PARTMASH(TM) PRIVACY POLICY

Last updated: October 29, 2026 | Effective Date: October 29, 2026

This Privacy Policy explains how Horsepower Connections LLC, an Arizona limited liability company doing business as The EFI Store ("Company," "we," "us"), collects, uses, and shares information in connection with PartMash (the "Service").

This policy is separate from, and does not replace, the privacy policy governing purchases at theefistore.com.

1. Information We Collect

Account information: name, business name, email address, and login credentials you provide when you register.

Payment information: billing details processed by our third-party payment processor, or by Shopify when you pay for the PartMash Shopify app through your Shopify bill. We do not store full payment card numbers.

Connected Account credentials and tokens: when you connect QuickBooks Online, Shopify, or a supplier, we store the access and refresh tokens issued by that provider. We do not receive or store your password for those services.

Subscriber Data: product records, part numbers, descriptions, prices, costs, inventory levels, catalog structure, orders, invoices and related accounting records retrieved from your Connected Accounts on your instruction, or uploaded by you as files.

Your customers' information: when you use orders-to-QuickBooks or tracking, the Service handles the names, email addresses, shipping addresses and order or invoice numbers of your customers, from your store's orders, your QuickBooks invoices, and the vendor shipping and order-confirmation emails you forward to your PartMash address. We process this information only on your behalf and only to provide those features to you.

Usage and technical data: log data, device and browser type, IP address, pages viewed, features used, and timestamps.

Cookies: used to keep you signed in and to protect forms from forgery.

2. How We Use Information

We use the information we collect to:

• provide, operate, maintain, and secure the Service;
• retrieve, compare, and reconcile product and pricing data across your Connected Accounts;
• generate reports and proposed changes for your review;
• make changes in your Connected Accounts that you have approved, or that you have set the Service to make for you (for example, nightly orders into QuickBooks or sending tracking);
• email your customers their tracking information on your behalf, when you have turned that on;
• process Subscriptions, billing, and renewals, and communicate about your account;
• provide customer support and respond to your requests;
• monitor usage, prevent fraud and abuse, and enforce our terms;
• improve and develop the Service; and
• comply with legal obligations and protect our legal rights.

3. What We Do NOT Do

• We do not sell your personal information, your customers' information, or your business data.
• We do not use one customer's data to serve another customer. Your cost, pricing, and catalog data is not pooled, aggregated across customers, or used to benchmark other subscribers.
• We do not use your accounting data or your customers' information for advertising or marketing.
• We do not use your data to train machine learning models offered to other parties.

4. Legal Bases for Processing

Where required by law (for example, for users in the European Economic Area or the United Kingdom), we process personal information on the bases of contract performance, legitimate interests, consent, and compliance with legal obligations. For your customers' information, we act as your service provider (processor) and follow your instructions.

5. Intuit QuickBooks Online Data

This section governs data accessed through your QuickBooks Online connection.

What we read. With your authorization, the Service reads product and service items, item pricing and cost, item categories, vendors, customers, invoices, and related records from your QuickBooks Online company.

What we write. The Service writes to QuickBooks Online only what you have approved, or have set it to do for you:

• creating products and services, deactivating ones you choose, and setting an item's vendor;
• creating customers, invoices and payments for your store's paid orders;
• adding the shipping carrier, tracking number and ship date to an invoice.

Every change is recorded (see Change history below) so it can be reviewed and, where possible, undone.

Why we access it. Solely to provide the Service to you: to compare your catalog against your supplier data, to put your store's orders and customers into your books, to record shipments on your invoices, and to present differences for your review.

We access only what the Service needs. We request the narrowest QuickBooks scopes required to perform these functions.

We do not:

• sell, rent, or trade QuickBooks data;
• use QuickBooks data for advertising, marketing, or profiling;
• disclose QuickBooks data to any third party except the service providers listed in Section 7, and only as needed to operate the Service;
• combine one customer's QuickBooks data with another customer's data.

Disconnection. You may disconnect QuickBooks at any time, from within the Service or from within Intuit's own app management page. On disconnection we immediately cease all further access and revoke the stored tokens.

Deletion on disconnection. Following disconnection, we delete Subscriber Data derived from your QuickBooks company from our live systems within thirty (30) days. Reconnecting before then cancels the deletion. We keep only the record of which store orders were already entered in QuickBooks (QuickBooks record numbers, no customer details), so a later reconnection does not enter the same orders twice, and anything retention is required for by law or for legitimate accounting, tax, or dispute-resolution purposes.

Token security. OAuth access and refresh tokens are stored encrypted at rest and are used only to perform the functions described above.

6. Shopify Data

This section governs data accessed through the PartMash app for Shopify, or a Shopify access token you provide.

What we read. Products, variants, prices, inventory and locations; paid orders, including your customers' names, email addresses, phone numbers, and billing and shipping addresses; and fulfillment orders.

Why each piece of your customers' information is used. Only for the features you turn on:

• Name and email: to find the matching customer in your QuickBooks, or create one, so each order's invoice is filed under the right person.
• Phone: recorded on a customer PartMash creates in your QuickBooks. It is not used for anything else.
• Billing address (zip): to tell apart two customers in your books with the same name.
• Shipping address: to match a vendor's shipping notice to the right order, so tracking reaches the right customer.

PartMash does not use your customers' information for marketing, does not sell it, and does not combine it with any other customer's data.

What we write. Only what you have approved, or have set the Service to do for you: prices, inventory levels and back-order dates for products you choose; and fulfillments with tracking numbers for your orders.

Your customers' privacy requests. When one of your customers asks your Shopify store for their data or for its deletion, Shopify notifies us, and we answer within thirty (30) days as Shopify requires.

Uninstalling or disconnecting. When you uninstall the PartMash app or disconnect your store, we immediately cease all further access and delete the stored tokens. We then delete the data we obtained from your store: reports, the record of changes written to your store, your store's order records, tracking matched to your store's orders, and your store's product identifiers. This happens when Shopify confirms the uninstall (about 48 hours later) or within thirty (30) days of a disconnection, whichever comes first. Reinstalling or reconnecting before then cancels it.

Payments through Shopify. Any charge for the PartMash app in the Shopify App Store is billed by Shopify on your Shopify bill.

7. How We Share Information

We do not sell your information. We share it only as follows:

Service providers, who process data on our behalf under confidentiality and security obligations and may not use it for their own purposes:

• DigitalOcean: hosting (United States);
• Resend: sending account emails, sign-in codes and your tracking emails to your customers, and receiving the vendor emails you forward to your PartMash address. Resend keeps email data, including message content and metadata, for thirty (30) days under its published retention policy;
• AgentMail: our support inbox;
• Dropbox: storage of our encrypted backups (we hold the only key to decrypt them);
• our payment processor, for subscriptions billed directly.

Connected Account providers: we transmit data to Intuit, Shopify, or a supplier system only to perform actions you have approved or set up.

Legal: where required by law, subpoena, or other legal process, or to protect the rights, property, or safety of Company, our customers, or the public.

Business transfer: in connection with a merger, acquisition, financing, or sale of assets, subject to this policy continuing to apply to the transferred information.

8. Data Security, Backups and Change History

We maintain commercially reasonable administrative, technical, and physical safeguards designed to protect information, including encryption at rest of all stored data and of our backups (our database and on-server backups are kept on encrypted storage, and off-site backups are separately encrypted), additional encryption of credentials and tokens, encryption in transit, access controls, two-factor sign-in, and logical separation of each customer's data. We record when our staff view pages that show your customers' personal information.

Backups. Residual copies may persist in encrypted backups until they age out of our backup rotation. Backups are retained no longer than thirty (30) days. Because a backup taken shortly before deletion still contains your data, all copies on our systems, live and backup, are removed within sixty (60) days of deletion. One exception: our off-site backups are encrypted before they leave our server, and our storage provider can keep a deleted copy recoverable for up to one hundred eighty (180) days after we delete it. Those copies cannot be read without a decryption key that is kept neither on our servers nor with the storage provider.

Change history while your account is active. The Service keeps a record of every change it makes to your Connected Accounts (the prior value, the new value, and when) so that changes can be reviewed and reverted. These records are retained for twelve (12) months and then automatically purged, or sooner when the connection they belong to is deleted as described above.

No method of transmission or storage is completely secure. We cannot guarantee absolute security. You are responsible for safeguarding your account credentials and for the acts of your authorized users.

9. Data Retention and Account Closure

We retain Account information for as long as your account is active and thereafter as needed for legal, accounting, and dispute-resolution purposes.

We retain Subscriber Data for as long as needed to provide the Service, and delete it after disconnection as described in Sections 5 and 6.

Closing your account. When you close your account, nobody can sign in and the Service stops all work for it immediately. Nothing is deleted at that moment, so a closure made by mistake can be reversed. We confirm the deletion with you first, then delete your account's data within thirty (30) days of that confirmation, never sooner than thirty (30) days after the closure.

10. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to object to or restrict processing, and to withdraw consent. California residents may have rights under the CCPA/CPRA, including the right to know, delete, correct, and to not be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under California law.

If you are one of our subscribers' customers, please contact the business you bought from; we will help them answer your request.

To exercise any right, contact us using Section 14. We may need to verify your identity before acting.

11. International Transfers

The Service is operated in the United States. If you access it from outside the United States, you understand your information will be processed in the United States, which may have different data protection laws than your jurisdiction.

12. Children

The Service is a business product and is not directed to children. We do not knowingly collect personal information from anyone under 18.

13. Changes to this Policy

We may update this Policy. Material changes will be notified by email or in-product notice before taking effect. The "Last updated" date above reflects the most recent revision.

14. Contact

Horsepower Connections LLC d/b/a The EFI Store

55 S Lake Havasu Ave Unit F-392, Lake Havasu City, AZ 86403

support@partmash.com