Attach merchant processing terms
Agreement version 3. Effective when the merchant's authorized Shopify account owner accepts these terms in Attach. Attach is operated by Pepper Labs. Contact raymondxma@gmail.com.
Parties and instructions
These terms apply between Pepper Labs and the merchant identified by the Shopify store accepting them. The merchant determines why customer files are collected and acts as controller of that customer data. Pepper Labs processes those files and related order identifiers on the merchant's behalf to provide Attach. Selecting products, enabling uploads, choosing a plan and using authenticated retrieval/deletion controls are documented processing instructions, subject to these terms and applicable law.
Scope of processing
The service collects one optional file per configured product/cart line, limited to the file categories the merchant enables for that product (photos (JPEG, PNG, HEIC, WebP); pdf (PDF); design files (SVG, AI, EPS, PSD); zip archives (ZIP); office documents (Word, Excel, PowerPoint); video (MP4, MOV, WebM)) and to the plan's maximum file size (Starter: 50 MB; Growth: 250 MB; Scale: 2 GB). Executables, scripts and web pages are never accepted. Processing consists of private upload in parts, integrity/type/size inspection, for photos up to 20 MB decoding and sanitized-preview generation, storage, exact cart/order-line association, authenticated retrieval/export and deletion. Data includes originals and their embedded metadata, previews, filenames, checksums, byte counts, file types, states/expiries and store/product/variant/cart/session/order/line identifiers. Data subjects are customers submitting files and account owners using the service. Files can include faces, documents, addresses, location metadata or other personal information even though Attach does not request Shopify customer contact fields.
Merchant responsibilities
Request only files necessary for the order and enable only the file categories you need, establish an appropriate legal basis, provide customers with relevant privacy/retention notices and handle their rights requests. Do not request sensitive or unrelated information through Attach. Obtain any required consent before collection and respect a customer's decision to purchase without a file. ZIP archives and Office documents can contain other files, macros or links: Attach checks their type but does not open or scan them, so open them only with appropriate care. Keep authenticated account-owner access secure and export needed originals before expiry. These terms do not authorize collection that is unlawful or outside the described service.
Purpose and confidentiality
Pepper Labs uses customer upload data only for the instructed service, security, limits and rights/deletion handling. We do not sell it, use it for advertising, train models on it or make legally significant automated decisions about customers. Personnel with operational access must be authorized and keep the data confidential. Merchant authentication, service-account security and Shopify billing records are processed separately as needed to operate and administer the service.
Security and limits
Originals use private storage and authenticated, scoped access. Merchant file operations require verified Shopify account-owner access. Downloads use an isolated origin and short-lived links, and originals are always delivered as downloads, never opened in the browser; stored previews strip metadata. Storefront adds include an unguessable, unexpiring link in the visible line-item property to the sanitized preview, or for files without a preview a page showing only the file's name, type and size; it stops working when the file is no longer available. Service-provider protections include encryption at rest and TLS in transit. Size, integrity and file-type checks are required before a file is ready; photos up to the decode limit must also decode successfully. Originals are byte-identical and retain their metadata. No antivirus scan, malware-safety certification, universal theme compatibility or individual-file backup/restore guarantee is provided.
Service providers and transfers
The merchant authorizes Cloudflare for Workers, private R2, D1/KV and Images processing for photo previews, and Shopify for platform installation/authentication, billing, storefront and order identity. These providers can process data internationally under their applicable security and data-protection arrangements. No particular data-residency region is promised. Contact us before using Attach where additional contractual transfer safeguards or residency requirements are necessary. We will notify merchants of material changes to our processing providers or purposes and provide a way to stop new collection and export retained files.
Retention, plan changes and termination
Unattached files expire 14 days after creation. A new file records its ordered-retention contract when reserved: Starter: 90 days; Growth: 180 days; Scale: 365 days from actual order creation, including canceled/refunded orders. Existing contracts are preserved on plan changes. Cancellation or a lower capacity stops new uploads as applicable without immediately deleting retained archives. Deliberate merchant deletion, verified uninstall and Shopify privacy instructions can require earlier removal. Access is revoked before physical deletion, which is retried if necessary. Identifying file mappings, original names and checksums are erased when deletion completes.
Provider disaster-recovery systems follow their own retention controls; immediate erasure from every backup is not promised. Restored service data must be checked against applicable deletion instructions before making it available. Limited acceptance, billing and opaque security/deletion records can be retained where necessary for accountability and legal obligations, with restricted access.
Rights requests, incidents and assistance
The merchant is the customer's primary contact. Pepper Labs assists with appropriate access/export, correction and deletion requests through verified merchant instructions and the support contact, and processes Shopify's mandatory privacy webhooks. We do not disclose originals to an unverified requester. We will notify affected merchants without undue delay after becoming aware of a personal-data breach, provide relevant available information and cooperate with necessary remediation and legally required notices. Reasonable information about these controls and relevant processing records is available to the merchant for compliance review.
Acceptance and changes
Attach records the agreement version, UTC acceptance time, Shopify store, verified accepting owner's identifier and installation epoch. Acceptance is required before new collection. Material changes require a new version and renewed acceptance; existing file expiries and authorized retained-file access are preserved. To withdraw instructions, disable new uploads, export retained originals and use deletion/uninstall controls as appropriate.