Privacy Policy — BuildAnyShop

Draft — not yet in force. The company is named and the substance is written

from what the application actually does, verified against the code. Four values

are still provisional and are marked (placeholder): the two retention periods,

the transfer mechanism, and whether an Article 27 representative is required. A

lawyer should see those before this is published.

Last updated: 18 October 2026 · Applies to: the BuildAnyShop application and

https://www.buildanyshop.com

> What this covers, and what it does not.

>

> This document is between Adpence LLC and the people who use BuildAnyShop.

>

> It is not the policy of any shop built with it. A store generated or bought

> here ships its own privacy policy and terms as drafts, with the business name,

> address, jurisdiction and contact left blank — because that shop belongs to its

> buyer, who is its own data controller and must supply their own details. Adpence

> LLC is never named on a shop it does not own, and a test enforces that.

1. Who we are

BuildAnyShop is a service of Adpence LLC, a limited liability company formed

in Wyoming, United States, at 1404 Dalmation Pl. Apt T2, Belcamp, MD 21017.

Questions, requests, or complaints: privacy@buildanyshop.com, a monitored

mailbox.

Adpence LLC is established in the United States. Where we handle the data of

people in the UK or EEA we do so as described in sections 8 and 13. If we are

required to appoint a representative under UK or EU GDPR Article 27, they are

named here: none appointed (placeholder).

2. The two kinds of data, and our two different roles

This matters more than anything else in this policy, so it comes first.

Your data, as a merchant. When you sign up, connect a shop, and pay us, we

decide what to collect and why. We are the controller of that data.

Your customers' data. When a shopper buys from your shop, we handle their

name and address only to carry out the fulfillment you asked us to perform. You

decide that; we act on your instruction. You are the controller and we are

your processor.

That second role is why this policy tells your shoppers very little directly —

they are your customers, and your own store policy governs your relationship with

them. What it does tell them is where their address goes, because we are the ones

who send it.

3. What we collect from merchants

We do not collect or store your card details. Payments are taken by Shopify

or by Stripe on their own pages.

4. What we handle about your shoppers

When a shopper completes a paid order in your shop, Shopify sends us that order

and we take exactly these fields:

• the shopper's name
• the shopper's email address
• the shopper's shipping address, including phone number where provided
• the order and line item identifiers, quantities and amounts

We take them for one reason: a dropshipping supplier ships directly to the

shopper, and no parcel arrives without a named recipient and an address.

We do not collect dates of birth, payment details, card numbers, browsing

history, marketing preferences, customer notes or tags, or any shopper who has

not placed a paid order. We do not request access to your shop's customer list.

5. Who we share shopper data with

To fulfill an order we disclose the shopper's **name, shipping address and phone

number** to the supplier fulfilling that line:

These companies operate internationally, including outside the UK and EEA. Where

that involves a transfer of personal data, it is made on the basis of

Standard Contractual Clauses (placeholder).

**If you install this app, your shoppers' addresses will be sent to the supplier

you source from.** Your own store privacy policy needs to say so.

6. Our other service providers

AI providers are sent the words needed to write a storefront: a niche, a product

name, a tone. A shopper's details are never part of a prompt.

7. What we do not do

• We do not sell personal data.
• We do not use shopper data for advertising, profiling or marketing.
• We do not use shopper data to train AI models.
• We run no advertising trackers, analytics pixels or third-party cookies on our

site.

8. Legal bases (UK/EU GDPR)

• Contract — to provide the service you signed up for and to bill you.
• Legitimate interests — security, fraud prevention, keeping an audit trail,

and debugging. We keep these records narrow for that reason.

• Legal obligation — tax and accounting records.

For shopper data, the lawful basis is yours to determine as the controller. We

process it only on your instruction.

9. How long we keep it

10. How we protect it

• Shop access tokens and supplier credentials are encrypted at rest

(AES-256-GCM). The service refuses to start without an encryption key.

• All traffic is over HTTPS.
• Every webhook we accept is signature-verified before it is acted on.
• We keep an append-only audit trail of every use of customer data. The trail

records that data was read and for which order; personal fields are reduced to

a length and secrets are redacted, so the record of who looked at an address

never becomes a second copy of it.

No system is perfectly secure, and we do not claim otherwise. We will notify affected

people, and the relevant authority, of a qualifying breach within the time the

applicable law requires — which for UK or EEA data is 72 hours to the

supervisory authority.

11. Erasure and access requests

Shoppers: contact the shop you bought from. They are the controller. When

they pass the request to Shopify, Shopify notifies us and we act automatically:

• a data request is recorded and the records are retrievable by order id
• an erasure request clears the shopper's name, email and shipping address

from our fulfillment records

We keep the sale itself — what was sold, what it cost, the margin — because that

is the merchant's own commercial record and not the shopper's personal data.

Merchants: email privacy@buildanyshop.com to access, correct, export or

delete your data. When you uninstall the app, Shopify tells us 48 hours later and

we delete your shop's orders, stores and access token.

If you are in the UK or EEA you may also complain to your own supervisory

authority — in the UK, the Information Commissioner's Office.

12. United States privacy rights

Adpence LLC is a US company, and several US states give residents rights over

their personal information. Where those laws apply to us:

• We do not sell personal information, and we do not share it for

cross-context behavioural advertising. There is nothing to opt out of, because

we do not do it.

• You may ask what we hold about you, ask for a copy, ask us to correct it, and

ask us to delete it.

• We will not discriminate against you for asking.

California residents: the categories in §3 and §4 are the categories we collect;

§5 and §6 are who receives them; §8 and §9 are why and for how long. We do not

knowingly collect the personal information of anyone under 16.

To exercise any of this, email privacy@buildanyshop.com. If a shopper asks us

directly about an order from a merchant's shop, we will tell them to contact that

merchant, who is the controller — and we will tell the merchant.

13. International transfers

We are in the United States. Our suppliers (§5) operate in China, the United

States and the EU, and our service providers (§6) are international.

Where personal data of people in the UK or EEA is transferred to us or to a

supplier on our instruction, the transfer is made on the basis of

Standard Contractual Clauses with the UK Addendum (placeholder).

A merchant acting as controller may need their own transfer basis for the

disclosure they are instructing us to make.

14. Children

The service is for businesses. It is not directed at anyone under 16 and we do

not knowingly collect their data.

15. Changes

We will post changes here and update the date above. Material changes will be

notified to merchants by email before they take effect.

16. Contact

Adpence LLC · formed in Wyoming · 1404 Dalmation Pl. Apt T2, Belcamp, MD 21017 · privacy@buildanyshop.com

Still outstanding

Every value marked (placeholder) is a provisional default, not a fact. The

page at /privacy shows a draft banner and stays out of search results until

they are gone.

Settled: Adpence LLC, formed in Wyoming, operating from 1404 Dalmation Pl. Apt

T2, Belcamp, MD 21017. Privacy contact: privacy@buildanyshop.com, a live

mailbox. Hosting: Strasmore, Inc. Sub-processors include Resend, which sends our

transactional email. Effective 18 October 2026.

Then

• ☐ Have a lawyer review it. This draft is accurate about the software, which

is not the same as being legally sufficient in any jurisdiction

• ☐ Put https://www.buildanyshop.com/privacy on the Shopify listing
• ☐ Reference the same URL in the Protected Customer Data application
• ☐ Re-check §5 and §6 whenever a supplier or provider is added or removed