DPA
Data Processing Addendum
SnapIT: AI Virtual Try On · Last updated: August 2026
This Data Processing Addendum (“DPA”) forms part of the agreement between the merchant (“Controller”, “you”) and SnapMyDesign (“Processor”, “we”) for use of the SnapIT Shopify application.
1. Roles
- You are the data controller for your customers' and visitors' personal data.
- We are the data processor, processing personal data only on your documented instructions via the app and Shopify mandatory webhooks.
2. Personal data processed
| Category | Examples | Purpose |
|---|---|---|
| Shopper images | Selfies, try-on results | Virtual try-on |
| Identifiers | Pseudonymous session / external user IDs, Shopify customer ID (when logged in) | Session linking, compliance |
| Product context | Product ID, SKU, title, page URL | Try-on generation |
| Merchant data | Shop domain, merchant email, OAuth tokens | App operation, billing |
We do not sell personal data.
1. Roles
- You are the data controller for your customers' and visitors' personal data.
- We are the data processor, processing personal data only on your documented instructions via the app and Shopify mandatory webhooks.
3. Security measures
- TLS encryption in transit
- Encrypted storage of API keys at rest
- GCP Secret Manager for credentials
- Role-based access to production systems with MFA
- Structured audit logging for personal data operations
4. Retention and deletion
- Try-on logs: 30 days, then automatic deletion
- Images on SnapMyDesign: 30 days for quality assessment, unless earlier deletion is required by a valid redaction request
- We process Shopify customers/data_request, customers/redact, and shop/redact webhooks within our documented SLA (48 hours for shop redact per Shopify policy)
5. Data subject requests
You are responsible for responding to data subject requests. We assist by:
- Exporting try-on records on customers/data_request
- Deleting or de-identifying records on customers/redact
- Erasing all shop data on shop/redact
6. Breach notification
- We will notify you without undue delay (and within 72 hours where feasible) after becoming aware of a personal data breach affecting your shoppers' data.
7. Audits
- Upon reasonable written request, we will provide information necessary to demonstrate compliance with this DPA.
8. Contact
Data protection contact: contactus@snapmydesign.com