JPG STUDIOS

Get Started Today!

Privacy Desk Terms of Service

Effective date: October 16, 2026

These Terms of Service (the Terms) are a legal agreement between JPGStudios LLC, with an address at 201 Mountain Rest Road, New Paltz, NY 12561, United States (JPGStudios, Privacy Desk, we, us, or our), and the person or organization installing, accessing, or using Privacy Desk (Merchant, you, or your).

By installing Privacy Desk, starting a subscription or trial, clicking to accept these Terms, or otherwise using the service, you represent that you have authority to bind the Merchant and agree to these Terms. If you do not agree, do not install or use Privacy Desk.

1. Privacy Desk service

  1. Privacy Desk is a Shopify application that helps merchants receive, organize, document, and manage customer privacy-rights requests. Features may include a storefront request form, request verification and status workflows, operational due-date calculations, case activity history, transactional acknowledgments, configurable retention, Shopify Flow integration, and Shopify privacy-compliance webhook handling.
  2. We may add, change, suspend, or discontinue features. We will provide reasonable notice if a material change substantially reduces core paid functionality, unless immediate action is necessary for security, legal compliance, Shopify requirements, or circumstances outside our reasonable control.
  3. Privacy Desk is provided for business use by Shopify merchants. It is not intended for personal, household, or consumer use by the Merchant.

2. No legal advice

  1. Privacy Desk is workflow software and does not provide legal advice, determine whether a privacy law applies, establish a legal basis, verify that a requester is entitled to exercise a right, decide whether an exception applies, or guarantee compliance with any law.
  2. Any default deadline, jurisdiction label, request category, template, notice, translation, retention option, or suggested workflow is an operational aid only. Legal requirements vary by jurisdiction and circumstances and may change.
  3. You are solely responsible for obtaining appropriate legal advice and for your decisions and actions in response to privacy requests.

3. Eligibility and Shopify account

  1. You must maintain an active Shopify store and comply with your agreements with Shopify.
  2. You authorize Privacy Desk to access the Shopify resources and protected customer fields disclosed during installation and approved through Shopify, solely as described in these Terms, our Privacy Policy, and the Data Processing Addendum.
  3. Administrative access to Privacy Desk is based on Shopify authentication and permissions. You are responsible for managing your Shopify staff accounts, permissions, devices, and credentials and for all activity performed through your authorized accounts.
  4. You must promptly notify us at privacy@jpgstudios.us if you suspect unauthorized access to Privacy Desk.

4. License and restrictions

  1. Subject to these Terms, we grant you a limited, non-exclusive, non-transferable, non-sublicensable, revocable right to access and use Privacy Desk for your internal business operations during the term.
  2. You must not, and must not permit anyone else to:
    • use Privacy Desk unlawfully or to violate another person’s rights;
    • access another merchant’s data or attempt to bypass authentication, authorization, rate limits, or security controls;
    • probe, scan, disrupt, overload, or test the vulnerability of the service without our prior written authorization;
    • introduce malware, harmful code, or fraudulent, misleading, or abusive content;
    • reverse engineer, decompile, disassemble, copy, scrape, or create derivative works from Privacy Desk except to the extent a restriction is prohibited by law;
    • rent, resell, sublicense, or make Privacy Desk available as a standalone service to a third party;
    • use the service to build or benchmark a competing product, except where such a restriction is prohibited by law;
    • remove proprietary notices; or
    • use Privacy Desk for high-risk automated decision-making or decisions producing legal or similarly significant effects about an individual.
  3. We may investigate suspected violations and suspend access when reasonably necessary to protect the service, merchants, Data Subjects, or third parties.

5. Merchant responsibilities

You are responsible for:

  1. providing accurate account, business, contact, and billing information;
  2. displaying the storefront form and related notices in a lawful and accessible manner;
  3. giving Data Subjects all notices and choices required by applicable law;
  4. establishing a lawful basis for collecting and processing Personal Data;
  5. confirming the identity and authority of a requester to the extent appropriate without collecting excessive information;
  6. determining whether a request is valid, whether an exception applies, and how and when to respond;
  7. reviewing calculated dates and meeting the deadlines that actually apply to you;
  8. configuring and periodically reviewing a legally appropriate retention period;
  9. limiting access to personnel with a business need and training those personnel appropriately;
  10. keeping response summaries, denial reasons, internal notes, and other content accurate, necessary, professional, and lawful;
  11. avoiding unnecessary sensitive information in free-text fields, including payment-card data, account passwords, government identifiers, health information, biometric data, and other highly sensitive content;
  12. independently maintaining any records or exports you are legally required to preserve; and
  13. complying with applicable privacy, consumer-protection, accessibility, employment, communications, and ecommerce laws.

6. Merchant Data

  1. Merchant Data means information, content, and Personal Data submitted to, received by, stored in, or generated through Privacy Desk for your shop, excluding aggregated or de-identified information that cannot reasonably identify you or a Data Subject.
  2. As between the parties, you retain your rights in Merchant Data. You grant us a limited right to host, copy, transmit, modify, and otherwise process Merchant Data only as necessary to provide, secure, maintain, support, and troubleshoot Privacy Desk; comply with your documented instructions; prevent fraud or abuse; and comply with law. We may use aggregated or de-identified service information that cannot reasonably identify you or a Data Subject to analyze and improve Privacy Desk.
  3. We do not sell Merchant Data or use it for targeted advertising.
  4. You represent that you have all rights, notices, consents, and lawful bases necessary for us to process Merchant Data as contemplated by these Terms.
  5. Our processing of Merchant Personal Data on your behalf is governed by the Privacy Desk Data Processing Addendum at https://jpgstudios.us/privacy-desk-data-processing-addendum/, which is incorporated into these Terms by reference. If the DPA conflicts with these Terms regarding that processing, the DPA controls.
  6. Our processing of information for our own business purposes is described in the Privacy Desk Privacy Policy at https://jpgstudios.us/privacy-desk-privacy-policy/.

7. Privacy requests and identity verification

  1. Privacy Desk supports case-management workflows but does not automatically establish the identity of a requester. A verification status is a record of your determination, not a verification performed or guaranteed by JPGStudios.
  2. You must use a verification method proportionate to the request and risk. You must not request more information than reasonably necessary.
  3. You control the substantive response, disclosure, correction, deletion, restriction, portability action, objection outcome, or denial. Privacy Desk does not perform those actions in your other systems unless a feature expressly states otherwise.
  4. You are responsible for communicating securely with requesters and for preventing unauthorized disclosure during fulfillment.

8. Transactional communications

  1. Privacy Desk may send transactional messages to acknowledge submissions or communicate service-related information. Delivery depends on third-party services and recipient systems and is not guaranteed.
  2. You authorize us and our email provider to process the recipient details and message content necessary to send and monitor those messages.
  3. You must not use Privacy Desk transactional messages for marketing, advertising, or unrelated communications.
  4. You are responsible for configuring and monitoring any merchant-facing reply address made available by the service.

9. Retention, deletion, and uninstalling

  1. Privacy Desk applies the retention setting you select to eligible completed or denied cases. The current retention workflow anonymizes identifying fields while retaining limited non-identifying case attributes and dates for operational reporting.
  2. Open cases are not automatically anonymized by the standard closed-case retention workflow. You are responsible for closing cases appropriately and reviewing stored data.
  3. Uninstalling Privacy Desk revokes application access and triggers Shopify’s uninstall process, but it may not cause every Merchant Data record to be deleted immediately. Data is deleted, anonymized, retained, or placed beyond active use in accordance with the DPA, your instructions, Shopify’s mandatory privacy webhooks, applicable law, and applicable backup cycles.
  4. You should retrieve any information you need before uninstalling or terminating the service. Unless required by law or expressly agreed otherwise, we have no obligation to retain or provide Merchant Data after deletion.

10. Third-party services

  1. Privacy Desk depends on Shopify and may use third-party infrastructure and communications providers, including hosting, database, and email-delivery services.
  2. Third-party services are governed by their own terms and may experience changes, interruptions, or errors outside our control. We are not responsible for third-party services except to the extent required by applicable law or the DPA.
  3. Authorized Subprocessors that process Merchant Personal Data are identified in the DPA and at https://jpgstudios.us/privacy-desk-subprocessors/.

11. Fees, trials, billing, and taxes

  1. Fees, included features, usage limits, billing intervals, and trial terms, if any, will be presented through Shopify or within Privacy Desk before you approve a charge. We will not charge you unless you authorize the applicable charge through Shopify or another clearly disclosed billing process.
  2. Paid subscriptions automatically renew for the displayed billing interval until canceled, unless the offer states otherwise. Shopify generally administers app charges, billing, and applicable credits under its policies.
  3. You may cancel by uninstalling Privacy Desk or using any cancellation method made available with the subscription. Cancellation stops future renewals but does not ordinarily create a refund for a current billing period except where required by law or expressly stated in the offer.
  4. Trials may be modified, suspended, or discontinued for future users. Unless stated otherwise, a trial converts to the selected paid plan when the trial ends if you approved the subscription and have not canceled.
  5. Fees exclude taxes, duties, levies, and similar governmental assessments. You are responsible for them except taxes based on our net income. Shopify may calculate and collect taxes as required.
  6. We may change fees on advance notice and in accordance with Shopify’s billing requirements. A pricing change applies no earlier than your next renewal or another date you affirmatively approve, unless required by law.

12. Intellectual property

  1. Privacy Desk, including its software, design, documentation, branding, and all related intellectual-property rights, belongs to JPGStudios and its licensors. No rights are granted except the limited right to use the service under these Terms.
  2. If you provide feedback, suggestions, or ideas, you grant us a perpetual, worldwide, irrevocable, royalty-free right to use them without restriction or compensation, provided we do not publicly identify you as the source without permission.
  3. You may not use the Privacy Desk or JPGStudios names, logos, or marks except to identify your authorized use of the service or with our written permission.

13. Confidentiality

  1. Confidential Information means non-public information disclosed by one party to the other that is identified as confidential or should reasonably be understood as confidential. Merchant Data is your Confidential Information. Non-public software, security, product, and business information is our Confidential Information.
  2. The receiving party will use Confidential Information only to perform or exercise rights under these Terms, protect it using reasonable care, and disclose it only to personnel and service providers who need it and are bound by confidentiality obligations.
  3. Confidential Information does not include information that the receiving party can demonstrate was lawfully known without restriction, becomes public without breach, is received lawfully from another source, or is independently developed without use of the disclosing party’s information.
  4. A receiving party may disclose Confidential Information when legally required, provided it gives advance notice where legally permitted and reasonably assists with protective measures.

14. Security

  1. We maintain reasonable technical and organizational measures designed to protect Merchant Personal Data, as further described in the DPA.
  2. No internet or software service is completely secure. You acknowledge that security depends in part on your systems, Shopify account controls, authorized users, configurations, and conduct.
  3. You must report a suspected vulnerability privately to privacy@jpgstudios.us and must not publicly disclose it until we have had a reasonable opportunity to investigate and remediate it.

15. Suspension

We may suspend some or all access to Privacy Desk if:

  • you materially breach these Terms;
  • payment is overdue after any required notice;
  • your use creates a security, legal, operational, or reputational risk;
  • suspension is requested by Shopify or required by law; or
  • necessary to prevent harm to Privacy Desk, Data Subjects, merchants, or third parties.

When reasonably possible, we will give notice and an opportunity to cure. We will limit the scope and duration of a suspension where reasonably practicable.

16. Term and termination

  1. These Terms begin when you first accept them or use Privacy Desk and continue until terminated.
  2. You may terminate by canceling any subscription and uninstalling Privacy Desk.
  3. We may terminate these Terms for a material breach that remains uncured 10 days after notice, immediately for an incurable breach or unlawful activity, or if we discontinue Privacy Desk. We may terminate a free service on 30 days’ notice.
  4. On termination, your right to access and use Privacy Desk ends. Accrued payment obligations and provisions that by their nature should survive—including Sections 2, 6, 9, 12, 13, 17, 18, 19, 20, and 22—will survive.
  5. Merchant Personal Data will be handled after termination as described in Section 9 and the DPA.

17. Disclaimers

TO THE MAXIMUM EXTENT PERMITTED BY LAW, PRIVACY DESK IS PROVIDED “AS IS” AND “AS AVAILABLE.” JPGSTUDIOS DISCLAIMS ALL EXPRESS, IMPLIED, STATUTORY, AND OTHER WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, QUIET ENJOYMENT, AND ANY WARRANTY ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

WE DO NOT WARRANT THAT PRIVACY DESK WILL BE UNINTERRUPTED, ERROR-FREE, COMPLETELY SECURE, OR LEGALLY SUFFICIENT FOR YOUR BUSINESS; THAT EMAILS WILL BE DELIVERED; THAT THIRD-PARTY SERVICES WILL REMAIN AVAILABLE; OR THAT USE OF PRIVACY DESK WILL ENSURE COMPLIANCE WITH ANY LAW.

Some jurisdictions do not allow certain disclaimers, so some of the above may not apply to you.

18. Limitation of liability

  1. TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR FOR LOSS OF PROFITS, REVENUE, GOODWILL, BUSINESS OPPORTUNITY, OR DATA, EVEN IF ADVISED OF THE POSSIBILITY.
  2. TO THE MAXIMUM EXTENT PERMITTED BY LAW, JPGSTUDIOS’ TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO PRIVACY DESK, THE AGREEMENT, AND THESE TERMS WILL NOT EXCEED THE GREATER OF: (A) THE AMOUNTS YOU PAID FOR PRIVACY DESK DURING THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY; OR (B) USD $100.
  3. The limitations in this section do not apply to liability that cannot lawfully be limited or excluded. The DPA controls if Applicable Data Protection Law requires a different allocation for a specific data-protection obligation.
  4. The parties agree that these limitations are an essential basis of the bargain and apply even if a remedy fails of its essential purpose.

19. Indemnification

To the extent permitted by law, you will defend, indemnify, and hold harmless JPGStudios, its affiliates, and their personnel from third-party claims, damages, penalties, losses, and reasonable costs, including attorneys’ fees, arising from:

  • your Merchant Data or instructions;
  • your unlawful or unauthorized use of Privacy Desk;
  • your privacy notices, identity-verification decisions, request outcomes, communications, or failure to comply with applicable law; or
  • your material breach of these Terms.

We will promptly notify you of an indemnified claim, allow you to control the defense and settlement, and reasonably cooperate at your expense. You may not settle a claim in a way that admits fault by or imposes non-monetary obligations on JPGStudios without our written consent.

20. Governing law and disputes

  1. These Terms are governed by the laws of the State of New York, without regard to conflict-of-law rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
  2. Subject to any mandatory rights or a different forum required by the DPA or applicable law, the state courts located in Ulster County, New York, and the federal courts with jurisdiction over Ulster County will have exclusive jurisdiction, and each party consents to personal jurisdiction and venue there.
  3. Before filing a claim, each party will give the other written notice describing the dispute and will attempt in good faith for at least 30 days to resolve it informally. This does not prevent either party from seeking urgent injunctive relief.

21. Changes to these Terms

We may update these Terms to reflect changes in the service, law, security practices, or our business. We will provide reasonable notice of material changes through Privacy Desk, Shopify, email, or another reasonable channel. Unless a different date is stated, updated Terms apply when they become effective. If you do not agree to a material update, you must stop using and uninstall Privacy Desk before the effective date. Changes to the DPA are governed by the DPA.

22. General provisions

  1. Notices. Legal notices to JPGStudios must be sent to privacy@jpgstudios.us and 201 Mountain Rest Road, New Paltz, NY 12561, United States. We may send notices to the email associated with your Shopify account, through Privacy Desk, or through Shopify.
  2. Assignment. You may not assign these Terms without our prior written consent. We may assign them in connection with a merger, acquisition, reorganization, sale of assets, or by operation of law, provided the assignee remains bound by these Terms and the DPA.
  3. Independent contractors. The parties are independent contractors. These Terms do not create a partnership, franchise, joint venture, fiduciary, agency, or employment relationship.
  4. No third-party beneficiaries. Except where the DPA, Standard Contractual Clauses, or applicable law provides otherwise, these Terms create no third-party beneficiary rights.
  5. Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, except payment obligations.
  6. Waiver and severability. A waiver must be in writing and is not a continuing waiver. If a provision is unenforceable, it will be modified to the minimum extent necessary, and the remaining provisions remain effective.
  7. Order of precedence. If documents conflict, the following order applies for their subject matter: an applicable order or pricing approval; the DPA for processing Merchant Personal Data; these Terms; then service documentation.
  8. Entire agreement. The Agreement, including these Terms, the DPA, any applicable order or Shopify pricing approval, and documents incorporated by reference, is the entire agreement about Privacy Desk and supersedes prior discussions or agreements on that subject.
  9. Electronic acceptance. Electronic acceptance and records have the same effect as originals and signatures to the extent permitted by law.

23. Contact

JPGStudios LLC
201 Mountain Rest Road, New Paltz, NY 12561, United States
Support: privacy@jpgstudios.us
Privacy: privacy@jpgstudios.us
Legal notices: privacy@jpgstudios.us