Security & PrivacyPolicy
Personal Data Protection Policy
This internal policy governs how Bump The DSL, LLC, the company that builds and operates Relay (“we”) collects, uses, stores, shares and deletes personal data. It covers the personal data of customers, creators and affiliates, suppliers and staff, including personal data Relay receives through the Shopify and TikTok Shop platforms.
Summary
We use personal data only to run our own business, keep as little as we can for as short a time as we can, store it in the United States, never sell it, and help sellers and TikTok Shop with any request to access, correct or delete it.
Principles
- Transparency. We tell people what we collect and why.
- Purpose limitation. Data is used only for the purpose it was collected for.
- Data minimization. We collect and keep only what that purpose needs.
- Accuracy. Data is corrected when we learn it is wrong.
- Storage limitation. Data is deleted when it is no longer needed.
- Security. Data is protected as our Data Classification and Encryption Policy requires.
- Accountability. We keep records that show we follow this policy.
Data Protection Officer
We have appointed a Data Protection Officer (DPO): the owner of Bump The DSL, LLC. The DPO oversees this policy, answers privacy questions and requests, and leads our response to any personal data incident. You can reach the DPO at privacy@bumpthedsl.com with "Attn: Data Protection Officer" in the subject line.
Data we receive from TikTok Shop
- We use it only to run our own TikTok Shop and its creator collaborations: finding and contacting creators, managing product samples, tracking content and commissions, and replying to messages.
- We never sell or rent it, never share it with third parties for their own purposes, and never use it to build profiles or target advertising outside our own shop's operations.
- It is not shared with AI providers unless the owner deliberately switches that option on. It is off by default.
- Access tokens are encrypted, Relay's requests to TikTok Shop are signed, and notifications from TikTok Shop are verified by signature.
- If our authorization is revoked, the access tokens are deleted immediately and all requests stop.
- We follow TikTok Shop's data and API policies.
Where data is stored and processed
Relay stores and processes personal data in the United States. It is hosted by Fly.io in Ashburn, Virginia, and its database is hosted by Neon on Amazon Web Services in Ohio (us-east-2).
Service providers
| Provider | Purpose | Location |
|---|---|---|
| Shopify | Online store and order management | Per Shopify's terms |
| TikTok Shop | Sales channel and creator collaboration platform | Per TikTok Shop's terms |
| Fly.io | Hosting for Relay | United States |
| Neon (on Amazon Web Services) | Database hosting for Relay | United States |
| Google Workspace | Business email | Per Google's terms |
| Anthropic | AI assistant features, used only when the owner turns them on | United States |
Requests from individuals, sellers and TikTok Shop
People can ask to access, correct, delete or receive a copy of their personal data. We will assist sellers and TikTok Shop in meeting such requests from their users:
- Requests can be sent to privacy@bumpthedsl.com. Requests passed on by a seller or by TikTok Shop are handled with priority.
- We verify the requester's identity, then locate the data in all of our systems.
- We update, delete or provide the data, and confirm when it is done, within 30 days or sooner if the law or our agreement requires.
- Privacy requests that arrive through Shopify's privacy notifications are handled automatically.
Retention and deletion
- Personal data is kept only as long as its purpose requires, and much of it is deleted automatically on a schedule. For example, a creator's shipping address is erased a set number of days after their sample is delivered, message and note text is deleted after a set retention period, and platform notification records are deleted after 30 days.
- At the end of a relationship. When Relay's TikTok Shop authorization ends, or our agreement with a seller or with TikTok Shop ends, we delete or irreversibly anonymize all personal data received under it within 30 days. Data the law requires us to keep is the only exception, and it is isolated and protected until it can be deleted.
Data breaches
Suspected and confirmed breaches are handled under our Incident Response Policy, which includes notifying affected sellers and TikTok Shop without undue delay, and within 72 hours at most.
Training
Everyone who handles personal data reads this policy when they join and again every year.
Review of this policy
This policy is reviewed at least once a year and whenever we add a system, change how we use personal data, or learn something from an incident. The next scheduled review is October 2027. Version 1.0, first published October 23, 2026.
Contact
Questions about this policy can be sent to privacy@bumpthedsl.com.