Data Processing Addendum

Lightward's Data Processing Addendum for Mechanic — roles, security, sub-processors, international transfers, deletion, and breach notification.

Last updated: April 10, 2026

This Data Processing Addendum (DPA) is part of the agreement between Lightward and the customer who uses Mechanic.

By using Mechanic, the customer agrees to this DPA.

1. Roles

The customer, as controller, determines why and how Personal Data is processed.

Lightward, as processor, processes Personal Data only as needed to provide Mechanic and support the customer's use of it.

Lightward processes Personal Data only according to the customer's documented instructions, including:

(a) the customer's subscription;

(b) the customer's configuration of Mechanic inside their shop; and

(c) the customer's use of Mechanic's features.

2. Purpose

Lightward processes Personal Data only as needed to provide Mechanic and as otherwise allowed under the agreement.

3. Security

Lightward implements reasonable technical and organizational measures designed to protect Personal Data against unauthorized access, loss, or misuse.

4. Confidentiality

Lightward ensures that team members who access Personal Data are bound by confidentiality obligations.

5. Sub-Processors

The customer authorizes Lightward to use sub-processors as necessary to provide Mechanic.

Lightward maintains an up-to-date list of sub-processors and may update this list from time to time.

6. International Transfers

Lightward may transfer Personal Data internationally as needed to provide Mechanic, using appropriate legal mechanisms where required under applicable law.

7. Assistance

Where required by law and technically feasible, Lightward will help the customer respond to data subject requests.

Lightward will make available reasonable information necessary to demonstrate compliance with this DPA upon request.

8. Deletion

When the customer stops using Mechanic, Lightward will delete or return Personal Data according to the agreement unless the law requires Lightward to keep it.

9. Breach Notification

Lightward will notify the customer without undue delay if Lightward becomes aware of a Personal Data Breach.

Appendix A: Sub-Processors for Mechanic

Last updated: April 30, 2026

Sub-processors are engaged only as necessary to provide Mechanic.

Infrastructure & Hosting

• Fly.io — application hosting

• Crunchy Data — managed PostgreSQL database hosting

• Amazon Web Services (AWS) — infrastructure services, including queueing and storage

Platform Integrations

• Shopify, Inc. — authentication, API platform, and webhook delivery

Optional Service Providers

These providers are used only when the merchant enables specific features or integrations.

• Postmark (ActiveCampaign, LLC) — email delivery

• PDFCrowd — PDF generation

• Slack Technologies, LLC — Slack integration

• Google LLC — Google integration

• Airtable — Airtable integration

• GitBook — documentation and AI-powered assistance, used only when a user uses Ask Mechanic AI in app

Error Monitoring

• Rollbar, Inc. — error monitoring and diagnostics