Data Processing Terms — Noshi Print (Shopify app)

Effective 2026-10-22. These terms apply between the merchant who installs the Noshi Print app on a Shopify store (the "Merchant") and Rulestamp, the developer of the app (the "Developer", contact [email protected]). They describe how the Developer processes personal data on the Merchant's behalf. See also the privacy policy.

1. Roles

The Merchant is the controller of its store's order data. The Developer processes that data only as a processor, only to provide the app's features the Merchant uses, and only on the Merchant's instructions given by using the app.

2. Data processed

• Order id and order number, order created date and fulfillment status.
• Line-item titles and quantities.
• The noshi line-item properties a shopper types on the product page: occasion (のし用途), inscription (表書き), cord (水引), placement (のし掛け) and the names to print (名入れ).

The app does not request customer names, email addresses, phone numbers, shipping or billing addresses, IP addresses or location. The only Shopify access scope is read_orders.

3. Purpose

Rendering and printing the noshi (Japanese gift paper) that the Merchant asks to print. No other purpose, no profiling, no marketing, no sale or sharing of data.

4. Where and how long

• App screen: the Merchant's browser reads the orders directly from Shopify (Shopify direct API access) and builds the previews and PDFs inside the browser. This data is not sent to the Developer.
• Print menu: a request from the Shopify admin Print menu reaches the Developer's code on Cloudflare Workers, which reads the selected orders from Shopify for that request only and returns the printable page.
• Retention: nothing is stored — no database, no files, no logs of order content, no stored access tokens. Data exists only in memory for the duration of a single print request.

5. Sub-processors

• Cloudflare, Inc. — edge hosting of the print request.
• Shopify — the platform on which the store and the orders live.

The Developer will list any new sub-processor on this page before using it.

6. Security

All traffic uses HTTPS/TLS. Requests from the Shopify admin are authenticated with Shopify session tokens and exchanged for short-lived access tokens; Shopify webhooks are verified with HMAC signatures. No order data is kept at rest.

7. Data subject requests

Requests from customers are handled through the Merchant and Shopify. The app answers Shopify's mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact); because the Developer holds no copy of the data, there is nothing to return or erase. The Developer will help the Merchant answer any request by email.

8. Personal data breach

If the Developer becomes aware of a personal data breach affecting the Merchant's data, it will notify the store's contact email without undue delay and in any case within 72 hours, with the facts known at that time.

9. Deletion and term

These terms apply while the app is installed. Because nothing is retained, uninstalling the app leaves no Merchant data with the Developer.

10. Acceptance

By installing and using the app, the Merchant accepts these terms. Questions: [email protected].

データ処理規約 — のし印刷（Shopify アプリ）