Data processing addendum
Effective November 3, 2026. Last updated November 3, 2026.
This is the full text of the data processing addendum to the Backspin Labs Subscription Agreement. It covers both OrderPick and Tally. For a shop that uses Tally under the online terms rather than a signed Order Form, the addendum is part of those terms and needs no separate signature. In that case, "the Agreement" and "the standard terms" mean the online terms; a section of the standard terms means the part of the online terms on the same subject; an Order Form means the plan and stores chosen at checkout, or the price we confirmed in writing; and the Owner is the shop's owner in Tally. To get a signed copy, email support@backspinlabs.com.
Version of November 3, 2026. This Data Processing Addendum (the "DPA") forms part of the Backspin Labs Subscription Agreement and of any online terms for OrderPick or Tally that refer to it. It applies to both products. Terms defined in the standard terms have the same meaning in this DPA.
1. Scope and roles
1.1 Scope. This DPA applies to personal information in Customer Data that Backspin Labs processes on Customer's behalf in providing the Services ("Customer Personal Information"). If this DPA conflicts with the rest of the Agreement on the handling of personal information, this DPA controls. On all other matters, including the limits of liability, the standard terms control. A signed Order Form controls over both.
1.2 Roles. Customer determines the purposes and means of processing Customer Personal Information, and Backspin Labs processes it on Customer's behalf. Under the California Consumer Privacy Act, Customer is the business and Backspin Labs its service provider. Under the Texas Data Privacy and Security Act and similar laws, Customer is the controller and Backspin Labs its processor. Backspin Labs' own business records, such as billing contacts and sign-in records, are governed by its privacy policies.
1.3 Customer's responsibilities. Customer gives its customers and employees the notices the law requires and ensures that its instructions comply with the law.
2. Instructions
Backspin Labs processes Customer Personal Information only on Customer's documented instructions. Those instructions are the Agreement, Customer's settings in each Product, the actions Customer's people take in the Products, and any other written request from Customer that is consistent with the Agreement. If Backspin Labs believes an instruction violates the law, it tells Customer and is not required to follow it.
3. Nature and purposes of processing
Backspin Labs collects, stores, organizes, displays, transmits, updates, and deletes Customer Personal Information only for the following business purposes.
3.1 OrderPick. (a) Reading Customer's web orders from Workstand, and items and stock from Lightspeed, and displaying them to Customer's people; (b) recording the actions Customer's people take in OrderPick, and who took each one; (c) sending new-order push notifications to Apple devices on which they are turned on, alerting admins when syncing stops working, and emailing admins their sign-in codes; (d) taking the Workstand actions in section 6.2 of the standard terms, when Customer has turned them on and one of Customer's people requests the action; (e) where Customer turns on delivery tracking, looking up the delivery status of tracking numbers; and (f) where Customer turns on label buying, buying shipping labels for orders.
3.2 Tally. (a) Copying Customer's Lightspeed data and keeping the copy current, within the history period the Owner allows; (b) answering the questions Customer's people ask through their own AI assistants, within each person's access rights, and providing the exports they request; (c) sending sign-in codes, invitations, account notices, the morning brief, and alerts; (d) where the Owner has turned on write access and one of Customer's people approves a change, making the change in Lightspeed and keeping a record of it; and (e) where the Owner turns on time-clock records, copying them to answer questions about labor.
3.3 Both Products. Securing the Services, investigating misuse and errors, keeping backups, supporting Customer, and improving the Services for Customer.
4. Categories of data, data subjects, and duration
Annex 1 sets out, for each Product, the categories of Customer Personal Information processed, the people it relates to, and how long it is kept. Backspin Labs processes Customer Personal Information while the Agreement is in effect and afterward until it is deleted under section 11. Annexes 1 and 2 describe the Products as of this version. As the Products change, Backspin Labs may update those descriptions in the Documentation, provided that no update materially reduces the protection of Customer Personal Information. An update that keeps Customer Personal Information materially longer takes effect only after 30 days' notice to Customer. Changes to Annex 3 are governed by section 8.
5. Restrictions
Backspin Labs does not: (a) sell Customer Personal Information, or share it for cross-context behavioral advertising; (b) retain, use, or disclose it for any purpose, commercial or otherwise, other than the business purposes in section 3; (c) retain, use, or disclose it outside its direct business relationship with Customer; (d) combine it with personal information that it receives from or on behalf of anyone else, or collects on its own behalf, except as the law permits a service provider to do for those business purposes; or (e) use it to train AI models or to provide services to anyone else. Backspin Labs certifies that it understands these restrictions and will comply with them.
6. Compliance with privacy laws
Backspin Labs complies with the obligations that apply to it as a service provider or processor under the laws named in section 1.2 and similar laws, and provides Customer Personal Information the same level of privacy protection those laws require of Customer. It tells Customer in writing if it decides it can no longer meet these obligations. Customer may take reasonable and appropriate steps to ensure that Backspin Labs uses Customer Personal Information consistently with Customer's obligations, including the steps in section 12, and, on notice, to stop and remediate any unauthorized use, including by suspending the affected Product or ending the Agreement.
7. Personnel and security
Backspin Labs limits access to Customer Personal Information to personnel who need it to operate, secure, support, or fix the Services, each of whom is bound to keep it confidential. It maintains the technical and organizational measures in Annex 2, which are reasonable security procedures and practices appropriate to the nature of the information. It will not materially reduce the overall protection of Customer Personal Information during the term.
8. Subprocessors
Customer approves the subprocessors listed in Annex 3. Each processes Customer Personal Information only to provide its service to Backspin Labs. Hetzner, Cloudflare, and Resend are bound by written data protection terms that impose obligations at least as protective as this DPA's, as they apply to the service each provides. Apple provides push notifications under its developer terms and Backspin Labs' email inbox under its iCloud terms. Customer's people should not email Backspin Labs personal information about Customer's customers or employees, and any such information they do send is held under those iCloud terms. Anthropic provides its AI tools under its own terms, with model training on Customer Personal Information turned off. Backspin Labs remains responsible for its subprocessors. It emails Customer at least 30 days before adding or replacing one. If Customer objects on reasonable data protection grounds and the parties cannot resolve the objection, Customer may end the affected Product before the change takes effect and receive a refund of any fees paid for the period after it ends.
9. Assistance with requests
If one of Customer's customers or employees contacts Backspin Labs about their personal information, Backspin Labs refers them to Customer and informs Customer, unless the law prohibits it. When Customer asks for assistance with a request to know, access, correct, or delete a person's information, Backspin Labs helps within 10 business days, or sooner if a legal deadline requires it. Backspin Labs also provides reasonable assistance with Customer's security obligations, breach notifications, and any data protection assessment the law requires of Customer.
10. Security incidents
10.1 Notice. A "Security Incident" is any unauthorized access to, or acquisition, loss, alteration, or destruction of, Customer Personal Information in Backspin Labs' care or the credentials for Customer's systems that Backspin Labs holds. Backspin Labs notifies Customer of a Security Incident without undue delay, and no later than 72 hours after confirming it, and sooner where the law requires. Backspin Labs works promptly to confirm any suspected Security Incident.
10.2 Contents and follow-up. To the extent then known to Backspin Labs, the notice describes what happened, the information involved and the approximate number of people affected, the steps Backspin Labs is taking, and whom to contact. Backspin Labs updates the notice as it learns more. Customer decides whether and how to notify its customers, employees, and regulators, and Backspin Labs assists by providing the relevant facts. Backspin Labs gives any notice that its own suppliers' terms require, including notice to Lightspeed concerning Lightspeed data. Otherwise, it does not name Customer without Customer's consent unless the law requires it. Notice of a Security Incident is not an admission of fault.
11. Return and deletion
11.1 During the term. Customer may export its data using Tally's export features. For OrderPick, and for any data that Tally's export features do not cover, Backspin Labs provides an export on request. The Owner may delete Tally's copy at any time using "Disconnect and delete" in Tally's Settings.
11.2 When an Order Form ends. Customer may request an export within 21 days after an Order Form ends, as described in section 11.6 of the standard terms. Backspin Labs deletes Customer Personal Information from its live systems within 30 days after the Order Form ends. Backups are deleted as they expire, on the schedule in Annex 1. If a backup is restored to recover the Services, any data that was due for deletion is deleted again. If Lightspeed ends Backspin Labs' access, Backspin Labs deletes the data it copied from Lightspeed once it learns that access has ended, as Lightspeed's terms require. Tally also deletes its copy automatically if the copy has not been refreshed for the full history period the Owner set.
11.3 Retained records. Backspin Labs may retain billing records, and any other data the law requires it to retain, for as long as the law requires, and this DPA continues to protect anything retained. On request, Backspin Labs confirms deletion in writing.
12. Demonstrating compliance
12.1 Information. On reasonable request, and no more than once a year unless there has been a Security Incident, Backspin Labs answers Customer's written security and privacy questions and makes available the information reasonably necessary to demonstrate its compliance with this DPA. The annual limit does not apply when the information is needed by a regulator or for a data protection assessment the law requires of Customer.
12.2 Assessments. Once a year, at Customer's cost and after 30 days' written notice, Customer, or an independent assessor bound by confidentiality obligations, may conduct a reasonable assessment of Backspin Labs' compliance, and Backspin Labs cooperates. An assessment does not include access to other customers' data. Instead of an assessment, Backspin Labs may provide an independent assessor's report covering the same matters. Backspin Labs reviews the measures in Annex 2 at least once a year.
13. Data location
Customer Personal Information and its backups are stored on servers in the European Union. Some subprocessors listed in Annex 3 process it in the United States. Backspin Labs notifies Customer at least 30 days before moving the storage of Customer Personal Information outside the European Union.
Annex 1. Categories of data, data subjects, and retention
OrderPick
| Category | Data | Retention |
|---|---|---|
| Customer's web customers | Name, email address, shipping address, and phone number; items ordered; order notes, including Workstand's staff-only comment; a payment summary (card type, last four digits, amounts, dates, and status); tracking numbers and delivery status; and, where Customer turns on label buying, the shipping labels purchased. Full card numbers are never included. | Customer details are cleared 90 days after an order closes, unless Customer requests a different period. Orders that are still open, or staged for pickup and not yet collected, are kept until they close. Label files are deleted after 30 days. |
| Customer's staff | Name, initials, role, and home store; for admins, the email address Customer enters for each admin, and their sign-in codes, one-time sign-in links, and sessions (stored only as one-way hashes), with the times each session started and was last used; the email addresses and IP addresses that requested or attempted an admin sign-in code, kept to limit attempts; the actions each person took in OrderPick, and when; and the push token of each Apple device with notifications turned on. | Until an admin deletes the person. Their name is then removed from the activity history, although it may remain in service logs until those logs are rotated out. Sign-in codes, links, and sessions are deleted when they expire. The email and IP addresses kept to limit attempts are deleted after one day. |
| Credentials for Customer's systems | The Workstand staff login Customer provides and the Workstand session OrderPick maintains with it; the login for the order-notice mailbox, if Customer sets one up; the Lightspeed connection token; and, where Customer turns on label buying, Customer's shipping-label account key, which is stored encrypted. | Until Customer changes it or the Agreement ends. |
| Backups | A nightly copy of the database and settings, kept on the server and as an encrypted copy in separate backup storage. | Deleted on a rolling basis: from the server within about three weeks, and from backup storage within 30 days. |
OrderPick's service logs may include order numbers, tracking numbers, item descriptions, and the sign-in names of Customer's people, and are kept on the server until they are rotated out. OrderPick also keeps item and stock details read from Lightspeed on its order records for the term. It does not read customer, sales, or employee records from Lightspeed.
Tally
| Category | Data | Retention |
|---|---|---|
| Customer's customers | Name and company; the company's registration and VAT numbers if entered; one email address and one phone number; city, state, and ZIP code; tags; the note on their record; their purchases, work orders, special orders, and layaways, with the notes on them; serial numbers; account, deposit, and gift card balances. | Customer records: for as long as the copy is refreshed. Sales and work orders: 60 days, or the longer history period the Owner allows. |
| Customer's employees | Name and role; the sales and labor recorded under their name; and, where the Owner turns them on, time-clock records. | As for customers. Time-clock records are kept within the same history period and deleted when the feature is turned off. |
| Customer's vendors | Vendor records as they appear in Lightspeed, including sales representatives' names and any contact details Lightspeed holds for them. | For as long as the copy is refreshed. |
| Customer's Tally users | Name, email address, role, access rights, and sign-in times; the email addresses and IP addresses that requested or attempted a sign-in code, kept to limit attempts; a log of the lookups each person used; and the facts people ask Tally to remember, with who saved each one. | Account details and remembered facts: for the term. A removed person loses access immediately, and their account is kept, marked as removed, until the term ends. Activity log: 13 months. The email and IP addresses kept to limit attempts are deleted after one day. |
| Changes made through Tally | The change as shown, the record before and after the change, who approved it, and when. | 13 months after the change is settled. |
| Backups | An encrypted nightly copy of the database, and any rolling backups the hosting company keeps of the server's system disk. | Deleted on a rolling basis, within about seven months. |
Tally does not copy payment card or bank numbers, customers' street addresses or birth dates, or Customer's Lightspeed password. When one of Customer's people changes a customer's contact details through Tally, the record of that change, including any street address it contains, is kept as stated in the row for changes made through Tally.
Annex 2. Security measures
- Hosting. Servers and backup storage are rented from Hetzner in the European Union.
- Encryption. Data passes between the apps, browsers, and servers over encrypted connections (TLS). Tally's database and backups are encrypted at rest, and Tally stores Lightspeed tokens in encrypted form.
- Authentication and roles. Each person signs in with their own login, except where Customer sets up a login for a shared shop device in OrderPick. The Owner or admins control what each person can see and do, and can switch off a person's access immediately. Access to payment capture, settings, and people management in OrderPick, and to costs, customer details, and team figures in Tally, is limited to the people granted that access.
- Least privilege. The services run under their own restricted system accounts and request the narrowest Lightspeed permissions available for the features they use. OrderPick only reads Lightspeed.
- Separation between shops. OrderPick keeps each shop's data in a separate database. Tally separates each shop's data within the database itself, with row-level security on the queries that answer people's questions.
- Credentials. Credentials Customer gives the Products, such as a Workstand login or Lightspeed tokens, stay on the servers and in their encrypted backups, are readable only by the service and the administrator, are never displayed back, and are kept out of logs.
- Activity logging. Each Product records the actions taken through it and who took them, for the Owner or admins to review.
- Backups. Each Product backs up its database nightly and has a written restore procedure.
- Administrative access. Server administration is limited to Backspin Labs' operator, who signs in to the servers with a key over encrypted connections, never with a password.
- Payment cards. Payments are processed by Customer's own payment processor. The Products never handle full card numbers.
- Incidents. Suspected incidents are investigated, contained, and reported under section 10.
- Subprocessors. Only the subprocessors listed in Annex 3 are used, on the terms described in section 8.
Annex 3. Subprocessors
| Subprocessor | Product | Service | Customer Personal Information | Location |
|---|---|---|---|---|
| Hetzner Online GmbH | Both | Servers and backup storage | All Customer Personal Information, at rest | European Union |
| Cloudflare, Inc. | OrderPick | Secure connection between the apps and the server, the shared sign-in page, and DNS | Order data passing between the server and staff devices, and the email address an admin enters on the sign-in page | United States and its global network |
| Apple Inc. | OrderPick | Push notifications to Apple devices | Order number, item counts, and supplier name, but never a customer's name or address | United States |
| Plus Five Five, Inc. (Resend) | Both | Email delivery | Recipients' email addresses and the text of each email | United States |
| Popout, Inc. (Shippo) | OrderPick | Shipping labels, used only where Customer turns on label buying | Recipient's name, address, and phone number, and parcel details | United States |
| Anthropic, PBC | Both | AI tools Backspin Labs uses to run, support, and fix the Services | Any Customer Personal Information, but only when that work requires it | United States |
| Apple Inc. (iCloud Mail) | Both | Backspin Labs' email inbox | Any information Customer's people include in an email to Backspin Labs | United States |
Not subprocessors. Lightspeed, Workstand, and the AI providers that Customer's people connect to Tally are Customer's own providers. Anthropic is listed above only for the AI tools Backspin Labs itself uses. OrderPick and Tally do not themselves send Customer Data to any AI provider. Stripe processes Backspin Labs' own billing records. Tailscale provides the private network used for server administration and, where a device uses it, for the connection to OrderPick. That traffic is encrypted end to end, so Tailscale cannot read it. On Android, OrderPick's barcode scanner sends device diagnostics to Google, but no order data or camera images. Where Customer turns on delivery tracking, OrderPick sends tracking numbers to USPS.