Terms of Service & Data Processing Terms

These terms form the agreement between SmileBulk ("we") and the merchant who installs the SmileBulk Hub app ("you"). By installing the app you accept these terms and our Privacy Policy. If you do not agree, uninstall the app.

1. The service

The app registers SmileBulk as a fulfillment service on your store and lets you import SmileBulk products (with your wholesale cost). When you request fulfillment for a paid order, SmileBulk accepts it, issues a payment link for the wholesale price plus shipping, ships to your customer and adds the tracking number to your order. Wholesale pricing and commercial terms are set by your SmileBulk wholesale account.

2. Roles

For your customers' personal data, you are the controller and SmileBulk is your processor. We process that data only on your documented instructions — installing the app and placing orders with SmileBulk products instructs us to fulfill those orders.

3. Data processed & purpose

• Categories: your customers' name, shipping address and phone number, plus order line items.
• Purpose: solely to fulfill and ship your orders and return tracking. Never for marketing, profiling, resale or automated decision-making.
• Duration: for as long as the app is installed. We do not keep a separate copy of your customers' personal data; it is held in Shopify.

4. Our obligations as processor

• Confidentiality: only authorized personnel bound by confidentiality can access the data.
• Security: encryption in transit (HTTPS), encrypted backups, access control with two-factor authentication, access logging, and a documented incident response procedure.
• Sub-processors: Shopify (platform), our hosting provider (Tencent Cloud, Singapore) and the shipping carriers needed to deliver each order. We will inform you of changes.
• Breaches: we notify you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your data.
• Assistance: we help you answer data subject requests; Shopify's GDPR webhooks are implemented.
• Deletion: on uninstall, your access token is revoked and your store's record is deleted when Shopify sends shop/redact.
• International transfers: data may be processed outside your country (Singapore servers, China-based fulfillment) with the safeguards described here.

5. Your obligations

You are responsible for having a lawful basis and a privacy notice for sharing your customers' data with us for fulfillment.

6. Liability & changes

The app is provided as is, free of charge; our liability is limited to the extent permitted by law. We may update these terms and will note the effective date above. Questions: hello@smilebulk.com.