Privacy Policy — Dashprep

This Privacy Policy explains how Dashprep (“Dashprep,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information. It applies to the Dashprep application installed from the Shopify App Store (the “App”), the prep-station dashboard we provide at {store}.dash-prep.com (the “Dashboard”), and our marketing website at dash-prep.com (together, the “Services”).

Dashprep helps Shopify merchants turn their orders into a live prep board for kitchens, warehouses, and production teams. By using the Services, you agree to the practices described in this policy.

1. Who is responsible for your data

For personal information about our merchants and website visitors, Dashprep is the “data controller.”

For personal information contained inside a merchant’s Shopify store data — including information about that merchant’s own customers — the merchant is the data controller and Dashprep acts as a “data processor” (or “service provider”) that processes this information only to provide the Services on the merchant’s behalf and under their instructions.

2. Information we collect

a. Merchant and account information

Your name, email address, Shopify store domain, store/shop identifier, and preferences you set during onboarding.
Team member details you add to the Dashboard, such as names and email addresses used to sign in.

b. Store data synced from Shopify

With the permissions you grant at install, we sync data from your Shopify store so we can display and organize it on the Dashboard. This includes:

Products, variants, and collections;
Orders and their line items, fulfillment status, and timing;
Information contained in orders that may identify your customers — such as customer name, shipping and billing address, and order contents.

We process this information solely to provide the Services (for example, to route items to the correct prep station and keep the board in sync). We do not use it to independently market to your customers.

c. Billing information

Subscription billing is handled by Shopify through the Shopify Billing API. We receive confirmation of your plan and charge status, but we do not collect or store your full payment card details.

d. Website and marketing information

Contact form submissions and any email address you provide to our newsletter or enterprise enquiry forms;
Usage and analytics data about how our marketing website is used (for example, pages viewed and general performance metrics).

e. Technical and log information

Like most online services, we automatically collect certain technical data such as IP address, browser and device type, and access timestamps for security, diagnostics, and reliability.

3. How we use information

Provide, operate, and maintain the App and Dashboard;
Sync, display, filter, and route your orders in real time to prep stations;
Authenticate users and manage your team and settings;
Process subscriptions and manage your plan;
Provide customer support and respond to your requests;
Monitor, secure, debug, and improve the Services and develop new features;
Send service-related communications and, where permitted, marketing communications you can opt out of at any time;
Comply with legal obligations and enforce our terms.

4. Legal bases for processing (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Services you request); our legitimate interests (to secure, maintain, and improve the Services); your consent (for optional marketing and certain cookies); and compliance with a legal obligation.

5. How we share information

We do not sell your personal information, and we do not sell or share it for cross-context behavioral advertising. We share information only as needed to run the Services, with the following categories of service providers (subprocessors) acting on our behalf under appropriate contractual protections:

Shopify — the platform your store runs on and the source of synced store data;
DigitalOcean — application hosting and our managed PostgreSQL database;
Pusher — real-time delivery of live board updates;
Vercel — hosting, performance analytics, and storage for our marketing website;
Sanity — content management for our marketing website;
Resend — delivery of transactional and marketing email.

We may also disclose information to comply with the law, respond to lawful requests, protect our rights and users, or in connection with a merger, acquisition, or sale of assets (with notice where required).

6. Your customers’ data and Shopify compliance

Because the App processes Shopify store data that can include your customers’ personal information, we support Shopify’s mandatory compliance webhooks:

customers/data_request — we provide the relevant stored data to the merchant so they can respond to a customer’s access request;
customers/redact — we delete or anonymize the identified customer’s personal information from our systems;
shop/redact — following app uninstall, we delete the store’s data on the schedule required by Shopify.

7. Data retention

We retain merchant and store data for as long as your Dashprep subscription is active and the App remains installed. After you uninstall the App or close your account, we delete or anonymize store data within 90 days, except where a longer period is required to comply with legal, accounting, or security obligations. Redaction requests received through Shopify’s webhooks are handled on Shopify’s required timelines.

8. Security

We protect information using industry-standard measures, including encryption in transit (TLS/SSL), an SSL-secured managed database, scoped access controls, and strict tenant isolation so each store’s data is kept separate. No method of transmission or storage is completely secure, but we work to protect your information and review our safeguards regularly.

9. International data transfers

We are based in, and process data in, the United States. If you access the Services from outside the United States, your information may be transferred to and processed in the U.S. and other countries. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses for such transfers.

10. Your rights and choices

Depending on where you live, you may have rights to access, correct, update, delete, port, restrict, or object to our processing of your personal information, and to withdraw consent. If you are in California, you may have rights to know, delete, and correct your personal information and to not receive discriminatory treatment for exercising them; we do not sell or share your personal information as those terms are defined under the CCPA/CPRA.

To exercise any of these rights, email us at privacy@dash-prep.com. If your request concerns data controlled by a merchant (for example, if you are a shopper who ordered from a store using Dashprep), please contact that merchant directly; we will assist them as their processor. We may need to verify your identity before acting on a request.

11. Cookies and tracking

The App and Dashboard use strictly necessary cookies to keep you signed in and to secure requests (for example, session and CSRF tokens). Our marketing website uses limited analytics to understand performance and usage. You can control cookies through your browser settings; disabling strictly necessary cookies may prevent parts of the Services from working.

12. Children’s privacy

The Services are intended for businesses and are not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us so we can delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice where appropriate. Your continued use of the Services after an update means you accept the revised policy.

14. Contact us

If you have questions about this Privacy Policy or how we handle your information, contact us at privacy@dash-prep.com or hello@dash-prep.com.