Data Processing Agreement
This agreement forms part of the Terms of Service between the merchant who installs the App (the “Controller”) and 7K Ritual Unipessoal Lda, Rua Eça de Queiroz 8, 2.º Esq., 2790-059 Carnaxide, Portugal, NIPC 518310248 (the “Processor”). It applies to the personal data the Processor handles on the Controller’s behalf, as Article 28 of the EU General Data Protection Regulation (GDPR) requires.
1. Roles
The Controller decides why and how its shoppers’ personal data is processed. The Processor processes it only to provide the App, on the Controller’s documented instructions, which are these terms and the Controller’s use of the App’s settings.
2. What is processed, and why
| Data | Purpose | Kept |
|---|---|---|
| Messages shoppers type to the advisor, which may contain personal data they choose to share | Generating the advisor’s replies | Not stored by the Processor. Sent to the AI provider to produce each reply. |
| Shopper IP address | Security: rate limiting and preventing abuse | Held briefly in server memory to limit requests per minute, never written to the database; stored only as a one-way keyed hash, for up to 1 hour |
| Order data: creation date, cancellation and payment status, the advisor’s cart marker, and order totals. No names, emails, phone numbers or addresses. | Counting the sales that started in the advisor, for the merchant’s report and for billing | Read at collection time; only monthly totals per store are kept (order count and amounts), which contain no personal data |
| Buyer details (name, email, delivery address), only where the store uses the App’s optional checkout protocol | Completing that checkout | Up to 24 hours |
Data subjects: visitors to the Controller’s store who use the advisor, and customers whose orders started in it. The advisor sets no cookies and stores nothing on shoppers’ devices. Personal data is never sold, and never used for advertising or to train AI models.
3. The Processor’s obligations
- Process personal data only on the Controller’s instructions, and tell the Controller if it believes an instruction breaks data protection law.
- Ensure that anyone authorised to process it is bound by confidentiality.
- Apply the security measures in section 6.
- Use sub-processors only as set out in section 4.
- Help the Controller respond to shoppers exercising their rights, and with security, impact assessments and prior consultations, as far as the Processor’s processing allows. Shopify’s data request and erasure requests are answered automatically: the Processor holds no personal data linked to an identified customer.
- Notify the Controller without undue delay, and within 48 hours, of becoming aware of a personal data breach affecting its data.
- Delete the Controller’s data when the App is uninstalled, as set out in section 5.
- Provide the information needed to demonstrate compliance with this agreement, and allow audits on reasonable notice, at the Controller’s cost.
4. Sub-processors
The Controller authorises these sub-processors. The Processor binds each to data protection obligations equivalent to these, and will give at least 30 days’ notice of a new one, during which the Controller may object by uninstalling the App.
| Sub-processor | Role | Location |
|---|---|---|
| Anthropic, PBC | AI model that generates the advisor’s replies | USA |
| Vercel Inc. | Application hosting | EU: Paris, France |
| Upstash, Inc. | Database | EU: Paris, France |
The App and its database run in the EU (Paris). Personal data leaves the European Economic Area only to reach the AI provider in the USA, and any such transfer relies on the EU–US Data Privacy Framework where the sub-processor is certified, and otherwise on the European Commission’s Standard Contractual Clauses.
Shopify, which runs the Controller’s store and the App’s billing, processes data under the Controller’s own agreement with Shopify.
5. Retention and deletion
Data is kept only as long as section 2 states. When the App is uninstalled, the Processor deletes the store’s access to Shopify (its access and refresh tokens) immediately, and the store’s settings within 48 hours of Shopify’s erasure request. Monthly sales totals are kept as billing records; they contain no personal data.
6. Security measures
- All data in transit is encrypted (HTTPS/TLS).
- Store records, including access to the Controller’s Shopify store, are encrypted at rest with AES-256-GCM, with the key held separately from the database.
- Every request from Shopify (webhooks, installs, the admin) is verified by its cryptographic signature before anything is done.
- The App requests only the Shopify permissions it needs, and reads no customer contact details.
- IP addresses are never written to the database except as a keyed hash, and only briefly; data about shoppers expires automatically.
- Access to cross-store information is restricted to the Processor and protected by a secret.
7. Duration and liability
This agreement lasts as long as the App processes the Controller’s data. Liability under it is subject to the limits in the Terms of Service, except where the law does not allow them.