Security & PrivacyLegal
Privacy Policy
This Privacy Policy explains how Bump The DSL, LLC (“we”, “us”) collects, uses, shares and protects personal information through Relay, the software we build and operate to manage an online store's orders, customer support, advertising and creator collaborations (“the store”). It covers customers of the store, creators and affiliates we work with, suppliers and team members, people who interact with the ads and social media accounts we manage, and anyone who visits a page Relay serves, such as an order tracking page, the creator application page, a supplier upload page or this website.
Purchases are also covered by the privacy policy of the store you bought from, which is linked from its website. Some Relay features described here are optional; we describe them so you know what happens when they are in use.
Summary
We collect what we need to run the store and to work with creators and partners. We do not sell personal information for money, we share it with advertising platforms only with your consent, sensitive details are encrypted, data is stored in the United States, and you can ask us to see, correct or delete your data at any time by emailing privacy@bumpthedsl.com.
Who we are
Relay is built and operated by Bump The DSL, LLC, a New York limited liability company, which is responsible for the personal information described in this policy. Our Data Protection Officer is the owner of Bump The DSL, LLC and can be reached at privacy@bumpthedsl.com with “Attn: Data Protection Officer” in the subject line.
Information we collect
| Who | What we collect | Where it comes from |
|---|---|---|
| Customers of the store | Order number, items, order and fulfillment dates, and carrier and tracking details. The email address on an order, used only to confirm that the person looking up tracking owns the order: it is checked and discarded, never stored. Ratings and comments you leave about a delivery. If you subscribe to a product: your name, email address, phone number, billing and shipping addresses and subscription details. For refunds and payment disputes: the order and payment facts, and evidence such as your name, email address, shipping address, the IP address used for the purchase, and emails between you and the store's support team. If you sign up in a pop-up form on the store: your email address and the notice you were shown. | You, and Shopify, which runs the store. Payment card details stay with Shopify and its payment processors; Relay never receives or stores them. |
| Visitors to the store, only with your consent | Pages and products viewed, cart and checkout steps and purchases; random browser and session identifiers; the referring website, campaign (UTM) tags and ad click identifiers; device type (mobile, tablet or desktop); and the consent choices you made. Like any website, our tagging server also sees your IP address and browser details. | Relay's storefront tracking code, which follows the choices you make in the store's cookie and privacy banner, and Shopify's own visit data. |
| Creators and affiliates | Your public profile and performance information from TikTok Shop (handle, follower counts, content and sales figures); messages exchanged with us through TikTok Shop; sample requests; what you submit when you apply to work with us (such as your name, email address and social media handles); your contact details and shipping address for samples; content you create for us; agreements and usage rights; and commission and payout records (a payment reference only, never bank or card details). | You, and TikTok Shop. |
| People who interact with the ads and social media we manage | Comments on the Facebook and Instagram ads we manage: the text, your public name and the identifier Meta gives your account for that Page or Instagram account. Replies you send to our automated private message (read and labelled, not stored). The fact that you sent that Facebook Page or Instagram account a new direct message; Relay does not read or keep its content. | Meta (Facebook and Instagram). |
| Suppliers and support team members | Name, email address and WhatsApp number; your agreement to receive work requests and alerts; and proof of delivery you upload (files, delivery date, carrier, tracking number, the name of the person who signed, and notes). | You. |
| Our staff | Shopify staff account details (account id, name, email address and language) from signing in through Shopify, and a record of actions taken in Relay, such as opening an order or changing a setting. | Shopify, and Relay itself. |
| Anyone who uses a Relay page | Security information: a keyed hash of part of your IP address, used to limit repeated attempts, and an anonymous visit identifier. Raw IP addresses are not stored for this. This website uses no tracking scripts or advertising cookies. | Your browser. |
How we use information
- To fulfil orders and show you where your order is.
- To run subscriptions you sign up for, including billing on the schedule you chose and letting you cancel.
- To handle refunds and payment disputes, including sending evidence to Shopify, payment processors and card networks.
- To work with creators: finding and contacting creators, sending samples, running campaigns, managing content rights, and calculating commissions.
- To moderate comments on the ads we manage and direct customer questions to the store's support team.
- To send work requests and alerts to suppliers and support team members.
- To send marketing emails you signed up for.
- To measure and improve our marketing, only with your consent.
- To keep our systems secure, prevent fraud and abuse, and keep records of who did what.
- To comply with the law and enforce our terms.
We do not use personal information to make decisions about you that have legal or similarly significant effects.
AI features
We use Anthropic's Claude AI service in two ways:
- Comment moderation. The text of comments on the ads we manage, and of replies to our automated private message, is sent to Claude to label it negative, neutral or positive. Your name and account identifier are not sent.
- A staff assistant. Our staff can ask an assistant about orders, deliveries, reviews, ads, subscriptions and disputes, and it looks up the records needed to answer. It never receives payment card details, passwords or access keys, or the contact details stored with subscriptions and dispute evidence. Information from TikTok Shop reaches it only if we deliberately turn that option on, and Gmail data never does. Our staff may also connect their own AI assistant to Relay with a revocable access key; it can read the same kinds of records.
Anthropic processes this information to provide its service to us, under commercial terms that do not allow it to train its models on it.
Comments on the ads we manage
We moderate comments on the Facebook and Instagram ads we manage. If our system labels a comment negative, for example a complaint about an order or a product, it may hide the comment, send you one private message that says it is automated and asks you to email the store's support team so they can help, and then delete the comment so the issue can be resolved privately. We send at most one such message per person every 7 days, we leave neutral and positive comments alone, and a person on our team can review and reverse any of these actions.
How we share information
We share personal information only with the service providers and platforms we use to run our business:
| Recipient | What it receives | Why |
|---|---|---|
| Shopify | Order, customer and subscription information, refunds, and dispute evidence; proof-of-delivery requests sent to suppliers by email through Shopify Flow | Runs the store, payments, subscriptions and customer accounts |
| Payment processors and card networks, through Shopify | Dispute evidence, including the support email excerpts we pick | To respond to chargebacks |
| Fly.io | Everything Relay processes | Hosting, in the United States |
| Neon, on Amazon Web Services | Relay's database | Database hosting, in the United States |
| Cloudflare | Requests to this website; if we turn it on, encrypted archives of old records that Cloudflare cannot read | Website hosting and storage |
| Our business email; read-only access to one support mailbox we manage; store visit and purchase events, with analytics consent; search statistics for our websites, with no personal information | Email, dispute evidence and analytics | |
| Meta (Facebook, Instagram and WhatsApp) | Store visit and purchase events, with marketing consent; our automated private replies; work alerts to suppliers and team members who agreed to them | Ad measurement, comment moderation and work alerts |
| TikTok | Messages, sample decisions and collaboration invitations to creators through TikTok Shop; store visit and purchase events, with marketing consent, if we turn that on | Creator collaborations and ad measurement |
| Anthropic | As described under AI features | AI features |
| Klaviyo | The email address you give in a pop-up sign-up form | Sending the emails you signed up for |
We may also disclose information when the law requires it, to protect the rights, safety and property of our customers, our business or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to it.
Advertising and your choices
We do not sell personal information for money. If you allow marketing cookies on the store, we share events about your visit and purchase with Meta, and with TikTok if we turn that on, so they can measure and improve the ads we manage. Your email address, phone number, name and address details are hashed (scrambled) before they are sent to Meta; your IP address and browser details are sent as Meta requires. Some US state laws call this “sharing” or “targeted advertising”. You can opt out at any time through the store's cookie and privacy settings, and Relay follows that choice. If you opted out of the sale or sharing of your information, purchase events sent to Meta carry Meta's Limited Data Use flag.
Google user data
Relay connects to one support mailbox that we manage, using Google's read-only Gmail permission (gmail.readonly). It cannot send, change or delete email.
- What Relay reads. Only while a payment dispute is open, and only when a member of our staff opens that dispute's customer emails, Relay searches the mailbox for messages to, from or copied to that order's customer in a date range around the order, and reads their dates, senders, subjects, text and attachment names.
- How it is used. Only to find correspondence that is evidence for that dispute. A member of our staff picks which messages to use, and quotes from them, with email addresses, phone numbers and card-like numbers removed, are included in our response to the dispute.
- What is stored. Search results are not stored. Only the quotes our staff pick are kept, encrypted, with the dispute record. The permission to read the mailbox is stored encrypted.
- Who it is shared with. The picked quotes are sent to Shopify as part of our dispute response, and Shopify passes them to the payment processor and card network. Gmail data is not shared with anyone else, not sold, not used for advertising, not sent to AI tools, and not used to develop, improve or train artificial intelligence or machine-learning models.
- Removing access. We can disconnect the mailbox in Relay at any time, which revokes Relay's access at Google and deletes the stored permission.
Relay's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Relay also reads reports from our own Google Analytics, Tag Manager and Search Console accounts, which contain no information about you beyond the analytics events described above.
Information from TikTok Shop
We use information from TikTok Shop only to run the TikTok shop we manage and its creator collaborations. We never sell it, never share it with third parties for their own purposes, and never use it to build profiles or target advertising outside that shop. It is shared with AI services only if we deliberately turn that option on, and if our TikTok Shop authorization ends, its access tokens are deleted immediately and the data received under it within 30 days. Our Personal Data Protection Policy has more detail.
Cookies and similar technologies
The store uses cookies under the choices you make in its cookie banner, and Relay's tracking code sends nothing without your consent. With analytics consent it may set _relay_bid, a random browser identifier, and read Google Analytics cookies. With marketing consent it may set _relay_clk, which remembers the ad click identifiers you arrived with for up to 90 days, and read Meta's _fbp and _fbc cookies. Google and Meta set their own cookies under their own policies.
How long we keep information
These are our standard periods. We delete information sooner when you ask us to (see our Data Deletion Instructions), unless the law requires us to keep it.
| Information | How long we keep it |
|---|---|
| Email address used to look up tracking | Not stored; held in memory for at most 30 seconds |
| Tracking lookup records (order and anonymous visit identifiers) | 400 days |
| Delivery ratings and comments | 24 months |
| Shipment records | 24 months after delivery |
| Store visit events | 90 days |
| Purchase measurement records | 400 days; the analytics identifiers in them are removed after 72 hours |
| Records of purchase events sent to Meta (no contact details) | 180 days |
| Comments on the ads we manage, with the commenter's name and identifier | 90 days |
| Notices of new direct messages | A coded reference for 8 days; alert records without your details for 180 days |
| Creator sample shipping addresses | 30 days after the sample is delivered |
| Creator messages and notes | 365 days |
| Other creator records | While we work together, then as long as needed for commission, tax and legal records |
| Subscription records | For the life of the subscription, then as long as needed for accounting, tax and legal obligations |
| Refund and dispute records | As long as needed to resolve the dispute and meet accounting and legal obligations |
| Supplier proof-of-delivery uploads | 120 days after the dispute is closed |
| Pop-up email sign-ups | Until you ask us to delete them |
| Supplier and team contact details | Until they are removed from our list |
| Staff sign-in sessions | 30 days after they expire |
| Encrypted archives of old pop-up and upsell events (random identifiers only) | Up to 2 years |
How we protect information
All traffic is encrypted in transit, our database is encrypted at rest, and the most sensitive details (such as contact details, shipping addresses, messages and dispute evidence) are encrypted again by Relay before they are saved. Access is limited to people who need it and is logged. Our Information Security Policy and Data Classification and Encryption Policy describe these protections.
Your rights and choices
Depending on where you live, you may have the right to know what personal information we hold about you and get a copy of it, to correct it, to delete it, to receive it in a portable format, to opt out of its sale or sharing and of targeted advertising, and to withdraw consent you gave. We do not use sensitive personal information to infer characteristics about you.
- To make a request, email privacy@bumpthedsl.com with “Privacy” in the subject line. To delete your data, follow our Data Deletion Instructions.
- We verify that the request comes from you, for example by replying to the email address on your order, and we respond within 30 days. We never ask for your password.
- You may use an authorized agent; we may ask for proof that they act for you.
- If we decline a request, you can appeal by replying to our decision, and we will answer within the time the law requires.
- We will not treat you differently for using your rights.
- Marketing emails: use the unsubscribe link in any email. Work alerts: tell us and we stop. Creators: ask us to stop contacting you and we add you to a do-not-contact list.
If you are in the European Economic Area or the United Kingdom, we rely on these legal bases: performing a contract with you (orders, subscriptions and collaborations), our legitimate interests (running and securing our business, handling disputes, moderating comments on the ads we manage, and working with suppliers), your consent (analytics and advertising cookies, and marketing emails), and legal obligations. You may object to processing based on our legitimate interests, and you may complain to your local data protection authority.
Children
Relay and the store are not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact privacy@bumpthedsl.com and we will delete it.
Where information is processed
Relay stores and processes personal information in the United States. The platforms we connect to, such as Shopify, Meta, Google and TikTok, may process it in other countries under their own terms.
Changes to this policy
We will update this policy when our practices change and show the date of the change at the top of this page. If a change is significant, we will make it clear on this page before it takes effect.
Contact us
Questions about this policy or your personal information can be sent to privacy@bumpthedsl.com, or to our Data Protection Officer at the same address with “Attn: Data Protection Officer” in the subject line. Support questions, including questions about an order, go to the same address.