Data Processing Agreement

The merchant is the controller of personal data processed through the app. Storestead Labs acts as the processor when handling merchant data through the app.

QuoteStead processes personal data on the merchant's behalf to operate a B2B quoting and ordering workflow. This includes:

• Buyer and contact personal data (name, email, phone, job title, billing/shipping address) attached to quotes, quote requests, leads, and orders.
• The merchant's staff roster (display name, email) linked to Shopify staff sign-in.
• Syncing configured company and customer data from Shopify.
• Providing the app features the merchant enabled, including the buyer self-service portal.
• Maintaining secure sessions, an access log of protected customer data, diagnostics, and technical operations.

• On receiving Shopify's customer-redaction request for a specific buyer, we anonymize that buyer's identifying fields (name, email, phone, address) across their quotes, requests, and leads, and delete their contact and buyer sign-in records, while retaining the de-identified business record the merchant needs for accounting and history.
• On receiving Shopify's shop-redaction request (following merchant uninstall), all of the merchant's data in the app — organizations, contacts, buyer identities, quotes, requests, leads, orders, saved lists, staff roster, and activity/audit logs — is deleted.
• Access and activity log entries otherwise age out automatically after 180 days; session records after 30 days.

• Shopify: App platform, merchant installation, and commerce data source.
• Postgres: Application database storage.

Storestead Labs uses HTTPS for public app traffic, TLS for database connections, AES-256-GCM encrypted Shopify session-token persistence, signed buyer session cookies, an access log covering protected customer data views and changes, and access-controlled hosted infrastructure.

For data protection requests regarding this DPA, contact contact@quotestead.com.