Data Processing Agreement

Last updated: October 27, 2026

This agreement is between you (the merchant) and TEKRAID LLC. It covers personal data that TEKRAID processes when you use tekraid.com or a TEKRAID app. It sits alongside our privacy policy, our terms of service, and our security page. Business address: TEKRAID LLC, 1561 West Hamlin Road, Rochester Hills, MI 48309.

1. Roles

You decide why and how your store's personal data is used. You are the controller. TEKRAID LLC processes that data only to provide the apps you install. We are the processor.

Our privacy policy says we follow requests under laws such as the GDPR and the CCPA, and that we don't sell personal data or use it for advertising. On that basis, TEKRAID LLC is also your service provider under the CCPA and similar US state privacy laws. We don't combine your store's data with another merchant's data.

2. What this covers, and for how long

The subject matter is the TEKRAID app or apps you install, and the tekraid.com pages that go with them. The purpose is to provide those apps: showing the features you turn on, billing them through Shopify, answering support, and keeping them secure. We don't use the data for our own marketing.

Processing lasts while an app is installed. Uninstalling ends the session and stops scheduled work right away. Shopify then sends shop/redact 48 hours after you uninstall, and we delete the store's data as section 8 describes. A few records stay for the windows in the privacy policy, such as the one-trial marker and the privacy-request log.

3. Data, by app

Each app below is a TEKRAID app, under its public name. Each one asks only for the Shopify permissions it needs.

Porchday

Data subjects are your shoppers, to a very small extent, and you and your staff. We keep the shipping country on an order (not the ZIP code, street, name, email, or phone), the promised delivery date, the delivered date, and the rule and warehouse used. We also keep your delivery settings, product and variant ids, tags, collections, and stock state, storefront event totals that don't identify a shopper, your store's contact name and email, feedback you send, and an uninstall reason if you give one. Order promise copies are kept for 13 months. The rest stays while Porchday is installed.

Sizeday

Sizeday holds no customer personal data. There is no customer, order, or email table. We keep the shop domain, the access token, the charts and rules you write, and the product ids, titles, tags, collections, types, and vendors used to assign a chart. A shopper viewing a chart does not contact Sizeday's servers. A customer privacy request is recorded, and there is no customer record to return or delete.

Stockday

Stockday holds no customer names, email addresses, phone numbers, or shipping addresses. We do hold merchant and store data: the shop domain, store name, Shopify plan, currency, time zone, and the store's contact email; products, variants, SKUs, costs, and current inventory quantities (available and on hand) at each location; order dates, line items, quantities, prices, whether an order was cancelled, its refunds, whether it is a test order, and the location it was sold from; supplier details you enter; purchase orders and the stock you receive against them; past purchase orders you import from a CSV file; an uninstall reason if you tell us; and which staff account did what in the app.

Sales data from orders is kept in two forms. Rows for each order (the order id with its units and revenue per product) are deleted after 93 days for every store, whether it's active, uninstalled, or has lapsed billing. Daily totals per product, which aren't linked to any order or customer, are deleted once they are 365 days old. Nothing from orders is kept past 365 days, even while the app is installed. Forecasts are kept for 14 days, forecast accuracy for 120 days, and stock snapshots for 90 days. Purchase orders, receipts, imported purchase history, suppliers, and settings stay while Stockday is installed, and are deleted on shop/redact.

Editday

Editday is built to let a customer correct their own order. To do that it reads, on the Shopify order and not as a copy in our database, the shipping address, the name and phone on that address, and the email used to send one edit link. What we store is the order id and name, the kind of edit, a short summary such as "Shipping address updated", before and after totals, a price preview for up to 30 minutes, and the time a link was sent. The street, name, phone, and email are not in those rows.

Printday

Printday reads the name, billing and shipping address, email, and phone already on an order at the moment a document is rendered, and does not store those fields. What we store is your document templates, the business details you type for branding, your store's business details synced from Shopify (business name, address, email, and phone), an invoice number with the order id, link outcomes with a hash of the IP address, staff permission flags, bulk-print order ids, a staff access log (which staff account printed which order, and when, without the order's contents), and the Shopify session (the shop's access token, and the signed-in staff member's name and email).

The IP hash on a link outcome is cleared after 30 days, and the link row is deleted after 93 days. Bulk-print jobs and the staff access log are deleted after 93 days. Invoice numbers stay while Printday is installed. For a customer data request, we store the report we prepared (order ids, invoice numbers, link outcomes, and bulk-job ids, with no names, addresses, or emails) on the privacy-request record. That report and its order ids are cleared after 93 days.

Bundleday

The privacy policy says Bundleday hasn't launched and doesn't collect any data. We'll describe what it holds here before it goes live.

Ruleday

Ruleday stores the checkout rules you write (conditions and actions). Those rows are not customer records. Like the other apps, a Shopify session can include the signed-in staff member's name and email, and the shop's access token.

Every installed app keeps that Shopify session. Customer privacy requests are logged with the store, the request type, the order numbers, and when we finished. That log has no names, emails, or addresses, and we delete it after 365 days. Stockday's record also holds the data-request export: order ids with units and revenue per product, and nothing about the customer. The same 365-day window applies to the access log of protected customer data, except Printday's, which is deleted after 93 days.

4. Confidentiality and security

Only people who need access to run the apps have it, and only for that work. They are required to keep merchant and customer data confidential and not to export it to personal devices, spreadsheets, or email. Our written policy requires a unique strong password and two-factor authentication on every account that can reach production. Access is reviewed quarterly.

The measures we actually run are the ones on our security page:

• Databases are Render Postgres, encrypted at rest with AES-256, including backups. We don't use database read replicas; each app's data lives on a single primary Render Postgres instance. Shopify access tokens are stored in that database, so they sit under the same encryption. We don't run a separate encryption step on the token itself.
• Everything in transit uses HTTPS. The databases accept connections only from our app servers, on a private network.
• Each app requests only the Shopify scopes it uses.
• Webhooks are checked to confirm they come from Shopify before a handler runs.
• Staff reads of protected customer data are logged, without storing the data itself, for up to 365 days (93 days for Printday).
• Secrets stay in the host environment, not in the code.

5. Sub-processors

These are the providers that process data for the apps or for tekraid.com.

If we add a provider, we'll update this page before we start using them, and we'll email the store's contact address about a significant change. You can object by writing to hello@tekraid.com. If we can't resolve it, you can uninstall, which ends processing for that app. The terms let you stop any time by uninstalling.

6. Requests from people

Shopify sends three privacy webhooks, and each TEKRAID app handles them:

• customers/data_request: a customer wants to know what we hold. We gather it and send it to you within 30 days. Where an app stores nothing about that customer, we say so.
• customers/redact: we delete what we hold about that customer's orders. Daily product totals that can't be linked to anyone stay, as the Stockday privacy section describes.
• shop/redact: sent 48 hours after you uninstall. We delete the store's data, with the exceptions in section 8.

You can also ask us for help with a request by emailing hello@tekraid.com. We complete a data-subject request within the 30 days above.

7. Personal data breaches

If a security incident affects merchant or customer data, we email the affected merchants and notify Shopify without undue delay, and within 72 hours of confirming it. We explain what happened, what data was involved, and what we did. We also notify authorities or individuals where the law requires it. The steps are on our security page.

8. Deletion

Uninstalling stops processing immediately: we end the session and stop scheduled work. Forty-eight hours later Shopify sends shop/redact, and we delete the store's app data.

• Porchday: settings, order rows, storefront events, totals, feedback, contact details, message markers, and uninstall answers. We keep the record that the store already used its free trial, and the privacy-request and access records, which go after 365 days. Promise copies are also deleted after 13 months while the app is installed.
• Sizeday: charts, rules, product overrides, and the session. Shopify removes the charts from the store. The privacy-request record goes after 365 days.
• Stockday: each order's own row is deleted after 93 days for every store, whether it's active, uninstalled, or has lapsed billing. Daily totals for each product, location, and day, which have no order id and no customer details, are deleted once they are 365 days old. After shop/redact we keep only the shop's domain and the date its free trial started, so each store gets one trial. Everything else is deleted, apart from the privacy-request and access records. For a customer data request, that record includes what we sent you: order ids with units and revenue per product, and nothing about the customer.
• Printday: templates, branding, synced business details, invoice numbers and counters, link rows, bulk-print jobs, staff flags, the staff access log, and the session. The session is ended at uninstall. Link rows, bulk-print jobs, and the staff access log are also deleted after 93 days while the app is installed. The privacy-request record stays; its report is cleared at shop/redact, and the record itself goes after 365 days.

When we receive a privacy request from Shopify, we send ourselves an internal notification email. Once it is sent, the stored copy inside Stockday keeps only the request type and reference number, not the store's details, and the internal record is deleted after 365 days. A record of each privacy request and of staff data access, including the store's domain, is kept for 365 days after it is completed so we can show we handled it, even after the store's other data is deleted. Our operational logs record the outcome of each request, including the store's domain, and are kept in Render's logs for up to 14 days.

Render keeps continuous point-in-time recovery for a rolling window of no more than 7 days, and keeps any manual export for 7 days after it is created. We don't download exports or keep other backup copies. Deleted data can therefore remain in Render-managed backups for up to about 7 days after deletion. Deleting a database instance removes all of its backups. Background job records, including queued supplier purchase-order emails, are deleted automatically within 15 days. Postmark keeps message content (including email bodies), recipient metadata and delivery/bounce activity for 45 days, then deletes it; aggregated statistics and any hard-bounce or spam-complaint suppression entries are kept until removed.

9. International transfers

The apps and their databases run in the United States. Where personal data is transferred from the EEA, the EU Standard Contractual Clauses are incorporated into this agreement by reference: Module 2 (controller to processor) for your transfers to TEKRAID LLC, and Module 3 (processor to processor) where we pass that data on to a sub-processor and Module 3 applies.

Transfers from the United Kingdom use the UK International Data Transfer Addendum to those clauses, incorporated by reference. For transfers from Switzerland, the clauses apply with the usual Swiss adjustments: the supervisory authority is the Federal Data Protection and Information Commissioner, and references to the GDPR are read as references to the Swiss Federal Act on Data Protection where that law requires it.

10. Audits

We meet audit requests with the documentation on this page, the privacy policy, and the security page, plus written answers to reasonable questions. You may ask once a year. You may ask sooner if there has been a personal data breach, or if a regulator requires it.

11. Liability

Liability under this agreement is subject to the limits in the terms of service. To the extent the law allows, the apps are provided as is, and our total liability is limited to what you paid us in the 12 months before the claim. This agreement does not raise that cap. Where the Standard Contractual Clauses set a different liability rule, section 12 applies.

12. Which document wins

If this agreement and the terms disagree about data protection, this agreement wins. If the Standard Contractual Clauses, or the UK addendum, disagree with this agreement or the terms, the clauses or the addendum win. The governing law and venue in the terms still apply to this agreement apart from those transfer clauses: the laws of the State of Michigan, and the state or federal courts located in Oakland County, Michigan.

13. Contact

Email: hello@tekraid.com
Company: TEKRAID LLC
Mail: TEKRAID LLC, 1561 West Hamlin Road, Rochester Hills, MI 48309