Effective date: October 17, 2026

This Privacy Policy explains how JPGStudios LLC, with an address at 201 Mountain Rest Road, New Paltz, NY 12561, United States (JPGStudios, Privacy Desk, we, us, or our), collects, uses, discloses, and protects personal information in connection with the Privacy Desk Shopify application, related websites, communications, and support services (collectively, the Service).

This Policy applies to Shopify merchants and their personnel who install, access, or communicate with Privacy Desk, visitors to our websites, and individuals whose information we process for our own business purposes. When Privacy Desk processes personal information submitted by a merchant or a merchant’s customer solely on the merchant’s behalf, the merchant controls that processing and JPGStudios acts as a service provider or processor. That processing is also governed by the Privacy Desk Data Processing Addendum.

1. Information we collect

Depending on how you interact with the Service, we may collect the following categories of information.

Merchant and Shopify account information

• Shopify shop domain and identifiers;
• installation, authentication, access-scope, and application configuration information;
• authorized Shopify administrator or staff information made available by Shopify, such as user ID, name, email address, locale, account role, and verification status;
• subscription, plan, billing-status, and entitlement information made available through Shopify; and
• merchant-selected settings, including retention settings and configured communication preferences.

Privacy-request and case information

When an individual submits a request through a merchant’s Privacy Desk form, or when a merchant records or manages a request, we may process:

• first and last name;
• email address, telephone number, company, and country or region;
• selected jurisdiction and request type;
• comments and other information included in the request;
• request identifiers, submission method, status, verification status, assignment, deadlines, and timestamps;
• response summaries, denial reasons, internal notes, decisions, and case activity; and
• export history and other records created while a merchant handles the request.

Merchants determine which information to collect and how to respond to privacy requests. Requesters should avoid submitting payment-card data, passwords, government identifiers, health information, biometric data, or other information that is not necessary for the request.

Shopify privacy-compliance information

We may receive Shopify’s mandatory privacy-compliance webhooks, including shop and customer identifiers, customer email or telephone information, relevant order identifiers, request identifiers, request type, and timestamps. We use this information to identify potentially matching Privacy Desk records and support access, deletion, and shop-erasure workflows.

Communications and email-delivery information

We collect information that you provide when contacting us for support, privacy, security, legal, or business inquiries. When Privacy Desk sends a transactional acknowledgment email, we and our email provider process the recipient address, sender and reply-to information, request reference, message content, message identifier, delivery status, bounce or complaint information, and related delivery metadata. Transactional acknowledgment emails are sent with tracking disabled, but delivery events are processed to show whether an email was accepted, delivered, deferred, failed, or reported as spam.

Usage, security, and audit information

We collect records needed to operate and secure the Service, including:

• administrator views and exports of protected customer data, including the Shopify user or shop associated with the action, action type, resource type, resource identifier, and timestamp;
• authentication, application, webhook, error, and operational logs;
• browser or device information, request metadata, and server logs that may be generated by our hosting providers; and
• a keyed hash derived from an incoming IP address for short-term abuse prevention and rate limiting. Privacy Desk does not store the raw IP address in its application rate-limit record.

Website information

If you visit a JPGStudios or Privacy Desk website, we may receive information you submit through a contact method and technical information ordinarily generated when a website is requested, such as IP address, browser type, requested page, referring page, and timestamp. Our websites and service providers may use cookies or similar technologies that are necessary for security, session management, preferences, and site operation. If we introduce optional analytics or advertising technologies, we will provide any notice and choice required by applicable law.

2. How we use information

We use personal information to:

• provide, authenticate, operate, maintain, localize, and improve the Service;
• receive, organize, display, update, export, and retain privacy-request records under merchant instructions;
• calculate operational due dates and support request workflows;
• send transactional acknowledgments and process delivery events;
• trigger merchant-configured Shopify Flow workflows;
• maintain case histories and protected-data access logs;
• apply merchant-selected retention settings and respond to Shopify privacy-compliance webhooks;
• provide support and communicate about the Service;
• administer plans, subscriptions, and billing through Shopify;
• monitor reliability, diagnose errors, prevent spam, fraud, abuse, and unauthorized access, and protect the rights and security of merchants, requesters, JPGStudios, and others;
• comply with law, enforce our agreements, and establish, exercise, or defend legal claims; and
• create aggregated or de-identified information that cannot reasonably identify a merchant, user, or requester.

We do not use Merchant Data or privacy-request information for targeted advertising.

3. Our roles and legal bases

For privacy-request records and other personal information that a merchant submits to Privacy Desk or instructs us to process, the merchant is generally the controller or business and JPGStudios is generally the processor or service provider. The merchant determines the purposes and legal basis for that processing. Individuals seeking to exercise rights concerning that information should ordinarily contact the relevant merchant first.

JPGStudios acts as a controller or business for information we process for our own purposes, such as merchant account administration, security, support, legal compliance, service communications, and our websites. Where applicable law requires a legal basis, we rely on performance of a contract, compliance with legal obligations, our legitimate interests in providing and securing the Service, consent where requested, and the establishment, exercise, or defense of legal claims.

4. How we disclose information

We may disclose personal information as follows:

• Merchants and authorized users. Privacy-request and case information is available to the merchant and personnel authenticated through the merchant’s Shopify account.
• Shopify. We exchange information with Shopify to authenticate users, operate the app proxy and extensions, deliver Shopify Flow triggers, administer app functionality and billing, and process mandatory privacy-compliance webhooks.
• Service providers and subprocessors. We use providers for application and database hosting, backups, operational logging, scheduled jobs, and transactional email. The current list is available on the Privacy Desk Subprocessor List.
• Legal and safety disclosures. We may disclose information when we reasonably believe disclosure is required by law or legal process, necessary to protect rights or safety, or appropriate to investigate fraud, abuse, or security incidents.
• Business transactions. Information may be disclosed in connection with a financing, merger, acquisition, reorganization, sale of assets, or similar transaction, subject to appropriate confidentiality and data-protection obligations.
• With direction or consent. We may disclose information when the relevant merchant directs us to do so or when the relevant individual provides consent.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising or use privacy-request information for advertising.

5. Retention and deletion

Privacy Desk gives merchants configurable retention options for eligible completed or denied request records. When the configured period expires, the current retention workflow anonymizes identifying fields while retaining limited non-identifying case attributes and dates. Open cases are not automatically anonymized by that workflow.

We retain other information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, following merchant instructions, maintaining security and audit records, resolving disputes, enforcing agreements, and complying with law. Short-term rate-limit records expire and are periodically removed. Mailgun webhook replay-prevention records are ordinarily removed after seven days. Information in backups and provider logs may remain for a limited period under provider backup, security, and deletion cycles.

When Shopify sends a valid customer-erasure or shop-erasure webhook, we delete, anonymize, or otherwise process matching information as required by Shopify’s privacy requirements, merchant instructions, our Data Processing Addendum, and applicable law. Uninstalling the app revokes application access but may not immediately remove every record from active systems or backups.

6. International transfers

JPGStudios is based in the United States, and personal information may be processed in countries other than the country where it was collected. We use contractual and organizational safeguards for restricted transfers where required. Transfers of Merchant Personal Data are addressed in the Privacy Desk Data Processing Addendum, including applicable Standard Contractual Clauses. Hosting and email-processing locations are described in our Subprocessor List.

7. Security

We maintain reasonable technical and organizational safeguards designed to protect personal information, including Shopify-based authentication, shop-level data separation, encrypted network connections, provider encryption at rest where applicable, input validation, rate limiting, webhook-signature verification, access logging, and retention controls. No transmission or storage system is completely secure, and we cannot guarantee absolute security.

If you believe information associated with Privacy Desk may have been accessed or disclosed improperly, contact privacy@jpgstudios.us promptly.

8. Privacy choices and rights

Depending on where you live and how we process your information, you may have rights to request access, correction, deletion, portability, restriction, or objection, or to withdraw consent. You may also have the right to appeal a decision or complain to a data-protection authority.

If your request concerns information submitted to a merchant through Privacy Desk, contact that merchant. We will assist the merchant with verified requests as required by our contract and applicable law. If your request concerns information JPGStudios controls directly, email privacy@jpgstudios.us. We may need information to verify your identity and authority. Authorized agents may submit requests where permitted by law, subject to appropriate verification.

We will not discriminate against an individual for exercising a privacy right. Because we do not sell personal information or share it for cross-context behavioral advertising, we do not offer an opt-out from those practices.

9. Children’s privacy

Privacy Desk is a business service for Shopify merchants and is not directed to children. We do not knowingly collect personal information directly from children for our own purposes. Merchants are responsible for determining whether and how they may lawfully process information concerning minors through the Service. If you believe a child has provided information to us improperly, contact privacy@jpgstudios.us.

10. Third-party services and links

The Service operates with Shopify and may link to third-party websites or services. Their privacy practices are governed by their own notices and agreements. This Policy does not apply to a merchant’s independent processing, Shopify’s processing under its agreements with merchants and users, or third-party services that JPGStudios does not control.

11. Changes to this Policy

We may update this Policy to reflect changes in the Service, law, or our practices. We will post the updated version at https://jpgstudios.us/privacy-desk-privacy-policy/ and revise the effective date. If a change materially affects how we process personal information, we will provide additional notice where required by law or our agreements.

12. Contact us

Questions, requests, or complaints about this Policy or our privacy practices may be sent to:

JPGStudios LLC
201 Mountain Rest Road
New Paltz, NY 12561
United States
Email: privacy@jpgstudios.us

For terms governing use of the Service, see the Privacy Desk Terms of Service. For processing performed on behalf of merchants, see the Privacy Desk Data Processing Addendum.