Data Processing Terms

Version 2026-10-24. Store owners confirm these terms for each store, the same way as the Seller responsibilities notice: a box ticked when the store is created and before it opens Live, recorded with the version, the time, who ticked it and from which IP address. Owners of earlier stores are asked in Admin. That confirmation is what puts these terms, and the EU standard contractual clauses and UK addendum incorporated in section 6, into effect between you and us for that store.

These terms are between a store owner ("you", the controller) and Stonebridge Digital LLC, doing business as SBCommerce.net ("we", the processor). They apply when we process personal data of your shoppers, staff and other people on your behalf. They are meant to meet GDPR article 28, the UK GDPR, and US state privacy laws that require a processor contract.

1. What we process

We don't process special categories of data unless you choose to put them in the Service, and you shouldn't without a legal basis.

2. Our commitments

We will:

• process the data only on your documented instructions, which are these terms and how you set up and use the Service, unless the law requires otherwise (and then we'll tell you, if allowed);
• make sure everyone at SBCommerce.net who can access it is bound to confidentiality;
• keep it secure, as in section 5;
• use sub-processors only as in section 4;
• help you answer people who exercise their rights; Admin already lets you export a store's data and erase a shopper's personal details;
• help you with security, breach notification, and data protection impact assessments, as far as our role allows;
• tell you without undue delay, and within 72 hours of becoming aware of a personal data breach affecting your data;
• delete or return the data at the end, as in section 7;
• give you the information needed to show we meet these terms, and allow audits as in section 8.

3. Your commitments

You confirm you have a legal basis for the data you put in the Service, that you give shoppers the notices the law requires (including your own privacy policy), and that your instructions to us are lawful.

4. Sub-processors

You authorise the sub-processors below. We will give at least 30 days' notice of a new one, by email or in Admin, so you can object; if we can't resolve a reasonable objection, you may end the Service and get a pro-rated refund of prepaid fees. We impose data protection terms on each sub-processor at least as protective as these, and remain responsible for them.

Payment providers you connect (such as Stripe, PayPal, Creem, Dodo Payments) are not our sub-processors: they act under your own agreement with them.

The same goes for AI apps you or your staff connect to the store (such as Claude or ChatGPT). Connecting one is your instruction to send it the store data it asks for, within the role of the person who connected it. We share contact details only when the app asks for them, keep money actions (refunds, cancellations, payment requests) waiting until an owner or administrator approves them in Admin, log what each app does, and let you disconnect an app or turn connections off for the store at any time. You are responsible for your agreement with the AI provider and for telling your shoppers about it.

Google and Meta for shopper sign-in. If the platform offers "Continue with Google" or "Continue with Facebook" on your store, a shopper who chooses it signs in with their own Google or Facebook account. Google and Meta act as independent controllers of their sign-in; they are not our sub-processors. We receive the shopper's name, email address and, for Facebook, an app-specific account id, and process them for you like any other customer data.

Likewise EasyPost, if you connect your own EasyPost account to buy shipping labels. Buying a label is your instruction to send EasyPost (and through it the carrier) the shopper's name, shipping address and phone number and your ship-from address. EasyPost acts under your agreement with it, and bills you directly.

5. Security measures

• HTTPS for all traffic; data encrypted at rest by Google Cloud.
• Each store's data kept separate, and checked by automated tests.
• Two-step sign-in for owners and staff, which an owner can require; required for our own platform staff.
• API keys and recovery codes stored only as hashes; payment provider keys stored encrypted.
• An audit log of administrative actions.
• Daily backups kept for 7 days, and point-in-time recovery for the last 7 days.
• Access to production limited to the people who need it.

6. International transfers

Data is stored in the United States. Transfers from the EU/EEA, UK and Switzerland are covered by the EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914, module two, controller to processor), which are incorporated by reference, with you as data exporter and us as data importer. Where the clauses leave a choice open:

• Clause 7 (docking clause) applies.
• Clause 9: option 2, your general authorisation of sub-processors, with the 30 days' notice in section 4.
• Clause 11(a): the optional independent dispute resolution wording doesn't apply.
• Clause 13: the supervisory authority of the EU/EEA country where you are established. If you aren't established there, the authority of the country where your representative under GDPR article 27 is; if you need no representative, the authority of a country where the people whose data is transferred are.
• Clauses 17 and 18: the law of Ireland, and the courts of Ireland.
• Annex I (parties and the transfer): you, as recorded in the store's business details, and Stonebridge Digital LLC, 4274 NW Canary Pl, Corvallis, OR 97330-2270, USA, legal@sbcommerce.net. The people, data, purpose and duration are in section 1; transfers are continuous, for as long as you use the Service.
• Annex II (security measures) is section 5, and Annex III (sub-processors) is the list in section 4.

Switzerland. For transfers under the Swiss Federal Act on Data Protection (FADP), the clauses apply as above, with these changes: the competent supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC); references to the GDPR mean the FADP where it applies; and "Member State" doesn't stop people in Switzerland from bringing claims where they normally live.

United Kingdom. For transfers under the UK GDPR, the International Data Transfer Addendum to the EU clauses (version B1.0, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018) applies and is incorporated by reference. Its Table 1 is filled in by Annex I above, Table 2 by the clause choices above (module two), and Table 3 by Annexes I to III above. For Table 4, neither party may end the Addendum under its section 19.

7. Deletion at the end

When you delete a store, its data is permanently deleted 30 days later (you can call it off by reopening it before then), and backups roll off within a further 7 days. Before deleting, you can export everything from Settings → Download all data.

8. Audits

We will answer reasonable written questions about how we meet these terms, and share summaries of our security practices. If that isn't enough to show compliance, or a regulator requires it, you may audit us, at your cost, with 30 days' notice, during business hours, no more than once a year, under a confidentiality agreement.

9. Liability and order of precedence

The limits of liability in the Terms of Service apply to these terms. If these terms conflict with the Terms of Service on data protection, these terms win; the standard contractual clauses win over both.