Data Processing Agreement

Last updated: 2026-10-23

This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Agreement") between Novogn LLC ("Novogn," "Processor") and the Shopify merchant that installs Autoprinter ("Merchant," "Controller"). This DPA governs Novogn's processing of Personal Data on the Merchant's behalf in connection with Autoprinter (the "Service").

Effective October 19, 2026, Econocraft Materials LLC assigned the Agreement and this DPA to Novogn LLC, which now owns and operates the Service and acts as Processor. The processing and security measures described in this DPA did not change with the assignment. Separately, on the same date Novogn moved email for autoprinter.app addresses from Cloudflare forwarding to Google Workspace (Section 7).

Where the Merchant is subject to the EU General Data Protection Regulation ("GDPR"), the UK GDPR, the Swiss Federal Act on Data Protection, or the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), this DPA is binding and governs as the data protection addendum under those laws. By installing or continuing to use Autoprinter, the Merchant enters into this DPA.

1. Definitions

Capitalized terms not defined here have the meanings given in the GDPR or the CCPA, as applicable.

• Personal Data: any information relating to an identified or identifiable natural person that Novogn processes on the Merchant's behalf through the Service.
• Data Subject: the identified or identifiable natural person to whom Personal Data relates.
• Subprocessor: a third party engaged by Novogn that processes Personal Data in providing the Service.
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.
• Processing: any operation performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, use, disclosure, or deletion.

2. Roles

• The Merchant is the Controller (or "Business" under the CCPA) of Personal Data processed through the Service.
• Novogn is the Processor (or "Service Provider" under the CCPA), acting on the Merchant's documented instructions.
• The Merchant's configuration of the Service (choice of templates, Print Rules, Label Source and Print Station assignments, and equivalent settings) constitutes a documented instruction under this DPA.
• This DPA applies only to Personal Data that Novogn processes on the Merchant's behalf. Processing of merchant account metadata, support communications, security logs, diagnostics, and product analytics for Novogn's own operations is described in the Privacy Policy and is not governed by this DPA.

3. Scope, Nature, and Purpose of Processing

Subject matter. Novogn processes Personal Data to provide Autoprinter, a printing-automation service for Shopify merchants.

Nature of the processing. Reading order data from the Shopify Admin API; rendering documents (packing slips, invoices, pick slips, return slips, gift receipts, and associated shipping-label workflows) on the Merchant's behalf; storing rendered documents (for a limited time), print job records, and associated metadata; transmitting rendered documents to paired local printers via the Desktop Utility and Chrome Extension.

Duration. The term of the Agreement and the retention period described in the Data Retention Policy.

Categories of Data Subjects.

• End customers of the Merchant whose orders are processed through the Service.
• The Merchant's authorized staff who operate the Service.

Categories of Personal Data.

• Identification and contact data: names, shipping and billing addresses, email addresses, phone numbers.
• Order data: order identifiers, line items, product information, prices and totals, discounts, payment method names, order notes, fulfillment status, order tags, custom attributes.
• Merchant staff and device metadata: Label Source and Print Station names, hostnames, operating-system platform, app versions, printer names.

4. Merchant Instructions

Novogn processes Personal Data only on the Merchant's documented instructions, including those set out in the Agreement, this DPA, and the Merchant's configuration of the Service, unless processing is required by applicable law. If Novogn believes an instruction violates applicable data protection law, it will notify the Merchant without undue delay.

5. Confidentiality

Novogn ensures that personnel authorized to process Personal Data are bound by written confidentiality obligations or appropriate statutory confidentiality duties.

6. Security Measures

Novogn implements and maintains appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include:

• Encryption in transit. TLS 1.2 or higher for all network connections to the Service.
• Encryption at rest. PostgreSQL at-rest encryption provided by Railway.
• Authentication. SHA-256 hashing of device pairing tokens; raw tokens are returned to the paired client once at pairing time and are never stored by Novogn.
• Error-report redaction. Request bodies, cookies, and authentication headers are stripped, and email and IP addresses are filtered where they can be detected, before any error report is transmitted to Sentry.
• Scoped API access. The Service requests only read-only Shopify scopes (read_orders, read_products, read_fulfillments, read_shipping, read_payment_terms, read_customers, read_merchant_managed_fulfillment_orders, read_third_party_fulfillment_orders, read_locations, and unauthenticated_read_product_listings; purposes are listed in the Privacy Policy) and never changes the Merchant's orders, products, customers, or other store data.
• Rate limiting. Public endpoints are rate-limited to deter brute-force and abuse.
• Access control. Production systems are accessible only to authorized Novogn personnel using unique credentials and multi-factor authentication where supported by the underlying platform.
• Logging. Print-job lifecycle events are logged for diagnostic and audit purposes and are deleted together with their print job record.

Novogn will periodically review and, where appropriate, update these measures.

7. Subprocessors

The Merchant authorizes Novogn to engage the Subprocessors listed below. Each Subprocessor is engaged under a written agreement that imposes data protection obligations no less protective than those in this DPA.

Novogn will notify the Merchant at least 30 days before adding or replacing any Subprocessor by (a) posting an updated list at autoprinter.app and (b) sending an email or in-app notice to the merchant contact associated with the Shopify installation. The Merchant may object to a new Subprocessor in writing during that notice period on reasonable data protection grounds. If the parties cannot resolve the objection, the Merchant may terminate the Agreement under its Termination provisions.

8. International Data Transfers

Novogn's primary Subprocessors are located in the United States. Where Personal Data is transferred from the European Economic Area, the United Kingdom, or Switzerland to the United States or another third country, the transfer is carried out under the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914 of 4 June 2021), with Novogn LLC acting as data importer under Module Two (controller-to-processor) or, for onward transfers to Subprocessors, Module Three (processor-to-processor), as applicable. For transfers from the United Kingdom, the UK International Data Transfer Addendum (version B1.0) to the EU Standard Contractual Clauses, issued by the UK Information Commissioner's Office, applies. For transfers from Switzerland, the EU Standard Contractual Clauses apply with the adaptations required for Swiss data-protection law and recognized by the Swiss Federal Data Protection and Information Commissioner. The Merchant and Novogn are deemed to have entered into these clauses through their acceptance of this DPA.

9. Data Subject Requests

Novogn will, to the extent permitted by law, promptly notify the Merchant of any request received directly from a Data Subject. Novogn will not respond to the request itself except to confirm receipt and to direct the Data Subject to the Merchant, unless required by applicable law.

Novogn will provide reasonable assistance to the Merchant, at the Merchant's cost, in responding to Data Subject requests to exercise rights of access, rectification, erasure, restriction, portability, or objection. Taking into account the nature of processing and the information available to Novogn, Novogn will also reasonably assist the Merchant with the Merchant's obligations under GDPR Articles 32–36, including security of processing, personal-data-breach assessment and notification, data protection impact assessments, and prior consultations with supervisory authorities. Where Novogn receives a valid Shopify customers/data_request webhook, it will provide the Merchant with the responsive customer and order data identified by Shopify to the extent that data remains in Autoprinter. Where Novogn receives a valid Shopify customers/redact webhook, it will delete the rendered documents and print-job records for the orders Shopify names, and anonymize their order-count records, within 30 days in compliance with Shopify's service-level requirement, without requiring separate instruction from the Merchant. Shipping labels that could not be tied to an order ID (for example, labels printed in bulk, or orders that use a custom order-number format), and the order-count records kept under the same order number, cannot always be matched to a Data Subject; they are retained as set out in the Data Retention Policy.

10. Personal Data Breach Notification

Novogn will notify the Merchant in writing without undue delay and, in any event, within 72 hours after becoming aware of a Personal Data Breach affecting the Merchant's Personal Data. Novogn may provide information in phases as it becomes available. The notification will include, to the extent known at the time: the nature of the Breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address the Breach. Novogn will cooperate with the Merchant's reasonable investigation and remediation efforts.

11. Audit Rights

The Merchant may request, no more than once per calendar year, a written summary of Novogn's security posture, including a description of the technical and organizational measures listed in Section 6 and any material changes since the prior summary. Novogn will provide this summary within 30 days of a written request.

Merchants do not have live access to Novogn's production systems. Where a Merchant's regulator or auditor requires additional information to demonstrate compliance, Novogn will respond to reasonable written inquiries and will cooperate in good faith to satisfy the regulator's or auditor's requirements, subject to reasonable confidentiality protections.

12. Return or Deletion of Personal Data

On termination of the Agreement, Novogn will, at the Merchant's election, either return or delete Personal Data processed on the Merchant's behalf, to the extent technically available, and will delete remaining copies, except to the extent that retention is required by applicable law. Absent a contrary election communicated before uninstall, Novogn will delete all such Personal Data within 30 days of the Shopify app/uninstalled webhook, except Personal Data that may appear in error reports and server logs, which is deleted on the schedules in the Data Retention Policy (no more than 90 days).

Database backups exist for disaster recovery only, are deleted automatically within 12 months, and are not used for any other purpose. If a backup containing previously-deleted Personal Data is restored for disaster-recovery reasons, Novogn will re-run the applicable deletion process so the restored records are removed again. Detailed schedules are set out in the Data Retention Policy.

13. CCPA-Specific Terms

To the extent Novogn processes Personal Information of California residents under the CCPA, Novogn:

• acts as a Service Provider on the Merchant's behalf;
• will not sell or share Personal Information;
• will not retain, use, or disclose Personal Information for any purpose other than performing the Service specified in the Agreement, or as otherwise permitted by the CCPA;
• will not retain, use, or disclose Personal Information outside of the direct business relationship between Novogn and the Merchant;
• will not combine Personal Information received from the Merchant with Personal Information received from any other source, except as permitted by the CCPA; and
• will comply with applicable obligations under the CCPA and provide the same level of privacy protection as required of businesses under the CCPA; and
• will notify the Merchant if Novogn determines that it can no longer meet its obligations under the CCPA with respect to Personal Information processed under this DPA.

The Merchant may take reasonable and appropriate steps to ensure that Novogn uses the Personal Information in a manner consistent with the Merchant's obligations under the CCPA, and to stop and remediate unauthorized use of Personal Information.

14. Liability

Each party's liability under this DPA is subject to the limitations of liability in the Agreement.

15. Precedence

If there is a conflict between this DPA and the Agreement, this DPA controls to the extent of the conflict and only with respect to the processing of Personal Data.

16. Contact

Data protection inquiries:

Novogn LLC 14255 N 79th St STE 4 Scottsdale, AZ 85260 United States Email: support@autoprinter.app