Terms of Service

Last updated: October 30, 2026

Ship To Who is operated by BrightLayer Lab LLC, a Virginia limited liability company ("BrightLayer Lab," "we," "us," "our"). "Ship To Who" and "the App" mean the Shopify app we operate under that name, including its admin pages, its blocks for your online store, thank-you page and order status page, and the optional feature described in Section 8.

1. Acceptance of Terms

By installing, accessing, or using the App, you ("Merchant," "you") agree to be bound by these Terms of Service ("Terms"). If you do not agree, do not install or use the App. These Terms are published at https://shiptowho.com/terms.

The Ship To Who Data Processing Agreement ("DPA"), published at https://shiptowho.com/dpa, forms part of these Terms. It applies to the personal data the App processes on your behalf. Our Privacy Policy, published at https://shiptowho.com/privacy, describes how we handle personal data. It is a notice and is not part of these Terms. The App's Settings page links to these Terms, the DPA and the Privacy Policy under Terms and privacy, and says that using the App means agreeing to these Terms, including the DPA.

2. Description of Service

2.1 What the App Does

Ship To Who helps you catch gift orders that are about to ship to the buyer's own address by mistake. In these Terms, the buyer is the person who places an order in your store, and the recipient is the person the buyer names as receiving the gift.

The App provides:

• A recipient form for your online store. You add it to your product or cart pages as a theme app block. It asks the buyer whether the order is a gift or "It's for me", and for a gift it asks for the recipient's name and phone number, a delivery type and the details that type needs, such as a ward and room number. The delivery types are Home, which the recipient form always offers; School, Office and Hotel, which are offered by default until you turn them off; and Hospital and Funeral home, which are off by default until you turn them on (Section 5.4). The answers are saved on the order, where you see them under the order's Additional details in Shopify. If another app already collects the recipient's name, you can tell the App which order field holds it.
• A name check on new orders. When Shopify tells the App about a new order, the App compares the recipient's name with the shipping name, company and second address line, and compares the shipping name with the buyer's first and last name (from the customer record or the billing address). If the buyer chose "It's for me", or no recipient name was entered, the order is not flagged. If any part of the recipient's name appears in the shipping name, company or second address line, the order passes. If it does not, and the shipping name contains the buyer's first and last name, the order is a strong mismatch, unless the recipient is given as a relationship such as "Mom" or "Grandma", which makes it a weak mismatch. Any other order where the recipient's name is not found is a weak mismatch.
• Flags and holds. The App tags each flagged order (by default with ship-to-who-check) and lists it under Needs attention in the App. On a strong mismatch it also places a fulfillment hold on the order (Section 7). Weak mismatches are listed but not held, unless you turn on holds for them.
• Recipient details on the order. The App saves the recipient's details in an app-owned field on the order (a metafield), which you can see on the order page in Shopify admin. Unless you turn it off, it also adds one line to the order note ("Gift recipient (Ship To Who): …"), which Shopify's default packing slip prints.
• Tools for your staff. From each flagged order your staff can correct the recipient and the shipping address in one step and save the correction, which records the outcome as Fixed; record a False alarm; release the App's hold; or use Report a problem to record a problem with the order that was not fixed through the App, such as a wrong delivery that already happened. The App records the outcome and which staff member recorded it.
• A recap for the buyer on the thank-you page and the order status page. It shows the recipient the buyer entered beside the actual shipping name and address, with a button to say something is wrong. A report made within the time you set places the App's hold on the order; otherwise the buyer sees the contact message you write.
• Liquid snippets to paste into your order confirmation email and, if you want, your packing slip (Section 9).
• Accuracy figures for your store, shown in the App only to your store (Section 2.3): how many flags your staff confirmed as real errors and how many were false alarms.
• Customer data requests. Shopify customer data requests that reach the App are listed in the App's settings (the 20 most recent), with a download of the recipient details, shipping details, matched name words and correction history the App still holds for the orders concerned (Section 13.4).

The App itself does not send email or text messages to you or to your customers.

2.2 Optional Feature

One further feature, a customer fix page, is off by default. Section 8 describes it and what you take on if you turn it on.

2.3 New Service

The App is new. Its features, settings, screens and thresholds may change, and features may be added or removed, as we learn how stores use it. Where practicable, we will tell you before we remove a feature you use. The App and all its features, including new features and the optional feature in Section 8, are provided "as is", without any service level or guarantee of results, and we may change, suspend or withdraw any of them at any time.

The App works out its accuracy figures (Section 2.1) for each store from that store's own orders, and in the App shows them only to that store. We look at your store's figures only to support you or with your agreement, for example in a review of how the App is working for your store. We do not compute or use accuracy figures across stores; across stores, the App's server logs record only operational totals, such as how many records its daily clean-up deleted.

If you send us feedback or suggestions, we may use them without any obligation to you.

3. What the App Does Not Guarantee

Please read this section carefully. Ship To Who is an extra check. It is not a guarantee that an order reaches the right person.

• The name check is a rule of thumb. It compares names, not identities. It can miss orders going to the wrong place, and it can flag orders that are correct (false alarms), for example when a buyer sends a gift to someone who lives with them and puts their own name on the shipping address.
• Shared names can pass. An order to the buyer's own address can pass when the recipient shares a first name or surname with the shipping name, for example a gift from Jane Smith to Mary Smith that ships to Jane Smith. A gift to a relative named only by relationship, such as "Mom", is at most a weak mismatch and is not held unless you turn on holds for weak mismatches.
• A correct name with a wrong street can pass. The App does not know which address the buyer meant. If the shipping name matches the recipient, the check passes even when the street, city or postcode is wrong.
• It is not an address validator. The App does not check whether an address exists, is complete, or can be delivered to, and it does not check phone numbers or delivery details.
• It only knows what the buyer entered. If the recipient form did not run (for example because the block is not on the page the buyer used, the buyer used a checkout button that skips it, or the order was created as a draft order or by another app), the App may have no recipient to compare and may not flag the order.
• It is not instant. The App acts when Shopify tells it about a new order, which is usually quick but not immediate. If an order is fulfilled before then, or if Shopify or the App is unavailable, the App may place a hold late or not at all.
• A hold is only a hold. It stops the order being fulfilled in Shopify until someone releases it. It does not contact the buyer, correct the address or make any decision. Your staff decide what happens next (Section 7).
• You remain responsible for fulfilment and for talking to your customers. Checking details with buyers, delivering orders, refunds, redeliveries and anything you tell your customers are your responsibility.

4. Eligibility

The App is available to Shopify merchants with an active Shopify store whose business is established in the United States, or in Canada outside Quebec (below). You must have the authority to bind your business to these Terms. Some parts of the App depend on your Shopify plan, theme and settings: the recipient form needs a theme that supports app blocks, the order status page block needs Shopify's new customer accounts, and the thank-you page blocks depend on your Shopify plan.

Where the App is offered. The App is offered only to merchants established in the United States, or in Canada outside the province of Quebec. It is not offered to merchants established in Quebec. You must not install or use the App for a business established in Quebec or anywhere else, except on a Shopify development store used only with test data. The App reads your store's business country and province or state (from your business details in Shopify, or your store address if there are none), and whether your store is a Shopify development store, from Shopify, keeps them with your store's record and refreshes them at most once a day, or each time your staff open the App while it is not served. If your store's business address is in another country, or in Quebec, the App opens in your Shopify admin only to a page saying it is not available there, and it does not run its name check on your store's new orders or record or hold them, record buyer reports from the thank-you and order status pages, or open the customer fix page. Development stores can use the App wherever they are, provided they hold only test data. If the App cannot determine your store's country, it serves your store and logs that it could not. If your store's business country is Canada and the App cannot determine its province, it also serves your store. Whatever your country or province, the App always handles Shopify's privacy requests (customer data requests, customer erasure and store deletion) and the clean-up when you uninstall (Section 13). If your store stops being served after you have used the App, for example because its business address moves to another country or to Quebec, your staff can no longer use the App (it opens only to that page): release any Ship To Who holds in Shopify admin, and write to support@shiptowho.com for a copy of what the App holds for your store, including the files for customer data requests, or to have it deleted. To be told when the App becomes available in your country or province, contact support@shiptowho.com.

This limit applies to where your business is established. It does not stop you from using the App for orders from buyers, or to recipients, in Quebec or in other countries. Where the GDPR, the UK GDPR or the Swiss FADP nonetheless applies to that processing, for example for a buyer or recipient in the European Economic Area, the United Kingdom or Switzerland, the DPA's transfer safeguards (DPA Section 6) apply to it. If your business is in Canada, or you have buyers or recipients there, Section 5.4 and DPA Section 6.6 describe what Canadian privacy law asks of you and of us.

You are responsible for all activity that occurs under your installation of the App and for the acts and omissions of any staff members, agents, or other users to whom you grant access to the App, as if they were your own. The App has no staff roles of its own: anyone Shopify lets open the App in your admin can see every gift order the App lists, change recipients and shipping addresses, release the App's holds and change its settings. You are responsible for deciding who has that access in Shopify.

5. Merchant Responsibilities

5.1 Legal Compliance

You are responsible for:

• Making sure your use of the App, including collecting recipient details at the cart and holding orders, complies with the laws that apply to your store, including consumer-protection and privacy laws in the places where you sell
• Ensuring your use of the App does not violate any applicable laws or Shopify's terms of service

5.2 Setting Up the App

You are responsible for:

• Adding the recipient form to your theme where buyers will see it, and checking that it works with your theme, including any cart drawer or quick-buy buttons
• If another app collects the recipient's name, entering the correct field name in the App's settings, and the same field name in the recap block's settings in Shopify's checkout editor. The check and the recap cannot work on a field they are not pointed at
• Choosing which delivery types to offer, and choosing the same types in the recipient form's theme settings and in the App's settings. Hospital and Funeral home start off in both places, and the other types start on (Section 5.4)
• Placing a test order to check the whole flow before you rely on the App
• Adding the recap blocks to your thank-you and order status pages in Shopify's checkout editor, if you want buyers to see them
• The wording of everything you write in the App's settings, such as the hold note and the contact message buyers see

5.3 Fulfilment and Customer Communication

You are responsible for:

• Checking the App's Needs attention list regularly, especially for same-day and timed deliveries. A held order is not fulfilled until someone releases the hold, so an order nobody looks at can miss its delivery time
• Contacting buyers to check their details, and deciding whether an order is correct
• Recording outcomes (Fixed, False alarm or Report a problem) truthfully. The App's accuracy figures depend on them
• Keeping the contact message buyers see accurate, and having a person review any buyer's challenge to a hold
• Keeping the recipient form's "It's for me" option available, because it is how a buyer who is buying for themselves avoids a false alarm
• Any refunds, redeliveries, replacement goods or other costs when an order is delivered to the wrong place, late, or not at all

5.4 Data Processing

As the data controller for your customers' data, you are responsible for:

• Having a lawful basis for collecting and processing buyer and recipient details through the App and, where delivery details reveal health or other special category data (for example that the recipient is in hospital), a condition under Article 9 of the GDPR or the equivalent under other laws that apply to you
• Giving buyers and, where required, recipients and other people named in delivery details the information that Articles 13 and 14 of the GDPR and similar laws require, for example in your store's privacy notice, or relying on a documented exemption such as Article 14(5)(b). This includes telling them that recipient details are saved on the order, printed on packing slips through the order note line (which stays on orders already written even if you later turn the setting off), and shown in your confirmation email if you paste the snippet
• Collecting only what you need. Hospital and Funeral home ask for details that reveal sensitive circumstances about the recipient, such as a hospital ward and room, or a funeral and the name of the person who died, so they are off by default, both in the recipient form's theme settings and in the App's settings. Turn them on, in both places, only if you deliver there, and turn off any other type you do not need to deliver
• If the Personal Information Protection and Electronic Documents Act (PIPEDA) or a substantially similar provincial law, such as Quebec's private-sector privacy law (as amended by Law 25), applies to your processing, which may be the case because your business is in Canada (outside Quebec, Section 4) or because you have buyers or recipients in Canada, including Quebec, meeting your obligations under it. You remain accountable for the personal information you transfer to us, which we process as your service provider under the DPA (DPA Section 6.6). Your privacy notice should tell buyers and recipients that their information is stored and processed in the United States and may be accessible to courts, law enforcement and national security authorities there under US law. Reporting a breach to the Office of the Privacy Commissioner of Canada, to a provincial privacy authority such as the Commission d'accès à l'information du Québec, or to the people affected, where the law requires it, is your responsibility; our notice under Section 13.6 is designed to support it
• Responding to data subject requests within legally required timeframes. The App does not notify you when Shopify sends it a customer data request, so check Settings, Customer data requests in the App regularly (Section 13.4). We also check for new requests at least once a week and remind you by email within 7 days of a request arriving (DPA Section 4.5). Recipients are usually not your Shopify customers, so their requests reach you through your own channels; we will help where we hold the data, as described in the DPA
• Keeping a monitored contact for privacy and security notices. We send them to the store owner or staff email addresses Shopify gives us and, if you send us one at support@shiptowho.com, to your privacy contact (DPA Section 4.8)
• Deciding how long to keep the recipient details the App writes into your Shopify orders, and deleting them when your practices or the law require. Section 7.2 explains which of them your staff can change in Shopify admin and when the App deletes its recipient field. The App's own copy is cleared on a fixed schedule (Section 13.2)

6. Shopify API and Permissions

The App requires the following Shopify API scopes to function:

• read_orders / write_orders — To read new orders, their shipping details and the buyer's first and last name (from the order's customer and billing address) for the name check; to add the App's tag, order note line and recipient metafield; and, when your staff save a correction (recorded as Fixed) or a buyer uses the fix page, to update the order's shipping address and recipient details
• write_merchant_managed_fulfillment_orders — To place and release the App's fulfillment holds on orders fulfilled from your own locations

The App also uses Shopify's protected customer data fields for name, address and phone. It does not request customers' email addresses. Shopify's order notifications include the whole order, such as the items, prices and totals. The App does not use or store payment details, prices, totals or the items ordered: it reads only the details it needs, holds the rest only in memory while it handles the notification, and never stores the notification itself.

The App subscribes to Shopify webhooks for new, fulfilled and cancelled orders, for released fulfillment holds, for app uninstallation, and for Shopify's mandatory privacy topics (customer data requests, customer redaction and shop redaction).

You authorize the App to access these scopes when you install it. The App will only use these permissions for the purposes described in these Terms and the DPA.

7. Holds and Order Changes

7.1 Fulfillment Holds

The App places a fulfillment hold on an order:

• Automatically, on a strong mismatch
• On a weak mismatch, only if you turn that on in the App's settings
• When a buyer reports a problem from the thank-you or order status page within the time you set
• When a buyer changes their details on the fix page, if you use it (Section 8.1)

Each hold is a Shopify fulfillment hold with the reason "Address incorrect" and a short note. For a hold from the name check, the default note names the recipient and the shipping name and links to the order in the App; you can change the note in the App's settings. Holds from a buyer report or a buyer's fix use a fixed note without names. Anyone who can see the order in Shopify admin can see the note. The App asks Shopify to notify you when it places a hold, so the note may also appear in Shopify's notifications to your store.

The App can only hold an order's fulfillment while it is open and fulfilled from your own locations. It cannot hold an order that is already fulfilled, cancelled, or in progress with a fulfillment service.

A hold stays on until it is released, either by your staff in the App (when they save a correction or record a false alarm, or with Release hold) or in Shopify admin. The App releases its own holds when an order is cancelled. The App only ever releases holds it placed itself: it never releases holds placed by you or by other apps. If a release fails, the order stays in Needs attention with its hold on, so your staff can try again.

7.2 Changes the App Makes to Your Orders

By installing the App, choosing its settings and using its tools, you instruct the App to make these changes in your Shopify store:

• Tag. Adds your chosen tag to each flagged order
• Recipient metafield. Saves the recipient's name, phone, delivery type and details in an app-owned field on the order. Your staff can see it in Shopify admin but cannot edit or delete it there. While the App is installed, it deletes this field from an order in Shopify when it clears its own copy of that order's recipient details, on its fixed schedule (Section 13.2) or on a customer erasure request (Section 13.5), and in any case at its first daily clean-up after the order is 55 days old. When we clear a recipient's details within 15 days of your written request to support@shiptowho.com (DPA Section 4.5), the field is deleted with them. If the request to Shopify fails, the App retries for up to an hour; if it still fails, the App records the failure in its server logs and tries again from its next daily clean-up, as long as the order was placed less than 60 days earlier. If Shopify refuses the deletion, the field stays on that order and the App records the failure in its server logs. Once the App has cleared its own copy of an order's recipient details or started deleting the field from that order, it never writes the field there again, even if the deletion failed: a later correction (saved by your staff, or a buyer's change on the fix page) updates only the shipping address, the order's additional details and the order note line. After you uninstall, the App no longer has access to your store and cannot delete the field, so it stays on any order it has not already been deleted from until Shopify removes it on its own schedule. If you reinstall and open the App before the App has deleted its records for your store (Section 13.3), the field comes back on those orders and the App deletes it at its next daily clean-up, including on an order whose deletion was still pending when you uninstalled. If you reinstall later, while Shopify still keeps the field, it comes back on those orders and the App does not delete it, because it no longer has a record of them
• Order note line. Adds or updates one "Gift recipient (Ship To Who)" line in the order note, unless you turn this off. It replaces only its own line and is designed to leave the rest of the note, including the buyer's own note, unchanged. If you turn the setting off, a line already on an order is still kept up to date when the order is fixed. Your staff can edit or remove the line in Shopify admin
• Corrections. When your staff save a correction (recorded as Fixed), or a buyer saves the fix page, one order update changes the shipping address (including the delivery phone), the recipient details saved on the order, the order note line and, unless the App has already cleared or started deleting it, the metafield. Order details written by other apps are kept. If Shopify sends the App its new-order notice again after a correction, or after the App has cleared the order's recipient details, the App does not overwrite the metafield or the order note line with the details from that notice

Other apps in your store that can read orders may see the tag, the order note line and the recipient details saved on the order.

7.3 Address Changes Do Not Recalculate Charges

Changing a shipping address through the App does not recalculate shipping rates, taxes or duties. You are responsible for checking whether the new address needs a different charge, and for any difference. The fix page does not let buyers change the country; your staff can, and should check charges when they do.

8. Optional Feature

The feature in this section is off by default. It appears in the App's settings only once we make it available, which we may do for all stores at once, and it does nothing until you turn it on. When you turn it on, you are responsible for its settings and for what it shows your buyers.

8.1 Customer Fix Page

What it does. It lets the buyer correct the recipient's details and the shipping address themselves, on a page hosted by the App. Buyers reach it from a link in your order confirmation email (once you paste the updated snippet), from the thank-you and order status page blocks, or from a link your staff create and send. Links from the email and the blocks check the order's confirmation number and then open the page for 2 hours. To stop guessing, ten wrong confirmation numbers within an hour lock an order's link until that hour is up, and the App also limits how often links can be opened from one network address and for orders it has no record of; a buyer who is refused sees a page asking them to contact you. The blocks show the link only when the page could open now, or when the order is up to 10 minutes old and the App has not finished handling it yet; in that case, until the App has handled the order, the page asks the buyer to try again in a minute or two. Links your staff create work for 7 days, and the App records the email of the staff member who created each one. The App deletes expired links daily. The page's footer says your store uses Ship To Who and links to our Privacy Policy.

Who can see it. Anyone with a working link can see the recipient's details and the full shipping address, including the delivery phone, and can change them. Send links you create only to the buyer. The thank-you and order status blocks ask the App for the fix-page link in the body of a request. The link they then show, like the link in your confirmation email, carries the order's ID and confirmation number in its web address until the App redirects the buyer to a page address without them, so that address can stay in the buyer's browser history. The App's request log records each request's method, the path it asked for with any query string removed and any link code masked, its status, size and response time, so the request log does not record confirmation numbers or link codes (DPA Section 5.2). The App's error records may include the path of the page where an error happened, with any query string removed and any link code masked in the same way. Our hosting provider and its edge network provider may separately keep their own platform request logs, which can include full web addresses, under their own retention terms. Only BrightLayer Lab's owner can access our server logs and hosting account.

When it is open. The page opens only for gift orders with a recipient entered (not "It's for me") and a shipping address, and your staff can create links only for those orders. For those orders it opens only within the fix window you set after the order is placed, while the App's hold is on the order, or through a link your staff created. It is closed once the order has a fulfillment, a fulfillment is in progress, the order is cancelled, or the order carries the cutoff tag you set. The App treats a fulfillment as in progress when Shopify's fulfillment status for the order shows that fulfilment has started, for example at a fulfillment service, and when it can see no fulfillment order 10 minutes after the order was placed, because the order has then gone to a fulfillment service the App cannot see or hold. When the page is closed, the buyer sees your contact message instead.

What a buyer's change does. The App first requests its hold on the order. If the order cannot be held, for example because fulfilment has started, the change is refused. If Shopify is not ready to place the hold yet, the change is saved and the App keeps trying to place the hold for up to an hour. The App updates the order as described in Section 7.2 and leaves any hold on. Details the page does not show, such as delivery details another app saved without a delivery type, are kept as they are. A buyer's change never releases a hold and never records an outcome: your staff review it and record the outcome, by saving the correction (recorded as Fixed) or recording a false alarm. If the buyer changes the details after a staff member opened the order in the App, the App refuses that staff member's correction or false alarm until they reload the order and see the change, and Needs attention offers no one-click False alarm for an order the buyer changed. While the App's hold is on the order, the buyer can instead choose "These details are correct": the App records that and changes nothing else, and refuses it if the buyer has typed changes without saving them.

Your responsibilities. You are responsible for:

• Setting a fix window, and a cutoff tag if your label or dispatch tools tag orders, so that the page closes before an order leaves your control
• Reviewing every buyer change before you release the hold
• Checking charges when the address changes (Section 7.3)
• The contact message buyers see

9. Liquid Snippets You Paste

The App's Setup page gives you Liquid code to paste into Shopify's order confirmation email template, and its Settings page, if you want, a block for your packing slip template. Apps cannot edit these templates, so you paste and maintain the code yourself.

• Shopify, not the App, sends the confirmation email and prints the packing slip
• The email snippet shows the buyer the recipient's name, the full shipping address and the delivery details. If you use the fix page, it also includes a link that carries the order's confirmation number
• Preview the result with a test order, and paste the snippet again after changing settings it depends on, such as the recipient name field or the fix page
• If you change the code, you are responsible for the result
• The snippets stay in your templates until you remove them, including after you uninstall the App

10. Pricing and Billing

10.1 The App Is Free for Now

The App is currently free of charge. We do not collect payment details.

10.2 Paid Plans

We may introduce paid plans. If we do, we will tell you in advance (Section 10.3), and you are charged only after you approve a plan in Shopify admin. Plans, prices, features and any free allowance or trial are shown on the App's Shopify App Store listing and on Shopify's plan approval screen before you approve a plan; the terms shown when you approve are authoritative. Once paid plans start, some features or volumes of use may require a paid plan. Billing runs through Shopify's billing system: we do not process payments directly, and all charges appear on your Shopify invoice.

10.3 Changes to Plans and Prices

We may change our plans and prices. We will tell you at least 30 days before paid plans start, and at least 30 days before a price change applies to a plan you are on.

10.4 Cancellation and Refunds

You may cancel at any time by uninstalling the App. Fees are collected through Shopify's billing system and are subject to Shopify's billing policies. Except where a refund is required by applicable law, App fees are non-refundable, including for partial billing periods and for the rest of a period after cancellation. We may, at our discretion, issue a credit or refund of App fees, for example after a confirmed extended outage or a billing error on our part. To ask for one, contact support@shiptowho.com.

11. Availability and Support

11.1 Service Availability

We strive to maintain high availability but do not guarantee uninterrupted service. The App depends on Shopify's platform and APIs and on our hosting and infrastructure providers. While any of them is unavailable, new orders may not be checked or held (Section 3). We are not responsible for their outages, or for changes Shopify makes to its platform, APIs or policies that affect the App (Section 12.2).

11.2 Support

Support is available via:

• Email: support@shiptowho.com
• Website: https://shiptowho.com

We will make reasonable efforts to respond to support requests in a timely manner.

11.3 Service Communications

We may send you service and administrative messages about your installation of the App, for example about incidents, defects or outages affecting your store, security, billing, and changes to the App or these Terms (Section 14). We send them to the contact described in Section 5.4, or to other contact details you give us or that Shopify makes available to app developers for your store. These messages are part of operating the App and are not marketing. We do not send marketing email to merchant contacts without consent, and any email that is not required to operate the App will include a way to opt out.

12. Limitation of Liability

12.1 Disclaimer

THE APP IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

WITHOUT LIMITING THE ABOVE, WE DO NOT WARRANT THAT THE APP WILL DETECT EVERY ORDER GOING TO THE WRONG ADDRESS OR RECIPIENT, THAT IT WILL NOT FLAG CORRECT ORDERS, THAT ANY ADDRESS IS VALID OR DELIVERABLE, OR THAT ANY ORDER WILL BE DELIVERED TO THE INTENDED PERSON OR ON TIME.

12.2 Limitation

TO THE MAXIMUM EXTENT PERMITTED BY LAW, AND SUBJECT TO SECTION 12.3, IN NO EVENT SHALL BRIGHTLAYER LAB OR ITS MEMBERS, OFFICERS, EMPLOYEES OR CONTRACTORS BE LIABLE FOR:

• Any indirect, incidental, special, consequential, or punitive damages
• Loss of profits, revenue, data, or business opportunities
• Damages arising from an order shipped to the wrong address or recipient, delivered late, or not delivered, including perishable goods, redeliveries and replacements, whether or not the App flagged or held the order
• Damages arising from a hold that delayed fulfilment, or from a false alarm
• Damages arising from changes made through the fix page by a person holding a link, unless our breach of our security obligations let that person obtain the link, or from settings, messages or snippets you configured
• Damages arising from customer disputes, chargebacks, or regulatory actions related to your fulfilment, delivery or customer-communication practices
• Damages arising from outages of Shopify, our hosting and infrastructure providers or any other third-party service, from the acts or omissions of Shopify or of any third-party service other than our sub-processors (for whom DPA Section 4.4 applies, within the limit below), or from changes Shopify makes to its platform, APIs or policies
• Any amount exceeding, in total, the greater of (a) the total fees paid by you for the App in the twelve (12) months preceding the claim and (b) US$100

This limit is our total liability for all claims together, whatever their basis, including claims under the Data Processing Agreement and claims about the security or confidentiality of data.

12.3 Exceptions

Nothing in Section 12.2 or in this Section 12.3 limits or excludes liability for gross negligence, wilful misconduct or fraud, or any liability that cannot be limited or excluded under applicable law, including liability to individuals under data protection law.

12.4 Merchant Indemnification

You agree to indemnify and hold harmless BrightLayer Lab and its members, officers, employees and contractors from any claims, damages, or expenses arising from:

• Your use of the App in violation of applicable laws
• Your fulfilment, delivery and customer-communication decisions, and your customer disputes
• The details you choose to collect through the recipient form, and the notes, messages and snippets you configure or edit
• Your failure to give buyers or recipients any notice required by law, or to respond to data subject requests
• Acts or omissions of your staff members, agents, or other users you grant access to the App

Indemnification procedure. We will notify you in writing of any claim for which we seek indemnification (a failure or delay in giving notice relieves you of your obligations only to the extent you are actually prejudiced by it). You may assume and control the defense and settlement of the claim with counsel of your choice, except that you may not agree to any settlement that imposes any liability, obligation, or admission of fault on BrightLayer Lab, or that does not fully release BrightLayer Lab, without our prior written consent (not to be unreasonably withheld). We may participate in the defense with our own counsel at our own expense, and each party will reasonably cooperate with the other in the defense of the claim.

12.5 Time Limit for Claims

To the extent permitted by law, any claim arising out of or relating to these Terms, the Data Processing Agreement or the App must be brought within one (1) year after the events giving rise to it. A claim not brought within that time is permanently barred.

13. Data and Uninstallation

13.1 Data Ownership and Roles

The order, buyer and recipient data processed through the App belongs to you (the merchant). We process it on your behalf under the DPA: as your processor under the GDPR and similar laws; as your service provider or processor under the California Consumer Privacy Act and similar US state laws; and, under PIPEDA and similar Canadian provincial laws, as a service provider to which you transfer personal information for processing, with you remaining accountable for it. This includes the email addresses of your staff that the App records on outcomes, corrections and fix links. We keep the staff access log, staff sign-in sessions and support correspondence about your account as our own records, as an independent controller, as described in the Privacy Policy and DPA Section 2.6.

13.2 While the App Is Installed

The App keeps its own copy of recipient and shipping details only for a limited time: until 30 days after an order is fulfilled or cancelled, or 60 days after the order was placed, whichever comes first. A daily clean-up clears them, normally within a day of that date, and the App then deletes its recipient field from those orders in Shopify, if it has not already done so from day 55 (Section 7.2).

Without customer names, addresses or phone numbers, the App keeps order IDs and numbers, check results and outcomes, for your accuracy figures, and the staff member who recorded each outcome or correction, as a record of who acted. It also keeps records of buyer reports (order ID and time), so a report is matched to its order, and of customer data requests (request ID, the buyer's Shopify customer ID, order IDs and date), as a record that the request was received and could be answered. It keeps all of these for as long as the App is installed and until your store's data is deleted (Section 13.3), except that a customer erasure request deletes the buyer report records for the orders listed and the data request records for that customer (Section 13.5). Order IDs can be linked to the buyer in Shopify. Fix links hold the order ID and, for links your staff create, that staff member's email, but no customer names, addresses or phone numbers; they are deleted daily once they expire (Section 8.1). DPA Section 5 lists each record and how long it is kept.

13.3 Uninstallation

When you uninstall the App:

• Shopify sends an app/uninstalled webhook, followed by a shop/redact webhook (ordinarily 48 hours later under Shopify's compliance schedule)
• Ask for a copy first. If you want a copy of what the App holds for your store, write to support@shiptowho.com before you uninstall, because uninstalling clears the recipient details at once (DPA Section 5.3)
• Release holds first. Once uninstalled, the App can no longer release its holds. Before uninstalling, resolve or release any Ship To Who holds; after uninstalling, release any that remain in Shopify admin
• On app/uninstalled, the App immediately deletes its access to your store, its pending retries and queued field deletions, and any fix links, and clears the recipient and shipping details from all of your store's records
• The remaining records (order numbers, check results, outcomes and change history without the customer details, the staff members who recorded them, buyer report and customer data request records, the staff access log, your settings, and your store's business country, province or state and development-store flag) are kept until shop/redact arrives, so a store that reinstalls within that time keeps its accuracy figures. On shop/redact, the App deletes everything it holds for your store in its database. If shop/redact has not already done so, the App's daily clean-up deletes everything it holds for your store once more than 30 days have passed since you uninstalled the App, unless you have reinstalled and opened the App (DPA Section 5.3). Copies in our database provider's restore history and in the App's server logs expire on our providers' schedules, which we keep to 28 days at most (DPA Section 5.2). Our hosting provider and its edge network provider may separately keep their own platform request logs under their own retention terms (Section 8.1)
• Deletion from the App cannot be undone by you or us through the App
• Data the App wrote into your Shopify store stays there, under Shopify's terms: tags, order note lines, hold notes, and corrected addresses and recipient details on orders. Your staff can change the tags, the order note and the shipping address in Shopify admin. The App's recipient field also stays on any order it has not already been deleted from, because the App can no longer delete it, until Shopify removes it on its own schedule after you uninstall; if you reinstall before then, it comes back, and the App deletes it only if it still holds your store's records and you open it (Section 7.2). Snippets you pasted stay in your templates until you remove them

13.4 Copies of Your Data and Customer Data Requests

The App has no bulk export, because the recipient details it uses are also saved on your orders in Shopify. If you want a copy of what the App holds for your store, write to support@shiptowho.com before you uninstall (Section 13.3).

When Shopify sends the App a customer data request, the App records it and lists it in its settings, which show the 20 most recent requests. The App does not notify you, so check the list regularly; we also remind you by email within 7 days of a request arriving (DPA Section 4.5). For each request you can download a file of the recipient details, shipping details, matched name words and correction history the App still holds for that customer's orders. The file does not include the App's check results, holds or outcomes for those orders, or your staff's identities; if you need the App's other records for a request, write to support@shiptowho.com and we will send them within 15 days (DPA Section 4.5). Once the App has cleared an order's details (Section 13.2), the file holds only what remains.

13.5 Customer Erasure Requests

When Shopify sends the App a customer erasure request, the App immediately clears the recipient details, shipping details, matched name words and correction details for the orders listed, deletes any fix links and buyer report records for those orders, and deletes the records of that customer's data requests. It keeps, until your store's data is deleted, the order record without those details and the staff email on outcomes and corrections (DPA Section 5.5). While the App is installed, it also deletes its recipient field from those orders in Shopify, if it has not already done so, and does not write it there again (Section 7.2). It does not otherwise change your Shopify store: you handle the customer's data there, including the order note line, the order's additional details, tags and hold notes.

13.6 Security

We protect the data the App processes with the technical and organizational measures described in Annex 2 of the DPA and in our Security and Incident Response Policy, which we make available on request at support@shiptowho.com. If a personal data breach affects your data, we will tell you without undue delay and no later than 72 hours after we become aware of it, as described in DPA Section 4.6, so that you can meet your own duties to report it, for example under the GDPR, PIPEDA or Quebec's Law 25. For personal information subject to Quebec's private-sector privacy law, we will also tell you without delay of any violation or attempted violation of our obligations to keep it confidential.

14. Modifications to Terms

We may change these Terms or the DPA. We will update the date above when we do. For a material change, we will give you at least 30 days' notice before it takes effect, by email to the contact described in Section 5.4 and on our website. Where a change is required sooner by law, or is needed urgently for security, we will give as much notice as we can. Changes to the DPA will not reduce the protection it gives personal data and will not change the Standard Contractual Clauses it incorporates. New sub-processors follow the notice and objection process in DPA Section 4.4, and the start of paid plans and price changes follow Section 10.3. If you do not agree to a change, you may uninstall the App before it takes effect. Continued use of the App after a change takes effect constitutes acceptance of the change.

15. Termination

We reserve the right to suspend or terminate your access to the App if:

• You violate these Terms
• Your Shopify store is suspended or terminated
• Continued provision of the service becomes commercially impractical, including if we stop offering the App

Where we suspend or terminate your access under this section for reasons other than your violation of these Terms, we will, where practicable, give you reasonable notice first, so you can release the App's holds. If we end your access without notice, any Ship To Who holds stay on your orders until your staff release them in Shopify admin.

Whatever the reason, you may ask for a copy of what the App holds for your store by writing to support@shiptowho.com, and we will provide it as described in DPA Section 5.3, unless it has already been deleted after an uninstall, by Shopify's shop/redact webhook or the App's 30-day clean-up (Section 13.3). If we end your access and you do not uninstall the App, we will delete what the App holds for your store within 30 days after your access ends, or after we send you the copy you asked for, if later. Deletion triggered by Shopify's shop/redact webhook proceeds on Shopify's compliance schedule and cannot be delayed.

Survival. The provisions of these Terms that by their nature should survive termination or expiration remain in effect afterward, including Section 10 (as to fees accrued before termination), Section 12 (Limitation of Liability, including the disclaimer, limitation, exceptions, indemnification and time limit for claims provisions), Section 13 (Data and Uninstallation), Section 15 (as to the return and deletion of data), Section 16 (Governing Law), Section 17 (Entire Agreement), Section 18 (Severability), and the DPA, for as long as we hold personal data processed for you.

16. Governing Law and Courts

These Terms shall be governed by and construed in accordance with the laws of the Commonwealth of Virginia, without regard to conflict of law principles. Any dispute arising out of or relating to these Terms, the Data Processing Agreement or the App shall be brought only in the state or federal courts located in the Commonwealth of Virginia, and you and we consent to the personal jurisdiction of those courts. The international transfer clauses in the DPA carry their own governing law and choice of forum (DPA Sections 6.1 to 6.3).

17. Entire Agreement

These Terms, together with the Data Processing Agreement, constitute the entire agreement between you and BrightLayer Lab regarding the App and supersede all prior agreements. The Privacy Policy is referred to in these Terms but is not part of that agreement. Your use of Shopify itself is governed by your agreement with Shopify, which these Terms do not change.

Order of precedence. For the processing of personal data, if these documents conflict, they apply in this order: the Standard Contractual Clauses, the UK Addendum and the Swiss adaptations incorporated in the DPA, where they apply, then the DPA, then these Terms (DPA Section 9).

These Terms, the Privacy Policy, and the Data Processing Agreement are provided in English, and the English-language documents are authoritative and govern in the event of any discrepancy with a translation.

18. Severability

If any provision of these Terms is found to be unenforceable, the remaining provisions shall continue in full force and effect.

19. Contact

For questions about these Terms:

• Company: BrightLayer Lab LLC
• Address: 8401 Mayland Dr #10685, Richmond, VA 23294, USA
• Email: support@shiptowho.com
• Website: https://shiptowho.com