Terms of Service

These Terms of Service and the attached Data Processing Addendum (together, the "Agreement") govern your use of the Professional List Manager application (the "App") provided by Digital Project Design ("DPD", "we", "us", "our"). The App lets a merchant's signed-in customers (business buyers and individual shoppers) save product lists and reorder from them, and lets the merchant's sales representatives create, manage and share those lists.

By installing, accessing, or using the App, you ("Merchant", "you") agree to this Agreement. If you are accepting on behalf of a company, you represent that you are authorized to bind that company. If you do not agree, do not install or use the App.

Subject to this Agreement, we grant you a non-exclusive, non-transferable, revocable license to use the App on your Shopify store(s) for your internal business purposes for as long as the App is installed and your fees are current.

You agree to:

• use the App in compliance with applicable laws and the Shopify Terms of Service and API/Partner terms;
• maintain your own privacy notice to your customers and obtain any consents you are legally required to obtain for the processing the App performs on your behalf;
• be responsible for the accuracy of the data in your store and for the actions of your staff and authorized users within the App;
• not misuse the App, attempt to circumvent its access controls or billing, reverse engineer it, or use it to infringe others' rights.

The App is offered on the pricing described on its Shopify App Store listing, including any free trial. All fees are billed through Shopify's billing system under your Shopify account; we do not separately collect payment card details. Fees are charged in advance on a recurring basis and are non-refundable except as required by law or as expressly stated on the listing. We may change pricing prospectively; changes apply on your next billing cycle and are subject to Shopify's approval/notification requirements.

This Agreement is effective while the App is installed. Either party may terminate at any time: you by uninstalling the App; we by discontinuing the App or for your breach of this Agreement. On termination, your license ends and we delete your data as described in the Data Processing Addendum and our Privacy Policy. Sections that by their nature should survive termination (e.g., disclaimers, limitation of liability, governing law) survive.

The App, including all software, design, and content we provide, is owned by DPD and its licensors. This Agreement grants no rights other than the limited license in Section 2. Data you and your customers create in the App ("Merchant Data") remains yours.

The App is provided "as is" and "as available" without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that the App will be uninterrupted, error-free, or that it will meet your requirements. The App depends on the Shopify platform and other third-party services that are outside our control.

To the maximum extent permitted by law, DPD will not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of profits, revenue, data, or goodwill. Our total aggregate liability arising out of or relating to this Agreement will not exceed the greater of (a) the fees you paid for the App in the twelve (12) months preceding the event giving rise to the claim, or (b) USD 100.

You will indemnify and hold DPD harmless from claims arising out of your use of the App in violation of this Agreement or applicable law, including your handling of your customers' data outside the App.

We may update this Agreement from time to time. We will revise the "Last updated" date and post the new version at the published URL. Your continued use of the App after changes take effect constitutes acceptance.

This Agreement is governed by the laws of the State of California, United States, without regard to its conflict-of-laws rules. The parties submit to the courts located in Los Angeles County, California for any disputes, except that either party may seek injunctive relief in any court of competent jurisdiction.

Digital Project Design (DPD) — Digital Project Design LLC, 10441 Chaney Ave, Downey, CA 90241, USA — plm@digitalprojectdesign.com — https://www.digitalprojectdesign.com

This DPA forms part of the Agreement and applies where DPD processes personal data of your customers and store visitors ("Customer Personal Data") on your behalf in connection with the App. In the event of a conflict between this DPA and Part A regarding the processing of Customer Personal Data, this DPA controls.

For Customer Personal Data processed through the App, you (the Merchant) are the data controller and DPD is the data processor. You are responsible for the lawfulness of the data and instructions you provide.

We will process Customer Personal Data only:

• to provide, maintain, and secure the App as described in the Agreement and our Privacy Policy;
• in accordance with your documented instructions, which include your configuration and use of the App and Shopify's standard data flows; and
• as required by applicable law (in which case we will inform you unless legally prohibited).

We will not use Customer Personal Data for our own purposes, will not sell it, and will not use it for advertising or profiling.

• Subject matter: provision of the App's list-management functionality.
• Duration: for as long as the App is installed, plus the retention periods in Section 5 of our Privacy Policy.
• Nature and purpose: storing and managing product lists created by a Merchant's signed-in customers and sales representatives, including lists shared with customers by customer tag; resolving B2B catalog and pricing context; keeping technical request logs, operational telemetry and backups so we can run, secure and recover the App; and responding to Shopify's privacy requests.
• Types of Customer Personal Data: a Customer's Shopify Customer identifier; the Customer's customer tags (read on each request, not stored); the Shopify Company and Company location a B2B buyer is buying for; list content (list names, product and variant identifiers, quantities, timestamps, and an identifier recording who created or changed an item); Customer names and email addresses, which the App reads from Shopify and shows to your staff in the Rep Tools but does not store in its databases; and log data (IP address, approximate location and request details, which can include search text your staff type). Phone numbers, postal addresses and order details are processed only where Shopify includes them in a mandatory privacy request, and only to fulfil that request.
• Categories of data subjects: the Merchant's signed-in customers, including business buyers and individual shoppers; Customers a representative creates a list for, whether or not they ever sign in; visitors to the Merchant's store pages that include the App's block; and the Merchant's staff users who operate the App.

We implement appropriate technical and organizational measures to protect Customer Personal Data, including encryption in transit (TLS) and at rest, a separate database for each store's list data, and access to production systems limited to DPD. These measures are described in Section 6 of our Privacy Policy.

We ensure that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations.

You authorize us to engage the following sub-processors, who are bound by data-protection obligations consistent with this DPA:

• Cloudflare, Inc. — Application hosting (Workers), databases (D1), technical request logs, operational telemetry and analytics, backup storage (R2), sending DPD's internal summary email, and sign-in protection for DPD's dashboard
• Google LLC (Google Workspace) — DPD's email, including support email and the internal daily summary

Shopify is the platform the App runs on and the source of the store and Customer data the App reads; it processes that data under your own agreement with Shopify and is not our sub-processor.

We use AI tools, including Anthropic's Claude, to develop, operate and troubleshoot the App. In that work they may see technical and store-level information, such as store domains, error messages and Shopify record IDs, but we do not give them Customer names or contact details, and we have turned off model training on our conversations. They are described in Section 4 of our Privacy Policy.

We will inform you of any intended changes to sub-processors by updating this Agreement and its "Last updated" date at the published URL, and give you an opportunity to object on reasonable data-protection grounds.

Taking into account the nature of the processing, we will assist you in meeting your obligations:

• Data-subject requests. The App processes Shopify's mandatory compliance webhooks. On a customers/data_request, we record the request; contact us at plm@digitalprojectdesign.com and we will provide the list data we hold about that Customer so you can respond. On a customers/redact, we delete the lists that Customer owns and their items, delete items they added to other lists, and replace their Customer ID with a placeholder on anything else they created or changed; a list name they typed for a list they did not own (such as a Company's list) is kept as written.
• Deletion on termination. When the App is uninstalled, we delete your staff's sign-in details and the App's Shopify access tokens for your store. Shopify then issues a shop/redact request (approximately 48 hours later), upon which we delete your store's list data, our technical record of the installation, and the operational telemetry labeled with your store. Technical logs expire within 7 days, operational telemetry within about 90 days, and backups and database recovery history within about 30 days, as set out in Section 5 of our Privacy Policy; business records of the installation are kept for our accounting and legal purposes.
• Records and demonstrating compliance. We will make available to you the information reasonably necessary to demonstrate compliance with this DPA.

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provide information reasonably available to us to help you meet your notification obligations.

Customer Personal Data may be processed in countries other than where you or your Customers are located. The App's databases are stored in a Cloudflare region (currently North America or Europe); backups, including those of Europe-region databases, are stored in North America; logs and telemetry are processed on Cloudflare's global network; Google and the AI tools named in Section B.6 process information where they operate; and DPD accesses the App's systems from the United States, where we operate the App. We rely on our sub-processors' transfer safeguards for the transfers they carry out.

Each party's liability under this DPA is subject to the limitations of liability set out in Part A, Section 8.