Mend

Data Processing

Last updated: July 12, 2026

These terms describe how Masas Technologies, LLC ("Mend", "processor") processes personal data of your shoppers on your behalf when you use Mend, and form part of our Terms of Service. For this data you are the controller; Mend processes it only to provide the service.

Scope of processing

  • Data subjects: your shoppers and customers who contact your store through the chat widget or by email.
  • Data categories: conversation content and attachments, contact details (email address), order details read from Shopify (order numbers, items, fulfillment, refunds), verification status, and technical metadata (device type, country).
  • Purpose: answering support requests, executing the order actions you have permitted, and the security, billing and abuse-prevention operations of the service.
  • Duration: for as long as you use Mend, subject to the retention windows in the Privacy Policy.

Our commitments

  • We process shopper data only on your documented instructions, which the service's configuration (rules, approvals, settings) expresses, and never for our own purposes such as advertising or model training.
  • Personnel access to personal data is limited and bound by confidentiality.
  • Security measures include TLS in transit, encryption at rest by our storage providers, application-layer encryption of Shopify credentials (AES-256-GCM), strict per-store tenant isolation, audit logging of sensitive access, and least-privilege API scopes.
  • We notify you without undue delay after becoming aware of a personal data breach affecting your shoppers' data.

Subprocessors

We use the vendors listed on the Subprocessors page to provide the service. We remain responsible for their processing, bind them to data-protection obligations, and update that page when the list changes. If you object to a new subprocessor, you may stop using the service and uninstall.

Assistance with privacy requests

Mend implements Shopify's privacy webhooks end to end: shopper data-access requests produce an export delivered to you, shopper erasure requests redact conversations, attachments and identifiers, and the post-uninstall shop redaction deletes your store's data. For requests arriving outside Shopify, contact support@mend.so and we will assist within the timelines applicable law requires.

International transfers

Processing takes place in the United States with the providers listed on the Subprocessors page. Where your shoppers are in jurisdictions requiring transfer safeguards (such as the EEA or UK), transfers rely on the applicable mechanisms offered by those providers, including standard contractual clauses.

Deletion at end of service

When you uninstall Mend, outbound processing stops immediately and stored data is deleted through Shopify's shop-redaction process; earlier deletion can be requested at support@mend.so.