Data Processing Addendum

Helm Store Sync (the Helm app for Shopify) · Last updated: July 15, 2026

In short. When a merchant connects Shopify to Helm using Helm Store Sync, Helm processes a limited set of the merchant’s customer order data (name, shipping address, and email) only to create and fulfill orders. The merchant is the controller of that data, and Helm is the processor acting on the merchant’s instructions. Helm does not sell or share that data and does not use it for advertising, profiling, or model training.

1. Scope and roles

This Addendum governs Helm’s processing of personal data on behalf of a merchant (“Controller”) when the merchant uses Helm Store Sync (the “App”). The merchant is the Controller of its customers’ personal data. Helm Social, Inc. (“Helm”) is the Processor, acting only on the merchant’s documented instructions, which are to synchronize the merchant’s catalog and to mirror and fulfill orders.

2. Details of processing

Item	Detail
Categories of data	Order shipping name, address, and email
Data subjects	The merchant’s customers who place orders synced through the App
Purpose	Order creation, order fulfillment, and catalog and inventory synchronization
Duration	The order and fulfillment lifecycle, plus any legally required retention

Helm processes only the minimum data required for these purposes and does not access the merchant’s customer list, phone numbers, or any other customer fields.

3. Sub-processors

Helm uses the following sub-processors to provide the App: Shopify (source and destination of the data), Helm’s hosting and database provider, and Stripe (payment processing at Helm checkout). Helm remains responsible for its sub-processors and will give notice of material changes.

4. Security measures

Helm maintains the technical and organizational measures described in its Information Security Policy, including encryption in transit (TLS) and at rest, least-privilege access controls, logging of access to personal data, storage of access tokens on the server side only, and an incident-response process. Development and production run in separate environments against separate databases.

5. International transfers

Helm operates from the United States. Where personal data is transferred across borders, Helm relies on lawful transfer mechanisms as required by applicable law.

6. Data subject requests and deletion

Helm assists the Controller in responding to data-subject access and deletion requests and supports Shopify’s compliance webhooks: customers/data_request, customers/redact, and shop/redact. On uninstall or termination, Helm deletes the Controller’s stored data, subject to legal retention requirements.

7. Breach notification

Helm will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller’s data, and will notify Shopify and any regulators as required by applicable law.

8. No sale or secondary use

Helm does not sell or share personal data and does not use it for advertising, profiling, automated decision-making, resale, or AI model training. Helm uses the data solely to provide the App.

9. Contact

Helm Social, Inc.
Security and data protection: security@helmsocial.app
General: hello@helmsocial.app

See also our Privacy Policy, including the Shopify integration section.