Last updated: October 8, 2026
This Data Processing Addendum ("Addendum") forms part of the Block Hero Terms of Service (the "Terms") between Three Two Studio LLC, doing business as Block Hero, 9510 Timberline Drive, Indianapolis, Indiana 46256, United States ("Block Hero", "we") and the merchant that installs the Block Hero app on its Shopify store ("Merchant", "you"). It applies whenever Block Hero processes Personal Data on your behalf through the app.
Terms such as "controller", "processor", "data subject" and "processing" have the meanings given in the GDPR.
You are the controller of the Personal Data about your Shoppers, and Block Hero is your processor. Under the CCPA, Block Hero is your service provider. This Addendum does not cover information Block Hero handles as a controller in its own right, such as your store account details, billing records and how your staff use the Block Hero admin; the Block Hero Privacy Policy covers those.
3.1 Block Hero processes Personal Data only on your documented instructions. By installing and configuring the app you instruct Block Hero to process Personal Data as described in Annex 1, which is to publish your scheduled content and show you how it performs.
3.2 Block Hero will tell you if it believes an instruction breaks Data Protection Laws, unless the law forbids it.
3.3 You are responsible for having a lawful basis for the processing, including showing your Shoppers a cookie or consent banner where the law requires one. Block Hero's storefront tracking follows the choice Shoppers make in Shopify's consent tools (Annex 2).
Block Hero makes sure that everyone it authorises to process Personal Data, including employees and contractors, is bound by a duty of confidentiality and can access the data only as far as needed to run, support or improve the service.
Block Hero applies the technical and organisational measures in Annex 2 and keeps them appropriate to the risk. It may update them as long as the overall level of protection does not go down.
6.1 You authorise Block Hero to use the Sub-processors listed in Annex 3.
6.2 Block Hero will give you at least 30 days' notice before adding or replacing a Sub-processor, by updating Annex 3 and emailing your store's contact address. You may object on reasonable data protection grounds within that period. If we cannot address the objection, you may stop using the app and uninstall it, which triggers deletion under section 9.
6.3 Block Hero has written terms with each Sub-processor that protect Personal Data at least as well as this Addendum, and remains responsible for its Sub-processors' performance.
7.1 Shopify passes Shoppers' requests to Block Hero automatically:
customers/redact): Block Hero automatically deletes the order records named in the request and the click session events and session summaries linked to them.customers/data_request): Block Hero gives you the data it holds about the orders named in the request within 30 days.7.2 If a Shopper contacts Block Hero directly, we will pass the request to you and not answer it ourselves, unless you ask us to.
7.3 Block Hero will give you reasonable help with data protection impact assessments and consultations with supervisory authorities, as far as they concern the processing under this Addendum.
Block Hero will tell you without undue delay, and no later than 72 hours after becoming aware of a Security Incident affecting your Personal Data. We will give you the information we have about its nature, the data and Shoppers likely affected, the likely consequences and the steps taken, and keep you updated. We will take reasonable steps to contain it and reduce its effects.
9.1 During the Terms, Block Hero deletes Shopper analytics events automatically 25 months after they happen (order records one day later), and each session summary 25 months after the session's last event.
9.2 When you uninstall the app, Block Hero keeps your data for 48 hours, so a reinstall loses nothing. Shopify then sends Block Hero a deletion request for your store, and Block Hero automatically deletes the Personal Data about your Shoppers, together with your blocks and content. If you reinstall within those 48 hours, nothing is deleted.
9.3 Copies in our hosting provider's request logs are deleted within 30 days (Annex 2). Block Hero may keep data longer only where the law requires it, and then only for that purpose.
Once a year, or after a Security Incident, you may ask Block Hero in writing for the information needed to show it complies with this Addendum. We will answer in writing within a reasonable time, including our Sub-processors' relevant security statements and certifications where available. If that information is not enough to meet a requirement of Data Protection Laws, we will agree reasonable further steps with you, at your cost. On-site audits are not included unless Data Protection Laws require them.
11.1 Block Hero and its Sub-processors process Personal Data in the United States (and, for our hosting provider, Canada).
11.2 Where Personal Data protected by the GDPR is transferred to Block Hero in a country without an adequacy decision, the Standard Contractual Clauses, Module Two (controller to processor), apply and are incorporated by reference, with you as data exporter and Block Hero as data importer, and with: in Clause 7, the docking clause applying; in Clause 9, option 2 (general authorisation, with the notice period in section 6.2); in Clause 11, the optional language not applying; in Clauses 17 and 18, the law and courts of Ireland. Annexes 1 to 3 of this Addendum complete the Clauses' annexes.
11.3 For Personal Data protected by the UK GDPR, the International Data Transfer Addendum issued by the UK Information Commissioner applies together with the Standard Contractual Clauses. For Personal Data protected by Swiss law, the Standard Contractual Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and to the competent supervisory authority as the Swiss Federal Data Protection and Information Commissioner.
As your service provider, Block Hero will not sell or share Personal Data, will not retain, use or disclose it for any purpose other than providing the app to you or outside our direct business relationship with you, and will not combine it with personal information from other sources except as the CCPA allows. Block Hero will tell you if it can no longer meet these obligations.
13.1 If this Addendum conflicts with the Terms, this Addendum wins for anything about Personal Data. If it conflicts with the Standard Contractual Clauses, the Clauses win.
13.2 Each party's liability under this Addendum is subject to the limits in the Terms.
13.3 This Addendum is governed by the laws of the State of Delaware, and disputes go to the courts named in the Terms, except that the Standard Contractual Clauses are governed as stated in section 11.
13.4 This Addendum lasts as long as Block Hero processes Personal Data for you.
| Data exporter | The Merchant (controller). Contact: the store's contact details in Shopify. |
| Data importer | Three Two Studio LLC, doing business as Block Hero (processor). Contact: accounts@blockhero.io. |
| Data subjects | Shoppers who visit the Merchant's storefront. |
| Categories of Personal Data | For every visitor whose browser allows analytics: which block and content item was shown or clicked, the store domain, block type and time. For Shoppers who click a block and allow analytics: a random session ID kept in the Shopper's browser, page views, product views, add to cart, reaching checkout, and for orders the Shopify order ID, order total and subtotal in the store's currency, and order time. Three cart attributes (session ID, content ID, block ID) that Shopify copies onto the order. For logged-in Shoppers, Shopify's customer ID appears in our hosting provider's request logs. Block Hero does not collect names, email addresses, phone numbers, postal addresses, payment details or IP addresses in its analytics database. |
| Sensitive data | None. |
| Nature of processing | Collection through the Merchant's storefront and Shopify's checkout pixel, storage, aggregation into reports for the Merchant, and deletion. |
| Purpose | Publishing the Merchant's scheduled content, and showing the Merchant how each block performs (impressions, clicks, sessions, page views, add to cart, reached checkout, orders and revenue for sessions that start with a block click). Not used for advertising, profiling or for any other merchant. |
| Frequency | Continuous while the app is installed. |
| Retention | Section 9: events 25 months (order records one day longer); session summaries 25 months after the session's last event; hosting request logs 30 days; deleted after uninstall as in section 9.2. |
| Transfers to Sub-processors | As listed in Annex 3, for the purposes stated there. |
| Competent supervisory authority | The supervisory authority of the EU member state where the Merchant is established, or where its EU representative is established. |
| Sub-processor | What it does | Personal Data | Location |
|---|---|---|---|
| Gadget Software Inc. | Hosts the app, its database and its storefront endpoints | All Annex 1 data passes through it; request logs for 30 days | United States and Canada (Google Cloud) |
| Tinybird Inc. | Analytics database | Shopper events, session summaries and order records (Annex 1) | United States (Google Cloud, us-east4) |
PostHog is not listed: it receives only how the Merchant's staff use the Block Hero admin, which Block Hero handles as controller under its Privacy Policy, never Shopper data.
## Related