Data Processing Addendum

IntakePilot: Purchase orders to Shopify draft orders

Effective date: November 3, 2026

This Data Processing Addendum ("DPA") forms part of the IntakePilot Terms of Service between you, the Shopify store that installs IntakePilot ("Customer," "you"), and Alpenglow Software LLC ("we," "us," "Processor"). It applies automatically when you accept the Terms, and covers the personal data we process on your behalf through the App ("Customer Personal Data"). If this DPA conflicts with the Terms or the Privacy Policy on the processing of Customer Personal Data, this DPA controls.

1. Roles

You are the controller of Customer Personal Data (or a processor acting for your own client, in which case we are your sub-processor). We are your processor, and a "service provider" or "processor" under US state privacy laws. For usage, setup and error records we use to run our business, we act as an independent controller under our Privacy Policy, and this DPA does not apply to them.

2. Details of Processing

• Subject matter and purpose: providing the App: receiving purchase orders emailed to your forwarding address or uploaded or pasted by your staff, reading them with an AI model, matching their lines to your products and their buyer to your customers, writing draft orders (and, where needed, customers) to your Shopify store for your staff to review and approve, and related support and security.
• Nature: receipt, encrypted storage, AI reading, matching, transmission to Shopify, and deletion.
• Duration: while the App is installed, plus the deletion periods in Section 9 and the Privacy Policy.
• Categories of data subjects: your buyers and their staff who send or are named in purchase orders; your staff who forward, upload or paste purchase orders; your Shopify customers the App reads to match a buyer.
• Categories of personal data: names, business contact details (email addresses, phone numbers, ship-to and billing addresses), company names, purchase order details, email metadata (sender, subject, dates and authentication results), and any other personal data that appears in documents you send to the App. You agree not to send the data the Terms exclude (including payment card numbers). No special categories of personal data are intended.

3. Instructions

We process Customer Personal Data only on your documented instructions, which are the Terms, this DPA, and your configuration and use of the App, unless the law requires otherwise; in that case we will tell you first unless the law forbids it. We will tell you if we believe an instruction breaks data protection law.

4. Confidentiality

Anyone we authorize to process Customer Personal Data is bound by confidentiality. Our staff do not access the content of your purchase orders or the App's reading of them except with your written permission for a specific support case, to fulfil a data request, to investigate a security incident or abuse of a forwarding address, or where required by law, and we never use that content in evaluation or test sets, or to train AI or machine-learning models, unless you opt in.

5. Security

We maintain appropriate technical and organizational measures, described in Section 4 of the Privacy Policy, including encryption in transit for connections the App makes, encryption of stored original documents and of Shopify access tokens (AES-256-GCM, with keys kept in our hosting provider's secret store), shop-scoped data access, treating every document as untrusted, and deletion schedules. We may update these measures as long as the overall level of protection does not decrease.

6. Sub-processors

You give us general authorization to use sub-processors. The current list is in Section 5 of the Privacy Policy. We impose on each sub-processor, under written terms (which may be the sub-processor's standard data processing terms), data protection obligations that are no less protective than this DPA, and we remain responsible for their performance. Before we add or replace a sub-processor that processes Customer Personal Data, we will update the Privacy Policy and give at least 15 days' notice in the App. You may object on reasonable data protection grounds within that period; if we cannot address your objection, you may uninstall the App before the change takes effect.

7. Assistance

• Data subject requests: if a person contacts us about Customer Personal Data, we will refer them to you. We act on the customer data and erasure requests Shopify sends us on your behalf, and we will help you respond to requests to access, correct, delete, or export data within 30 days.
• Impact assessments and consultations: we will give you reasonable information about the App's processing to help with data protection impact assessments and consultations with authorities.
• Personal data breaches: if we become aware of a personal data breach affecting Customer Personal Data, we will notify Shopify within 24 hours, as our agreement with Shopify requires, and then notify you without undue delay and in any event within 72 hours of becoming aware of it, with the information you reasonably need to meet your own obligations, and we will take reasonable steps to contain it.

8. Audits

On written request, and no more than once a year unless a breach or an authority requires it, we will provide the information reasonably necessary to demonstrate our compliance with this DPA, starting with written answers to a security questionnaire. If that information is not sufficient to demonstrate compliance, you (or an independent auditor you appoint, bound by confidentiality) may conduct a reasonable audit on at least 30 days' notice, during business hours, at your cost, and in a way that does not compromise other customers' data. Requests go to the contact address below.

9. Deletion and Return

While the App is installed, original documents and the App's reading of them are deleted on the schedule in Section 6 of the Privacy Policy. When you uninstall the App, Shopify sends us a shop erasure request (typically 48 hours later), and on receiving it we permanently delete all Customer Personal Data associated with your store. Before uninstalling, you may ask for a copy of your data. Draft orders, orders, customers, tags and notes the App wrote to your store stay in Shopify under your control. Our email provider keeps each email received for your forwarding address for 30 days, as described in the Privacy Policy.

10. International Transfers

We process Customer Personal Data in the United States, and our sub-processors may process it where they operate. Where a transfer of personal data from the European Economic Area, Switzerland, or the United Kingdom to us requires a transfer mechanism, the following are incorporated into this DPA by reference:

• the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 ("SCCs"), Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor, with you as data exporter and us as data importer. Clause 7 (docking) does not apply; Clause 9 option 2 (general authorization, with the notice period in Section 6) applies; the optional wording in Clause 11 does not apply; Clauses 17 and 18 are governed by, and disputes resolved in the courts of, Ireland; and Annexes I and II are completed by Sections 2 and 5 of this DPA, with the competent supervisory authority determined under Clause 13;
• for transfers from the United Kingdom, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0), with the tables completed by this DPA and either party able to end it as allowed by its Section 19; and
• for transfers from Switzerland, the SCCs as adapted for the Swiss Federal Act on Data Protection, with the Swiss Federal Data Protection and Information Commissioner as the competent authority.

If the SCCs conflict with this DPA, the SCCs control.

11. US State Privacy Laws

Where US state privacy laws (such as the California Consumer Privacy Act) apply, we act as your service provider or processor. We will not sell or share Customer Personal Data (as those laws define "sell" and "share"); retain, use, or disclose it for any purpose other than providing the App to you, or outside our direct business relationship with you; or combine it with personal data we receive from other sources, except as those laws allow. We will comply with our obligations under those laws and provide the same level of privacy protection they require of you; you may take reasonable and appropriate steps to ensure we use Customer Personal Data consistently with your obligations, and, on notice, to stop and remediate unauthorized use; and we will bind our sub-processors to the same restrictions. We will tell you if we can no longer meet these obligations.

12. Liability

Each party's liability under this DPA is subject to the limitations of liability in the Terms, except where the law does not allow it.

13. Contact