Law 25 compliance with third party ( app developer)

Hi @Farah2025 ,

To clarify, when I refer to “Shopify-built apps,” I specifically mean those developed directly by Shopify, as opposed to apps created by third-party developers.

It’s important to note that the “Built for Shopify” badge (indicated by a diamond icon) in the App Store signifies that an app meets certain quality standards, but it doesn’t guarantee that it was developed by Shopify itself. These apps may still be from third-party developers and are not covered by Shopify’s Data Processing Addendum (DPA).

Examples of apps built by Shopify and thus covered under Shopify’s DPA include:-

  • Shopify Email
  • Shopify Inbox
  • Shopify Flow
  • Shopify Translate & Adapt.

You can typically verify if an app is Shopify-built by checking the developer’s name in the App Store, which will usually be listed as “Shopify.” These apps are fully protected under Shopify’s privacy and security policies, including their DPA.

If you cannot find a suitable app that meets your requirements, an alternative solution would be to use or develop a custom uploader that ensures images are stored in Canada with a valid DPA. This approach would involve the following:

  • Customers directly upload their photos to a secure server located in Canada.
  • You (or a developer) integrate this custom uploader into your Shopify store.
  • You establish a Data Processing Addendum directly with the hosting provider.

I hope this clarifies the distinction between Shopify-built and third-party apps, as well as an alternative solution for your needs.

Please let me know if you need any further clarifications.

Thanks !