected.

- **Erasure** (“right to be forgotten”), to have your personal data deleted, subject to any legal ground we or the merchant may have to keep it.

- **Restriction of processing**, to limit how your data is used while a dispute about it is resolved.

- **Data portability**, to receive certain data in a portable format, where the processing is based on consent or contract and carried out by automated means.

- **Object**, to object to processing based on legitimate interests, and to object to direct marketing at any time, with no justification required.

- **Rights related to automated decision-making**, see Section 10, which explains why this does not currently apply to Tacey’s address-validation logic.

- **Withdraw consent**, where processing is based on consent, at any time, without affecting the lawfulness of processing before the withdrawal (Section 11).

- **Lodge a complaint** with a supervisory authority (Section 19).

**If you are a shopper** whose order was processed by a merchant using Tacey, the merchant is your primary point of contact for exercising these rights, because they are the controller of your data. We support them in fulfilling your request, see Section 9 and Section 14 for exactly how.

**If you are a merchant**, or a website visitor, you can exercise these rights against us directly, as the controller of your account or website data.

## 9. How to exercise your rights and our response times

**Shoppers:** contact the merchant whose store you ordered from, they are the controller of your data and the right party to handle your request. If a merchant asks us for help fulfilling a shopper’s request, we respond promptly; in practice, the three Shopify-mandated privacy webhooks (Section 14) already automate most of this without either of us filing a manual request.

**Merchants and website visitors:** submit a request at [tacey.app/privacy-request](/privacy-request), or email hello@taceysupport.app. We confirm the email address a request came from before acting on it. We aim to acknowledge every request within a reasonable time and to respond substantively **within one month**, as GDPR Article 12(3) requires, extendable by a further two months for complex or numerous requests, with notice to you if that extension is needed.

## 10. Automated decision-making

**Tacey does not carry out automated decision-making that produces legal effects or similarly significantly affects a person, within the meaning of Article 22.**

Address validation produces a verdict **about an address**, not about a person, “verified”, “corrected”, or “could not be checked”. It never blocks a purchase, never denies service, and never decides anything about the shopper themselves. If a validation vendor is slow or unavailable, the order proceeds exactly as if no check had been run at all, the absence of a working validator produces no adverse outcome for anyone.

Any actual change to an order, an address correction, a line-item swap, a cancellation, is made by a **human**: the shopper themselves, confirming a change on Shopify’s order-status page, or the merchant, acting in their admin. Tacey never edits an order on its own initiative. No money moves without an explicit human confirmation, on either side.

If this changes in a future version of the product, this section will be updated before that change ships, not after.

## 11. Consent and how to withdraw it

Where we rely on consent, principally, marketing communications to merchants or website visitors who opted in, you can withdraw it at any time:

- Every marketing email includes an unsubscribe link.

- You can email hello@taceysupport.app to opt out directly.

Withdrawing consent does not affect the lawfulness of any processing carried out before the withdrawal, and it does not affect **transactional** messages (order-edit confirmations, security notices) that are not based on consent in the first place (Section 5).

We do not rely on consent as the lawful basis for shopper-facing order-edit emails; those are sent under the merchant’s instruction as part of fulfilling the order relationship (Section 5).

## 12. International data transfers and the safeguards we rely on

Tacey’s infrastructure and every subprocessor we use today is operated by a company headquartered in the **United States**. If you are located in the EU, the UK, or another jurisdiction with its own transfer restrictions, your personal data will typically be transferred to and processed in the United States (and, for our infrastructure provider Cloudflare, potentially at edge locations in other countries as part of its global network).

Where such a transfer requires a safeguard under GDPR (Chapter V) or UK GDPR, we rely on the **EU Standard Contractual Clauses (SCCs)** (and, for the UK, the **UK International Data Transfer Addendum**), incorporated into our agreements with each subprocessor, or on the subprocessor’s own certified mechanism (e.g. participation in an approved framework) where applicable.

We do not currently transfer any personal data outside of our subprocessors’ own infrastructure, we do not operate our own servers in any other country, and Cloudflare’s product set (Workers, D1, R2, KV, Queues) is what our application runs on.

## 13. Subprocessors and your right to object

A subprocessor is a third party we engage to help deliver the Tacey service. The full, current list, what each one does, what data it receives, and where it is located, is published on our dedicated **Subprocessors page**, rather than gated behind an access request. We believe merchants and their customers are entitled to see this without having to ask.

**We engage each subprocessor under a written agreement** that requires them to protect personal data to a standard consistent with our own obligations under Article 28.

**Your right to object:** if we intend to add a new subprocessor, or replace an existing one, we will update the Subprocessors page and notify merchants in advance (the notice period and mechanism are detailed there). If a merchant reasonably objects to a new subprocessor on data-protection grounds, we will work with them in good faith to address the objection, which may include not proceeding with that subprocessor for their account, or, if the concern cannot be resolved, allowing the merchant to terminate the affected service without penalty.

## 14. The Shopify mandated data lifecycle and deletion timelines

Every public Shopify app must implement three mandatory privacy webhooks. Tacey implements all three:

- **`customers/data_request`**, triggered when a shopper asks a merchant what data is held about them. We do not contact the shopper directly (Shopify API Terms Section 6.2 prohibits an app from contacting a merchant’s customers by default, and we honour that), instead, we count and log what we hold for that customer so the merchant can fulfil the request themselves.

- **`customers/redact`**, triggered when a shopper’s data should be erased (typically at the merchant’s request, or automatically for customers who have had no order activity for a defined period). This **deletes** the customer’s rows from our address-validation and address-cache tables.

- **`shop/redact`**, triggered by Shopify approximately **48 hours after a merchant uninstalls Tacey**. This **deletes** every row scoped to that shop across our database, and sweeps the merchant’s archived raw order payloads out of our object storage.

**What “deletes” means concretely, and the one gap we are naming rather than hiding:** our deletion process removes the merchant’s database rows across every shop-scoped table, and separately sweeps the archived webhook payloads from object storage. That storage sweep returns one of three outcomes: it deletes a specific number of objects, it correctly reports zero objects existed, or, if the storage connection itself is unavailable at the moment of erasure, which is a configuration failure rather than a normal outcome, it **cannot attempt the sweep at all**, and that failure is distinguished from “nothing to delete” and logged loudly rather than reported as success.

We are stating this plainly because a deletion commitment that glosses over its own failure mode is worse than no commitment. In the rare case where that storage connection is unavailable, the database rows are still deleted in full, only the archived raw payloads could be affected, and the failure is never silently reported as a successful erasure. Closing this gap entirely (so a sweep can never simply fail to run) is tracked as an engineering priority ahead of a merchant relying on this page in a compliance audit.

## 15. Data retention

- **While a merchant has Tacey installed:** shopper order and address data is retained for as long as it is needed to provide the service, principally, for the life of the order’s edit window, and for a limited period after to support the merchant’s own record-keeping and dispute resolution needs.

- **Archived raw order payloads:** retained only for as long as needed to support reprocessing (for example, if a validation run needs to be retried), and erased on uninstall as described in Section 14.

- **Merchant account data:** retained for as long as the merchant has Tacey installed, and erased on `shop/redact` (Section 14).

- **After uninstall:** `shop/redact` fires roughly 48 hours after uninstall and triggers erasure as described above.

- **Analytics and usage events:** retained per the applicable vendor’s own standard retention policy (see the Subprocessors page for each vendor’s documentation link); these events are keyed to the shop, never to an individual shopper.

## 16. Security measures

- **Encryption in transit:** every connection to and from Tacey uses TLS. There is no unencrypted path in or out of the system.

- **Encryption at rest:** storage is encrypted by our infrastructure provider, Cloudflare, by default.

- **Least-privilege access to Shopify data:** we request only the OAuth scopes our features need, Shopify enforces that boundary (not us), and every scope we hold is publicly listed on our App Store listing.

- **Short-lived tokens:** the offline access token that lets us act on a merchant’s behalf now expires within 60 minutes and must be actively refreshed, a deliberate design choice that limits how long a compromised token would remain useful.

- **Webhook authenticity verification:** every webhook Shopify sends us is verified against its HMAC signature before we act on it, so a forged request cannot trigger a data operation.

- **No payment data in scope:** because Shopify handles all payment processing, our systems are never in scope for PCI DSS in the first place (Section 6).

- **Tenancy isolation:** every database query affecting shop-scoped data carries an explicit shop identifier, and per-shop compute and edit sessions are isolated by construction at the infrastructure level.

We hold no third-party security certification today (no SOC 2, no ISO 27001), see the Trust Centre for the honest account of what that does and does not mean, and we do not represent otherwise on this page.

## 17. Personal data breach notification

If we become aware of a personal data breach affecting shopper or merchant data, we will:

- Notify affected merchants **without undue delay**, so they can meet their own Article 33 obligation to notify their supervisory authority within **72 hours** of becoming aware of a breach, where required.

- Provide the information reasonably necessary for the merchant to assess the breach’s risk and notify affected individuals, where required under Article 34.

- Take immediate steps to contain and remediate the breach.

## 18. Records of processing and documentation available on request

We maintain records of our processing activities as required by Article 30, including the categories of processing we carry out, the categories of data subjects and personal data involved, and our subprocessors.

On request, and subject to appropriate confidentiality protections, we can provide:

- A summary of our technical and organisational security measures.

- Our current subprocessor list (also published openly, Section 13).

- Confirmation of the safeguards relied on for international transfers (Section 12).

Email hello@taceysupport.app to request any of the above, or to arrange a security review call.

## 19. EU and UK representatives, supervisory authorities, and your right to complain

As a US-based company processing personal data of EU and UK data subjects, Article 27 GDPR and Article 27 UK GDPR may require us to appoint a representative in the EU and/or UK, unless a derogation applies (e.g. processing is occasional, low-risk, and does not involve special category data at scale). **We have not yet appointed an EU or UK representative.** This is an open item for legal review, not an oversight to be read past.

Regardless of whether we have a representative, if you believe our processing of your personal data infringes GDPR, you have the right to lodge a complaint with the supervisory authority in your own country of residence, place of work, or the place of the alleged infringement. You do not need to contact us first.

- **UK residents:** the Information Commissioner’s Office (ICO), ico.org.uk.

- **EU residents:** your national data protection authority, a full list is available at edpb.europa.eu.

## 20. Global coverage beyond the EU and UK

GDPR is the framework this page is written against because it is the most comprehensive and the one most of our merchants’ compliance teams ask about, but we apply the same standard of care regardless of where a shopper or merchant is located. Depending on where you are, additional rights may apply under your local law, for example, the **California Consumer Privacy Act (CCPA/CPRA)** for California residents, or **Canada’s PIPEDA**.

## 21. The Data Processing Agreement

Our Data Processing Agreement is published and forms part of, and is incorporated by reference into, the Tacey Terms of Service. It incorporates by reference:

- The subprocessor list in Section 13, kept current.

- The security measures in Section 16.

- The international transfer safeguards in Section 12.

- The deletion and retention commitments in Section 14 and Section 15.

A merchant who needs a signable copy addressed specifically to their organisation can email hello@taceysupport.app to request one.

## 22. Changes to this page

We will update this page as our processing activities, subprocessors, or legal obligations change, and we will update the “Last updated” date at the top whenever we do. Material changes, a new category of data, a new subprocessor, or a change to how long we retain something, will also be communicated to merchants directly, not only through a silent page edit (see also Section 13’s subprocessor-change notice).

## 23. Contact us

Questions about this page, a data-subject request, or a security review:

- **Data-subject request form:** [tacey.app/privacy-request](/privacy-request)

- **Email:** hello@taceysupport.app

- **Help centre:** help.tacey.app

If you are a shopper with a question about an order, please contact the store you ordered from, they are best placed to help you, and are the controller of your order data (Section 3).