Data Processing Addendum

This Data Processing Addendum forms part of the litecommerce Terms of Service when incorporated into the service terms accepted by the merchant. It applies to personal information Idaho Pro Digital, LLC processes on the merchant's behalf through the platform, its APIs, and hosted checkout and customer-account services.

The merchant determines why and how its customer information is used and acts as the controller. We act as its processor for that information. In this addendum, "personal information" includes personal data protected by the data protection laws that apply to the processing.

Our Privacy Policy describes information we control for our own business purposes, including platform account administration, billing, inquiries, and service security.

• Subject and purpose. Providing the commerce functions the merchant enables, including customer records, checkout, orders, fulfillment, returns, customer accounts, and transactional communications.
• People concerned. The merchant's customers, prospective customers, people receiving deliveries, customer contacts, and people whose information the merchant supplies to use an enabled service.
• Information involved. Names and contact details, addresses, customer identifiers, order and basket contents, payment references and limited payment-method details, return records, communication preferences, and information in records or files the merchant supplies.
• Operations. Receiving, recording, organizing, storing, retrieving, displaying, transmitting, correcting, exporting, and deleting information as needed for the selected functions and lawful instructions.
• Duration. Processing continues while we provide the service and through the return, deletion, and legally required retention described below.

The merchant should supply only information needed for the service it is using. Discuss any requirements for sensitive or specially regulated information with us before using the service for it.

We process merchant personal information on documented instructions. Those instructions include the applicable service terms, the merchant's settings and authorized API requests, and additional lawful instructions agreed with us. The merchant is responsible for its authority to collect and supply the information, the accuracy of its instructions, and the notices and permissions required for its use.

If an instruction appears to violate applicable data protection law, we will inform the merchant and seek clarification. If law requires processing beyond those instructions, we will inform the merchant of that requirement before processing unless the law prohibits that notice.

We will limit access to personal information to authorized people who need it to provide, support, or secure the service or meet legal obligations. People authorized to process it must be subject to confidentiality commitments or an applicable legal duty of confidentiality. The merchant manages the access it gives its own staff and integrations.

We will maintain technical and organizational measures appropriate to the nature of the information and the risks of the processing. Our service uses authenticated access, organization context and permission checks, and activity records for supported administrative operations. Web services use HTTPS to protect information in transit.

Security also depends on the merchant's storefront, staff access, integrations, and payment setup. Keep credentials secure, remove unused access, and use supported payment fields for full card details. Contact us to discuss the controls relevant to your intended processing and any additional requirements.

The following service providers support our processing of merchant information. The information each handles depends on the features used and the requests made. These providers can also handle information for litecommerce's own operations, as described in the Privacy Policy.

Supabase

Managed Postgres, authentication, and object storage for tenant and platform data.

Tenant account data, merchant-loaded end-customer personal data, uploaded media, and authentication identifiers and session material.

Primary production hosting is in Northern Virginia, United States (AWS us-east-1).

Resend

Merchant email delivery, including transactional messages and, where enabled, newsletter confirmations and back-in-stock notifications.

Recipient email addresses, message content, and delivery metadata.

Resend stores customer data in the United States.

Vercel

Application hosting, edge routing, and CDN for the API and every Next.js application.

Full request and response payloads for the API and applications it hosts — including tenant account data and end-customer personal data such as profiles, addresses, and orders — plus request metadata, IP addresses, and logs.

Primary API compute is in the Washington, D.C., United States region (iad1). Vercel also operates a global edge network.

Sentry

Error monitoring and sampled performance tracing for the API, admin, and platform-admin applications.

Error details, stack traces, IP addresses, request metadata, and diagnostic context that can include personal information.

Sentry stores error events and performance traces at rest in Iowa, United States.

By accepting this addendum, the merchant generally authorizes us to use the listed providers for the processing described. We will engage subprocessors under written terms requiring appropriate data protection obligations and remain responsible to the merchant for their performance of those obligations.

We will give the merchant prior notice of an intended addition or replacement and a reasonable opportunity to object on documented data protection grounds before the new provider processes affected information. We will work with the merchant to address a reasonable objection, including considering an alternative or ending the affected service where the objection cannot be resolved.

A merchant can select its own payment, shipping, analytics, and other integrations. The merchant's relationship with those providers and their use of information depend on the service and the terms the merchant accepts with them.

For sales through a connected Stripe account, the merchant engages Stripe for its payment services. Stripe can also process information for its own financial, fraud-prevention, and legal purposes. litecommerce's own subscription billing is covered by our Privacy Policy.

Cloudflare Turnstile protects litecommerce's public signup and contact forms. Its processing in that context concerns information we handle for our own inquiries and account intake. Our Privacy Policy describes that use.

The merchant handles requests from people whose information it controls. We will assist it, taking account of the processing and information available to us, with access, correction, export, deletion, and other applicable rights requests.

If a person contacts us about information we process for a merchant, we will direct the request to the merchant or ask for its instructions unless law requires another response. We will also provide reasonable assistance with security obligations, breach assessments, data protection impact assessments, and consultation with a regulator where applicable.

We will notify the affected merchant without undue delay after becoming aware of a personal data breach affecting information processed on its behalf, and meet any stricter notification requirement imposed by applicable law.

We will provide available information about what happened, the affected information and people, likely consequences, measures taken or proposed, and a contact for follow-up. We may provide information in stages as the investigation develops. Notice will be directed to an authorized contact for the affected merchant.

The merchant assesses its obligations to regulators and affected people. We will reasonably cooperate with that assessment and response, including providing relevant information about the incident and mitigation.

At the end of the relevant service, the merchant can choose return or deletion of personal information we process on its behalf, subject to applicable legal retention requirements. An authorized account owner can contact us to request an export, closure, or deletion review. We verify the organization, the requester, and the handling of outstanding transactions before acting.

We will return or delete the information according to the applicable instructions and delete remaining copies unless law requires retention. Backup copies follow their applicable expiry or replacement process and remain protected while held. Any retained information stays subject to the relevant confidentiality, security, and purpose restrictions.

A merchant's own storefront and its direct provider accounts have their own closure and retention processes. The merchant should arrange those separately where needed.

We will make information available that is necessary to demonstrate compliance with this addendum and allow audits and inspections required by applicable data protection law by the merchant or its authorized auditor. Coordinate the scope, timing, and secure handling of findings with us in advance where practicable. Audit arrangements must protect confidential information, the security of the service, and the information and rights of other merchants.

Idaho Pro Digital, LLC is based in the United States. Our providers may process information in the United States or other countries where they operate. A transfer subject to data protection restrictions must have an applicable lawful mechanism before it occurs. We will provide relevant information about the locations, safeguards, and any additional transfer terms applicable to the merchant's processing on request.

Where we act as a service provider or contractor under applicable U.S. state privacy law, we will use the merchant's personal information only for the specified business purposes and other uses the law permits. We will not sell it, share it for cross-context behavioral advertising, use it outside the direct business relationship, or combine it with other information except as that law permits. We will provide the required level of privacy protection, inform the merchant if we can no longer comply, and cooperate with reasonable steps to verify compliance and stop or remediate unauthorized use.

This addendum governs our processing of personal information for the merchant if there is a conflict with the general Terms on that subject. Any mandatory transfer terms govern according to their own order of precedence. Changes to this addendum follow the notice and acceptance requirements of the applicable service terms and law.

Email privacy@litecommerce.io or use our contact form for questions about this addendum. Identify the merchant account and the request. Keep credentials, full payment details, and private customer records out of the initial message so we can arrange an appropriate way to handle any supporting information.