ModdiDraft. This page has not been reviewed yet and will change before launch.
Data Processing Addendum
Last updated November 1, 2026
This addendum ("DPA") forms part of the terms of service between Moddi Apps Ltd ("Moddi", the processor) and the business using Moddi ("you", the controller). It applies where Moddi processes personal data on your behalf and the UK GDPR, the EU GDPR or similar laws apply. If it conflicts with the terms about personal data, this DPA wins. It takes effect when you install Moddi, with no signature needed.
1. What we process
- Subject matter and purpose: providing Moddi (a catalog editor with bulk edits, automations, history, translations and AI writing tools) as described in the terms.
- Duration: while Moddi is installed on your store, plus the deletion period in section 8.
- Types of personal data: mainly business data about your products, which usually isn't personal. It can include names, emails or similar details that you put in catalog fields, and the name, email and Shopify user ID of your staff who use Moddi. Moddi does not sync customers or orders.
- People it relates to: your staff, and anyone whose details you choose to put in your catalog.
2. Our commitments
We will:
- process personal data only on your documented instructions, which are the terms, this DPA, and your use of Moddi's features, unless the law requires otherwise (we will tell you if so, where allowed);
- make sure everyone who can access it is bound by confidentiality;
- keep it secure (section 4);
- help you respond to requests from people exercising their data rights, and with security, breach notification, impact assessments and consultations with regulators, taking into account the nature of the processing and the information we have;
- tell you if we think an instruction breaks data protection law; and
- give you the information needed to show we comply with this DPA, and allow audits as set out in section 7.
3. Your responsibilities
You confirm that you have a lawful basis to give us the personal data, that your instructions are lawful, and that you have given any notices needed to the people concerned. Please do not put sensitive categories of personal data (such as health data) or government ID numbers in Moddi.
4. Security
We use measures suited to the risk, including: encryption in transit; access to production systems limited to those who need it and protected by strong authentication; separation of each store's data in our database; secrets kept out of code; Shopify access tokens deleted on uninstall; logging and monitoring; and prompt updates to the software we use. We review these measures from time to time.
5. Sub-processors
You agree to our use of the sub-processors below and we have written agreements with each that require protections equivalent to this DPA. We remain responsible for their work. We will tell you at least 30 days before adding or replacing one that handles your personal data, by email or in the app. You may object on reasonable data protection grounds within that time. If we cannot resolve it, you can stop using Moddi and uninstall.
| Provider | What for | Data involved | Location |
|---|---|---|---|
| Fly.io | Hosts the Moddi app and its background jobs | Everything the app handles while running (store data in memory, request logs) | United Kingdom (London) |
| Supabase | Hosts the Moddi database (Postgres) | Your catalog copy, drafts, history, settings, AI usage records | United Kingdom (London) |
| Anthropic | AI writing, translation and alt text (Claude models) | Only the text or image a task needs, for example a product title and description to translate | United States |
| Sentry | Error tracking, so we can find and fix crashes | Technical error reports: the error, where in the code it happened, the page path (no query strings), and your store's domain. No cookies, request data, or what you typed | European Union (Germany) |
| Resend | Sends Moddi's emails (alerts, welcome and review requests) | Store email address and the notice being sent | United States |
| Featurebase | In-app support chat, help center, changelog and feature requests | Staff name and email, store domain, and what you write to us | United States |
| Google Workspace | Our support email inbox | Emails you send to support@moddi.app | United States / EU |
6. International transfers
We may transfer personal data outside the UK and EEA only with a lawful safeguard, such as an adequacy decision (for example the UK-US data bridge), the UK International Data Transfer Addendum, or the EU Standard Contractual Clauses (module two, controller to processor, and module three where needed). Where a transfer needs those clauses, they are incorporated into this DPA, with the details in sections 1 and 5 serving as their annexes.
7. Breaches and audits
If we become aware of a personal data breach affecting your data, we will tell you without undue delay, and normally within 72 hours, with what we know about it, what we are doing, and how to reduce its effects. Once a year, or after a breach, you may ask for the information we have to show compliance. If that is not enough, you may carry out an audit, on reasonable notice, during business hours, at your own cost, and in a way that does not put other customers' data at risk.
8. Deletion and return
When you uninstall Moddi, we delete your access tokens immediately. After Shopify sends the request to erase your store's data (about 48 hours after uninstall), we delete the store's data and everything linked to it, apart from what the law requires us to keep. Deleted data may remain in encrypted backups for a limited period until they are overwritten. Before you uninstall, you can export your data using Moddi's export features.
9. Liability
Each party's liability under this DPA is subject to the limits in the terms of service, except where the law does not allow that.
10. Contact
Send questions about this DPA, or a signed copy request if your organization needs one, to support@moddi.app. Moddi Apps Ltd, 124 City Road, London, EC1V 2NX, United Kingdom.