Contact Me! Data Processing Agreement
Effective date: 2 November 2026 Service provider/processor: Fancylab, a California, USA company Merchant/controller: The Shopify merchant using Contact Me!
This DPA applies to personal data processed by Fancy Lab on the merchant's behalf through Contact Me! and forms part of the Terms of Service. A separately signed DPA controls where it conflicts with this document.
Roles and instructions
The merchant decides why and how customer submissions are collected and is the controller, business, or equivalent decision-maker. Fancy Lab is the processor, service provider, or equivalent. Fancy Lab processes submissions only to provide, secure, support, maintain, and delete Contact Me!, or as required by law. Fancy Lab does not sell customer submissions or use them for cross-merchant advertising.
Processing details
| Item | Description |
|---|---|
| Subject matter | Storefront submissions, notifications, support, security, and app operation |
| Duration | While the merchant uses the app, plus deletion, backup, legal, security, and dispute periods |
| Nature | Collection through the app proxy, validation, Shopify metaobject storage, merchant inbox display, analytics, transactional email, abuse prevention, and deletion |
| Personal data | Names, email addresses, phone numbers, free text, choices, dates, URLs, attribution/campaign data, file metadata, and technical request metadata |
| Data subjects | Store visitors, customers, leads, wholesale contacts, and other form submitters |
| Sensitive data | The merchant must not collect sensitive or special-category data without a lawful basis, safeguards, and any required prior written approval |
Merchant obligations
The merchant will use the app lawfully; provide privacy and consent notices; collect only necessary data; authorize staff and contractors; respond to data-subject and regulator requests; maintain retention rules; and tell Fancy Lab if an instruction would violate applicable law.
Security and confidentiality
Fancy Lab will require personnel with access to personal data to keep it confidential and will maintain reasonable measures appropriate to risk, including HTTPS/TLS, Shopify authentication, scoped API access, validation, rate limiting, access controls, credential protection, and deletion workflows. The merchant must secure its Shopify account, staff permissions, and any exports.
Subprocessors
| Provider | Purpose | Data |
|---|---|---|
| Shopify | Platform, metaobjects, metafields, authentication, billing, storefront delivery | Merchant data, forms, submissions, configuration |
| Postmark | Transactional email and bounce/spam-complaint events | Email addresses, rendered messages, sender/reply-to details, shop identifier, delivery events |
| Fancy Lab hosting/infrastructure providers | Runtime and OAuth-session storage | Sessions, logs, request metadata |
The merchant authorizes these providers and future replacements for legitimate service purposes. Fancy Lab will impose appropriate obligations on subprocessors and remains responsible for their processing to the extent required by law. Objections may be sent to support@fancylab.com.
Processing may occur outside the merchant's country. Fancylab is located in California, USA. [Insert service-provider locations and the applicable transfer mechanism, such as standard contractual clauses, after legal review.]
Assistance, incidents, and deletion
Fancy Lab will reasonably assist with access, correction, deletion, restriction, portability, objection, and similar requests involving data handled by Contact Me!. The merchant must provide the shop, scope, deadline, and lawful instruction. Fancy Lab will notify the merchant without undue delay after confirming a security incident involving the merchant's data, to the extent legally permitted and reasonably known; the merchant remains responsible for regulator and individual notifications where required.
At the merchant's request, on termination, or when required by law, Fancy Lab will delete or return personal data unless retention is legally required or the data remains with Shopify or another provider under that provider's separate relationship with the merchant. App uninstall and Shopify redaction workflows are designed to delete app-owned records and OAuth sessions, subject to processing time and backup retention.
Fancy Lab will provide reasonable written information needed to demonstrate compliance, subject to confidentiality, security, and non-disruption requirements. This DPA does not expand liability beyond the Terms of Service except where applicable data-protection law requires it.