> For the complete documentation index, see [llms.txt](https://learn.mechanic.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://learn.mechanic.dev/platform/policies/dpa.md).

# Data Processing Addendum

Lightward's Data Processing Addendum for Mechanic — roles, security, sub-processors, international transfers, deletion, and breach notification.

*Last updated: April 10, 2026*

This Data Processing Addendum (DPA) is part of the agreement between Lightward and the customer who uses Mechanic.

By using Mechanic, the customer agrees to this DPA.

## 1. Roles

The customer, as controller, determines why and how Personal Data is processed.

Lightward, as processor, processes Personal Data only as needed to provide Mechanic and support the customer's use of it.

Lightward processes Personal Data only according to the customer's documented instructions, including:

(a) the customer's subscription;

(b) the customer's configuration of Mechanic inside their shop; and

(c) the customer's use of Mechanic's features.

## 2. Purpose

Lightward processes Personal Data only as needed to provide Mechanic and as otherwise allowed under the agreement.

## 3. Security

Lightward implements reasonable technical and organizational measures designed to protect Personal Data against unauthorized access, loss, or misuse.

## 4. Confidentiality

Lightward ensures that team members who access Personal Data are bound by confidentiality obligations.

## 5. Sub-Processors

The customer authorizes Lightward to use sub-processors as necessary to provide Mechanic.

Lightward maintains an up-to-date list of sub-processors and may update this list from time to time.

## 6. International Transfers

Lightward may transfer Personal Data internationally as needed to provide Mechanic, using appropriate legal mechanisms where required under applicable law.

## 7. Assistance

Where required by law and technically feasible, Lightward will help the customer respond to data subject requests.

Lightward will make available reasonable information necessary to demonstrate compliance with this DPA upon request.

## 8. Deletion

When the customer stops using Mechanic, Lightward will delete or return Personal Data according to the agreement unless the law requires Lightward to keep it.

## 9. Breach Notification

Lightward will notify the customer without undue delay if Lightward becomes aware of a Personal Data Breach.

## Appendix A: Sub-Processors for Mechanic

*Last updated: April 30, 2026*

Sub-processors are engaged only as necessary to provide Mechanic.

### Infrastructure & Hosting

* Fly.io — application hosting
* Crunchy Data — managed PostgreSQL database hosting
* Amazon Web Services (AWS) — infrastructure services, including queueing and storage

### Platform Integrations

* Shopify, Inc. — authentication, API platform, and webhook delivery

### Optional Service Providers

These providers are used only when the merchant enables specific features or integrations.

* Postmark (ActiveCampaign, LLC) — email delivery
* PDFCrowd — PDF generation
* Slack Technologies, LLC — Slack integration
* Google LLC — Google integration
* Airtable — Airtable integration
* GitBook — documentation and AI-powered assistance, used only when a user uses Ask Mechanic AI in app

### Error Monitoring

* Rollbar, Inc. — error monitoring and diagnostics


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://learn.mechanic.dev/platform/policies/dpa.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.