BulkBase terms of service and data processing agreement

Last updated: October 1, 2026

These terms are an agreement between Twinfire Group SIA, Spartaka iela 26-21, Tukums, LV-3101, Latvia (registration number 40203766304, VAT LV40203766304) ("we"), and the merchant who installs BulkBase on a Shopify store ("you"). Installing or using the app means you accept them.

1. The service

BulkBase imports and exports Shopify store data with spreadsheets, previews changes before they are made and can undo them afterwards. We provide it as it is and keep improving it. Shopify's own limits and availability apply to everything the app does in your store.

2. Plans and billing

Paid plans are billed by Shopify on your Shopify invoice, every 30 days, in USD. You can change or cancel your plan at any time in the app; Shopify prorates the difference. Uninstalling the app cancels the plan. Fees already charged are not refunded, except where the law requires it.

3. Your responsibilities

You are responsible for the files you import and the changes you apply. Review each preview before applying it.
You have the right to the data you import, and a lawful basis for any personal data it contains.
You don't use the app to break the law, Shopify's terms, or to overload Shopify or our servers.

4. Liability

We take care to make the app safe: nothing changes before you apply a preview, and applied imports can be undone. To the extent the law allows, we are not liable for indirect or consequential losses, lost profits or lost data, and our total liability is limited to the fees you paid for the app in the 12 months before the claim.

5. Ending the agreement

You can stop at any time by uninstalling the app. We can end the service for a store that breaks these terms, with notice where possible. On uninstall your store's data is deleted as described in the privacy policy.

6. Data processing agreement

This section is the data processing agreement under Article 28 of the EU General Data Protection Regulation (GDPR) and similar laws. For personal data in your store that the app handles, you are the controller and we are the processor.

Subject and duration. We process personal data only to provide the app: to import, export, preview, undo and schedule the store data you choose, for as long as the app is installed, and then for the retention periods below.
Data and people. Names, email addresses, phone numbers, addresses, marketing preferences, tags, notes and order details of your customers, as contained in the files and store data you import or export.
Instructions. We process personal data only on your documented instructions, which are the imports, exports and automations you set up in the app. We don't use it for any other purpose, don't sell it, and don't use it for advertising, profiling or training.
Confidentiality. Only people at Twinfire Group SIA who need access to run and support the app have it, and they are bound to confidentiality.
Security. We apply the measures described on our security page, including encryption in transit and at rest, encrypted backups, key-only server access and automatic security updates.
Sub-processors. Vultr Holdings LLC hosts the app and its data in Frankfurt, Germany (EU). Shopify provides the store data and billing. We tell you before adding or replacing a sub-processor, and you may object by uninstalling the app.
Assistance. We help you answer requests from people exercising their rights, and with security, impact assessments and consultations where they concern the app. Shopify's customer data request and erasure webhooks are handled automatically.
Breaches. We tell you without undue delay, and within 48 hours of becoming aware of a personal data breach affecting your store, with what we know and what we are doing about it.
Deletion. Uploaded and exported files are deleted after 30 days (or the shorter period you choose in Settings), import history after 90 days (or when you delete it in Settings), and all of your store's data when you uninstall the app (backups roll over within 14 days).
Audits. We make available the information needed to show compliance with this section and answer reasonable audit questions in writing.
Transfers. Data is stored and processed in the EU. Any transfer outside the EU or EEA would use a lawful transfer mechanism such as the EU Standard Contractual Clauses.

7. Changes and law

We publish changes to these terms here with a new date, and tell you in the app about important ones. Latvian law applies, and the courts of Latvia have jurisdiction, without limiting the rights consumers or businesses have under the laws of their own country.

Contact

Questions about these terms: janis@twinfireup.com.