Last updated: 10 September 2026
Digital Product Labs, Inc. (“DPL”, “we”, “us”, “our”) provides the Squarespace Integration & Sync application (the “App”), which connects your Squarespace site to your connected ecommerce store so that products, inventory, and orders stay in sync.
This policy explains what data the App accesses, why we access it, who we share it with, how long we keep it, and how you can revoke access or have your data deleted. It applies specifically to the App. Our general website and company privacy practices are described separately.
Data controller: Digital Product Labs, Inc., 2035 Sunset Lake Road, Suite B-2, Newark, Delaware 19702, USA. Privacy contact: squarepos@dpl.company
1. What we access from your Squarespace site
The App accesses your Squarespace site only after you authorize it through Squarespace’s own OAuth consent screen, and only within the permission scopes you approve. Depending on the features you enable, this may include:
Product and catalog data – product titles, descriptions, SKUs, variants, options, pricing, images, and categories. Used to create and update listings and to match products between your site and your connected store.
Inventory data – stock counts and availability per SKU or variant. Used to read and update stock levels so quantities stay aligned across channels.
Order data – order numbers, line items, quantities, order totals, fulfillment status, and shipping and billing details, which include your customers’ names, addresses, email addresses, and phone numbers. Used to import orders for fulfillment and to write fulfillment status back to your site.
Transaction data – order-level financial details such as amounts, currency, taxes, and discounts, where required to import an order accurately. The App does not access full payment card numbers or payment credentials.
Site information – your site ID, site title, and configured currency and locale, used to identify the correct site and apply the right settings.
The App requests only the scopes needed for the features you enable. It does not access your Squarespace site content, billing details, or password.
2. What we collect directly from you
Account information – your name, business name, email address, and phone number when you create a DPL account or contact us.
Billing information – plan, billing period, and transaction records. Our payment providers process payments; we do not store full card numbers.
Support information – messages, screenshots, logs, and configuration details you send us when requesting help.
Technical and usage data – IP address, browser and device type, timestamps, pages viewed in the App dashboard, sync run logs, and error records. Used to operate the service, diagnose faults, and protect against abuse.
3. How we use data
We use the data described above to:
- run the syncs you configure, in the direction and with the field rules you set;
- import orders and write fulfillment status back to your site;
- provide setup help, technical support, and troubleshooting;
- detect, investigate, and prevent fraud, abuse, and security incidents;
- process subscriptions, billing, and renewals;
- send service messages about outages, reauthorization requirements, and changes to the App;
- improve reliability and performance, using aggregated or de-identified data.
We do not sell your data. We do not use your Squarespace product, inventory, order, or customer data for advertising, marketing, profiling, or model training, and we do not share it with advertising networks or data brokers.
We send marketing emails about DPL products only to your DPL account contact address, and every message includes an unsubscribe link. You can opt out at any time by writing to hello@dpl.company.
4. Legal bases for processing
Where GDPR or UK GDPR applies, we rely on:
- performance of a contract – to provide the App you have subscribed to;
- legitimate interests – service security, fraud prevention, diagnostics, and product reliability;
- consent – where required for optional analytics or marketing communications, withdrawable at any time;
- legal obligation – tax, accounting, and lawful requests for information.
5. Your customers’ personal data
Order data includes your customers’ personal data. For that data, you are the controller, and DPL acts as your processor: we process it on your documented instructions, solely to deliver the App, and we do not use it for our own purposes. You are responsible for having a lawful basis to share it with us and for informing your customers in your own privacy notice.
If one of your customers exercises a data right directly with us, we will refer them to you and help you respond.
6. Access tokens and revoking access
Squarespace grants authorization through its OAuth flow. We store access and refresh tokens encrypted and use them only to operate the App on your behalf. Token lifetimes are set by Squarespace, and expiry may require you to reauthorize before syncing resumes.
You can revoke the App’s access at any time from your Squarespace account settings, or by uninstalling the App. When you revoke access, syncing stops immediately, and the App can no longer read from or write to your site. To also have stored data deleted, write to squarepos@dpl.company.
7. Who we share data with
We share data only with service providers who process it on our behalf under contract, and only as needed to run the App:
- cloud hosting and storage – to host the App and store synced data;
- email delivery – to send service and account email;
- customer support tooling – to manage support conversations;
- product analytics and error monitoring – to diagnose faults in the App;
- payment processing – to bill subscriptions.
We may also disclose data where required by law, valid legal process, or a lawful government request, or to establish or defend legal claims. If DPL is involved in a merger, acquisition, or asset sale, data may transfer as part of that transaction, and we will notify you if it becomes subject to a different privacy policy.
Squarespace, Inc. is an independent third party. DPL is not affiliated with, endorsed by, or acting as an agent of Squarespace, Inc. Data you hold on Squarespace remains governed by Squarespace’s own privacy policy.
8. International transfers
DPL operates from the United States and maintains a team in Nepal. Data may be processed in either location and by service providers in other countries. When we transfer data out of the EEA or UK, we rely on appropriate safeguards, including Standard Contractual Clauses, and require our providers to maintain equivalent protection.
9. Retention and deletion
- Access and refresh tokens – deleted when you revoke access or uninstall the App.
- Synced product, inventory, and order data – retained while your account is active, then deleted within 30 days of account closure or a deletion request.
- Support conversations – retained up to 24 months.
- Sync and error logs – retained up to 90 days.
You can request export or deletion of your data at any time by writing to squarepos@dpl.company. We respond within 30 days.
10. Security
We protect data using encryption in transit and at rest, scoped API credentials, role-based internal access limited to staff who need it, audit logging of administrative actions, and regular dependency and patch review. No system is completely secure, but we will notify affected users and relevant regulators of a qualifying personal data breach without undue delay.
11. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict processing, to withdraw consent, and to lodge a complaint with a supervisory authority. Residents of California and other US states with comprehensive privacy laws may request disclosure of the categories of data collected and shared, request deletion, and opt out of sale or sharing. DPL does not sell personal data or share it for cross-context behavioral advertising.
To exercise any right, write to squarepos@dpl.company. We do not discriminate against users who exercise their privacy rights.
12. Children
The App is a business tool and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have, contact us, and we will delete it.
13. Cookies
The App dashboard uses cookies that are strictly necessary for sign-in, session security, and preferences. Cookie use on the DPL public website is covered by our general website privacy policy.
14. Changes to this policy
We may update this policy to reflect product, legal, or platform changes. The “Last updated” date above will change when we do, and we will notify you by email or in-app notice of material changes. Continued use of the App after an update constitutes acceptance of the revised policy.
15. Contact
Digital Product Labs, Inc., 9450 Southwest Gemini Drive, Beaverton, OR 97008, USA
Support: squarepos@dpl.company · General: hello@dpl.company Phone: +1 205 415 2736