Privacy Policy
Duo Digital Prints ("Company", "we", "us", or "our"), a company organized and operating in the United States, operates the DDPOMS Shopify application and cloud integration microservice hosted at https://app.ddpoms.us.
This Privacy Policy explains how we collect, access, use, disclose, retain, and protect personal information when a merchant installs and utilizes DDPOMS in connection with their Shopify e-commerce store. This policy is designed in strict compliance with United States federal and state privacy statutes (including the California Consumer Privacy Act as amended by the California Privacy Rights Act, "CCPA/CPRA"), as well as global standards (including the General Data Protection Regulation, "GDPR") and the Shopify App Store Developer Requirements.
Under US state comprehensive privacy laws (such as the CCPA/CPRA) and international data protection laws (such as the GDPR), Duo Digital Prints acts as a "Service Provider" and "Data Processor". The Shopify merchant acts as the "Business" or "Data Controller". We process customer order data strictly pursuant to the merchant's business instructions solely to execute custom manufacturing, printing, and shipping fulfillment.
1. Notice at Collection: Information We Access and Collect
When you install and authorize DDPOMS, we access the minimum necessary information via Shopify's authenticated GraphQL and REST APIs and real-time Webhooks:
| Category of Information | Specific Data Elements | Business Purpose |
|---|---|---|
| Merchant Account Identifiers | Shop myshopify domain (e.g. store.myshopify.com), store owner contact email, primary currency, and store country/locale. |
Account authentication, store identification, and communication. |
| Authentication Credentials | Shopify-issued OAuth access tokens. | Cryptographically authenticate secure API communications (stored with AES-256 encryption at rest). |
| Customer Identifiers & Contact Details | Customer full name, email address, and phone number. | Required solely for carrier delivery notifications and order support. |
| Shipping & Delivery Addresses | Recipient full name, street address, suite/apartment, city, state/province, postal/ZIP code, and destination country. | Generating commercial carrier shipping labels and physical package delivery. |
| Commercial Order Data | Shopify order ID, order number, purchased line item titles, SKUs, product quantities, variant titles, item properties, and total amounts. | Routing orders directly into Duo Digital Prints' manufacturing and printing machinery. |
2. How We Use Information
We process merchant and customer information exclusively for legitimate, operational business purposes:
- Ingesting orders in real time from Shopify and dispatching them into Duo Digital Prints' manufacturing pipeline.
- Printing customized physical products according to specifications and shipping them to the merchant's customers.
- Updating fulfillment, tracking, and synchronization statuses within the embedded Shopify Admin interface.
- Maintaining error logs, debugging webhook deliveries, and verifying security signatures.
3. No Sale or Sharing of Personal Information
Duo Digital Prints does not sell personal information, nor do we share personal information for cross-context behavioral advertising or targeted advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) and other applicable US state privacy laws. We do not monetize merchant or customer data in any manner.
4. Disclosures to Service Providers and Sub-Processors
We disclose personal information only to trusted third-party service providers who assist us in operating our business and fulfilling orders, strictly under contractual confidentiality and data processing terms:
- Cloud Infrastructure Providers: Secure enterprise hosting, managed database, and server infrastructure located in the United States.
- Shipping & Logistics Carriers: Commercial freight and postal carriers (e.g., USPS, UPS, FedEx, DHL) strictly to deliver physical packages to customer addresses.
- Legal & Compliance: When required by applicable law, lawful subpoena, or government order.
5. Data Retention and Deletion Timelines (Shopify 30-Day Requirement)
We adhere strictly to Shopify's data retention standards and applicable data protection laws:
- Active Data Retention: Customer shipping details and order records are retained only for the duration necessary to manufacture the product, ensure delivery completion, and address any merchant service inquiries.
- App Uninstallation: When a merchant uninstalls DDPOMS:
- Shopify dispatches an
app/uninstalledwebhook. - Our system immediately revokes and clears all stored access credentials, terminating all API connections.
- The store record is soft-deleted and permanently erased from our production databases within 30 days.
- Shopify dispatches an
- Mandatory 30-Day Erasure: In strict compliance with Shopify App Store requirements, all merchant data and customer personal information will be completely and permanently expunged within 30 days of uninstallation or upon receipt of a verified deletion request.
6. Automated Handling of Mandatory Shopify Privacy Webhooks
DDPOMS implements fully automated, programmatic job handlers for Shopify's mandatory GDPR and CCPA compliance webhooks:
A. Customer Data Request (customers/data_request)
When a customer exercises their right to access their data through a merchant, Shopify delivers a customers/data_request webhook. Our automated handler queries our database for any order records associated with that customer ID and furnishes them to the merchant so they may fulfill the customer's data subject access request.
B. Customer Data Erasure (customers/redact)
When a customer requests erasure of their personal information (Right to be Forgotten), Shopify sends a customers/redact webhook. DDPOMS programmatically locates all matching order records and purges all personally identifiable information—anonymizing customer names, erasing email addresses, phone numbers, delivery addresses, and raw payload data.
C. Shop Data Erasure (shop/redact)
Shopify delivers this webhook 48 hours after an app is uninstalled. Upon delivery, DDPOMS permanently deletes all remaining store records, configuration attributes, and associated order records from our production databases.
7. United States State Consumer Privacy Rights (CCPA / CPRA & Other States)
Residents of California, Virginia, Colorado, Connecticut, Utah, and other US states with comprehensive consumer privacy statutes possess specific rights regarding their personal information:
- Right to Know / Access: The right to request the categories and specific pieces of personal information collected.
- Right to Deletion: The right to request the permanent deletion of personal information.
- Right to Correction: The right to request correction of inaccurate personal information.
- Right to Non-Discrimination: We will never discriminate against any merchant or customer for exercising their statutory privacy rights.
Because Duo Digital Prints acts as a Service Provider to Shopify merchants, consumers seeking to exercise their privacy rights should submit their request directly to the merchant from whom they made their purchase. Once the merchant processes the request through Shopify, Shopify dispatches the corresponding webhook to DDPOMS, which we honor automatically.
8. Children's Privacy (COPPA)
DDPOMS is a business-to-business application and is not directed to, marketed to, or intended for use by children under the age of 13 (or under 16 where required by law). We do not knowingly collect personal information from children.
9. Technical and Organizational Security Safeguards
Duo Digital Prints maintains robust industry-standard safeguards to protect personal information against unauthorized access, loss, or alteration:
- Encryption in Transit: All web traffic and API communications are encrypted using Transport Layer Security (TLS 1.3 / HTTPS).
- Encryption at Rest: Merchant access tokens and sensitive credentials are encrypted using industry-standard AES-256 encryption.
- Cryptographic Signature Verification: Every incoming Shopify webhook is cryptographically verified using HMAC-SHA256 signatures before processing.
- Principle of Least Privilege: Internal access to production manufacturing databases is strictly restricted to authorized operational personnel.
10. Changes to This Privacy Policy
We may periodically update this Privacy Policy to reflect modifications to our operations, technology, or legal requirements. Material modifications will be posted to this page with an updated "Effective Date."
11. Contact Us
If you have questions, comments, or concerns regarding this Privacy Policy or our data protection practices, please contact our team:
- Company: Duo Digital Prints
- Official Website: https://duodigitalprints.com/
- Application Gateway: https://app.ddpoms.us/
- Privacy Inquiries: info@duodigitalprints.com