Data Processing Addendum

Sonic Highway, operated by Electric Mud Creative LLC · Last updated October 24, 2026

This Addendum forms part of the Sonic Highway Merchant Terms of Service (the "agreement") between Electric Mud Creative LLC, trading as Sonic Highway ("Processor", "we"), and the merchant installing the Sonic Highway Shopify app ("Controller", "you"). It applies whenever we process personal data on your behalf, and takes effect when you install the app.

1. Roles

You are the Controller of personal data relating to your customers. We are your Processor and act only on your documented instructions, which for this app are: receive the orders your customers place, and arrange for the goods to be shipped to them; and, when your staff, or a person you have given assistant access in the merchant portal, use the optional assistant, answer their questions about your store. Installing the app and leaving it enabled constitutes the first instruction; a staff member, or a person you have given assistant access in the merchant portal, asking the assistant a question constitutes the second. For data about you, your store and the people you give portal access, we act as Controller.

Requests a store's owner makes in Sonic Highway outside Shopify's admin, after Shopify confirms they own the store, are processing on the merchant's instructions: the app carries them out with the store's own access to Shopify, records them, and no new sub-processor is involved. When the store's owner opens an order in the browser tab, the app reads the customer's name, shipping address and phone from Shopify at that moment and shows them on the page; it does not store them for this.

Signing in once across stores, and the record of who confirmed they own a store, are processing on the merchant's instructions to secure access to the app: the app keeps only what the privacy policy lists, no new sub-processor is involved, and a store's records are deleted on Shopify's shop/redact request.

2. Subject matter and duration

Processing lasts for as long as the app is installed, plus the short retention described in clause 6. The subject matter is order fulfillment, giving the people you choose access to your store's orders and the other sections you allow in the merchant portal, and, where your staff or those people use it, answering their questions through the assistant.

Categories of data subject

• Your customers, being the recipients of orders you fulfill through the app.
• Your staff, to the extent their contact details appear in store or billing settings, or they type questions into the in-app assistant.
• The people you give access to the merchant portal, who may be outside contractors: their email address, their sign-in links and sessions, which notifications they have read, the changes they make in the portal, and, where you give them assistant access, their questions and a daily count of them.

If a merchant gives someone order detail in its merchant portal, that person can see each order's stage, packages, ship dates, the state it ships to and its carrier tracking numbers, never the customer's name, street address, phone or notes, and we record each order they open, keeping that record for 90 days. People a store invites to its merchant portal and gives Catalog Change can have our app create draft products in the store, using the store's own access; a draft is not for sale until the store's staff make it active in Shopify.

Categories of personal data

• Identity and contact: name, shipping address, email address, telephone number.
• Transaction: order number, line items, quantities, order and fulfillment status, tracking number.
• Assistant: the questions your staff type into the in-app assistant, the order and catalog details looked up to answer them, the answers, and any rating or comment your staff leave on an answer.
• Merchant portal: the questions people you give assistant access type into it there, the details looked up to answer them and the answers, each linked to that person's portal account, which is never sent to the assistant's provider.

For each routed order we also keep a pseudonymous customer key (a keyed hash of the store and the customer's Shopify id, never the id itself) and the amount the customer paid for the items we fulfilled, to give the merchant counts of new and returning customers and, for each customer, their orders and spend at the store. Where the merchant's staff may see customer details, the app may show a customer's name on these pages, read from Shopify at that moment and not stored. It is erased with the customer's other data on customers/redactand with the store's on shop/redact.

We do not process special category data or government identifiers, and we ask you not to send either through the app; order notes are not processed by us for any purpose. We never see or store card numbers. Card payments to us are processed by Stripe.

3. Our obligations

• We process personal data only on your instructions, and only to fulfill orders, to let the people you choose use the merchant portal, and, when your staff or the people you give assistant access in the portal use it, to answer their questions through the assistant.
• We do not sell, share for value, or use personal data for advertising or profiling.
• Personnel with access are bound by confidentiality and are limited to those who need it.
• We maintain the technical and organizational measures in clause 5.
• We assist you, so far as we reasonably can, with data subject requests, impact assessments and regulator enquiries.
• We tell you about a personal data breach without undue delay, and in any event within 72 hours of becoming aware of it, with what we know at the time.

4. Sub-processors

You authorize the following sub-processors:

When a staff member asks the assistant a question, we send Anthropic that question, up to three earlier questions from the same conversation, and the details needed to answer it: order numbers, dates, totals, statuses and order history events; support request references, types and statuses; your store's notifications, other than wallet charges; destination state or province; product and catalog details; and store-level sales summaries (order counts, revenue, best sellers and top destination states), which never include cost or profit. The assistant does not send your customers' names, email addresses, street addresses or phone numbers, though a question your staff type may contain them. Ratings and comments on answers stay with us and are not sent. Every request we send requires Anthropic to run it in the United States. Under Anthropic's commercial terms, Anthropic does not use this data to train its models and deletes it within 30 days, except where it must keep it longer to enforce its usage policy or to comply with the law. The assistant can only read: it cannot change an order, a setting or anything else in your store.

When a person you have given assistant access in the merchant portal asks it a question, we send our AI provider that question and up to three of their earlier questions from the same conversation, and only details from the sections you allow that person to see: for orders, the order numbers, dates, totals, statuses, item counts and destination state or province; for one order, where you give that person order detail, its packages and their contents, whether a package has tracking, and its pre-order release dates; for notifications, your store's notifications as that person sees them; for support, the support request references, types and statuses, and the items they are about; for Insights, order counts and store-level sales summaries; and for Catalog, catalog details. We never send cost or profit, your billing contact, a tracking number, or that person's own email or name. This adds no sub-processor.

We impose data protection obligations on each sub-processor no less protective than those in this Addendum, and we remain liable to you for their performance. We will give you at least 30 days' notice before adding or replacing a sub-processor. If you reasonably object on data protection grounds, you may terminate the affected service without penalty.

5. Security measures

• Encryption of personal data in transit (HTTPS enforced on every endpoint) and at rest.
• Isolation by store: every read and write of merchant data is scoped to that merchant's store through one shared module, and fulfillment partner credentials are resolved per store. A deployment serving a single merchant is isolated at the infrastructure level as well; the multi-tenant deployment holds merchants together in one Postgres, with that scoping applied to every access.
• Fulfillment partner passwords held as host-level secrets, outside the database; Shopify access tokens stored in the application database, encrypted at rest by the hosting provider; portal sign-in links and sessions stored only as one-way hashes.
• Append-only audit logging of every action that transmits personal data to a sub-processor, recording the store, the order, the action and its outcome, and, for a question asked in the merchant portal, the person's portal account, never their email.
• Access to production limited to named individuals with unique accounts and multi-factor authentication; no shared logins.
• Automated backups provided by our managed database host, with encryption inherited from that layer.
• Minimisation by design: the order payload containing customer identity data is erased automatically once an order reaches a final state, typically within a minute.

We do not currently hold SOC 2, ISO 27001 or equivalent certification, and we will not represent otherwise. We will tell you if that changes.

6. Retention and deletion

The stored order payload containing customer identity data is erased automatically on order completion, independent of any request. On uninstall we delete your store's sessions and access tokens, clear in-flight queues and erase those payloads; your fulfillment configuration is retained, deactivated, so that reinstalling does not require re-entering it. On Shopify'sshop/redact request, which follows 48 hours after an uninstall, or on your written request, we delete the remaining personal data we hold for your store, including routing records, wallet transactions, payment records, assistant conversations and the audit log, except where we must retain something to comply with a legal obligation. Assistant conversations are deleted automatically after 30 days in any case, and their text is erased on uninstall.

In the app and the merchant portal a conversation is shown only to the person who asked it, and questions asked while signed in as the store owner only in an owner sign-in. When a customer asks you for their data, every conversation that looked up that customer's orders is included in what we send you, whoever asked it, portal users included, and our team reads those conversations to compile it. Removing a person's portal access to your store, or disabling their portal sign-in, deletes the questions they asked in the portal there at once. When access lapses after 30 days unused, the questions asked with it are deleted within a day of it lapsing, since none is kept longer than 30 days. Questions asked while signed in as the store owner are kept for 30 days like staff questions. A daily count of each portal user's questions is kept for two days to apply their limit, then deleted.

On Shopify's customers/redact request we erase what we hold about the orders it names: the routing record, the stored order, its history and tracking, support requests about it, its notices, its audit log entries, our record of any data request naming it, and every assistant conversation that looked one of those orders up, whole: every question and answer in it, whoever asked, on your staff or in the merchant portal. Any of your store's assistant conversations with a question still being answered when we act on the request is erased too, because what that question has already read cannot be known. An assistant question that names the customer, in a conversation that never looked up their orders, cannot be matched to them, and is deleted by the 30-day retention. The request does not erase your wallet ledger, which records each order's charges and refunds by order number, your payment records (amounts, dates and order numbers), a fulfillment partner's confirmation that a cancellation went through and the audit entries filed under it, or our operational alerts, which can name an order; those are deleted on shop/redact. What was already sent to the assistant's provider cannot be recalled, and is deleted under the provider's terms in clause 4.

We act on Shopify's customers/redact and shop/redact webhooks automatically. When a customers/data_request webhook arrives, we record it and the orders it names automatically; we then compile what we hold about those orders, including their routing records, order history, support requests and any assistant conversations that looked them up, whoever asked them, on your staff or in the merchant portal, and send it to you. Our record of the request names those orders, so a customers/redact request for any of them erases it, and once we have dealt with the request it is deleted 90 days after the request arrived.

7. International transfers

Where you are established in, or your customers are located in, the UK or EEA, personal data may be transferred to the United States, where our hosting, our fulfillment partner and the assistant's provider, Anthropic, process it. Such transfers are made under the European Commission's Standard Contractual Clauses (Module Two, controller to processor), together with the UK International Data Transfer Addendum where applicable, which are incorporated into this Addendum by reference. Where those clauses require a selection, the governing law is that of the Controller's place of establishment and the supervisory authority is that of the Controller.

8. Audit

On reasonable written notice and no more than once a year, we will provide the information necessary to demonstrate compliance with this Addendum. Where you reasonably require more, we will agree a scope that respects the confidentiality and security of our other merchants.

9. Liability and precedence

Liability under this Addendum is subject to the limitations in the Merchant Terms of Service. If this Addendum conflicts with any other term of that agreement on the processing of personal data, this Addendum prevails.

10. Signature

This Addendum is incorporated into the Merchant Terms of Service and takes effect on installation without signature. If your organization requires a counter-signed copy, write to privacy@sonichighway.io and we will provide one.

Questions about this document: privacy@sonichighway.io.

Merchant Terms of Service · Privacy Policy · Data Processing Addendum