Data Processing Addendum

1. Scope and roles

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between ChatAxon (“we”, the processor) and the merchant using ChatAxon on its store (“you”, the controller). It applies whenever we process personal data of your shoppers and website visitors to provide the service, whether you install ChatAxon through WordPress/WooCommerce, Shopify, Instagram or a custom integration. By using ChatAxon you accept this DPA; no separate signature is needed.

2. What we process and why

• Purpose: to answer your shoppers in the chat assistant — product search, order status, store policies, discount codes, add-to-cart — and to show you conversations, leads and analytics in your dashboard. Nothing else.
• Data subjects: visitors and shoppers who use the chat on your store or message your connected Instagram account.
• Personal data: chat messages; email addresses a shopper types into the chat or its forms; order numbers given for order tracking; a pseudonymous chat session identifier; Instagram user ID and username for Instagram conversations; IP address and browser information for security and abuse prevention.
• Order lookups: an email given for order tracking is only compared with the email on the order to confirm the order belongs to the shopper. It is not stored separately.
• No sale, no advertising, no model training: we do not sell personal data, use it for advertising or profiling, or use it to train AI models.

3. Our obligations as processor

• We process personal data only on your documented instructions, which are these Terms, this DPA and your settings in ChatAxon.
• Everyone at ChatAxon with access to personal data is bound by confidentiality, and access is limited to what is needed to operate and support the service.
• We apply the technical and organisational measures in Section 8.
• We help you answer requests from shoppers to access, correct or delete their data. On Shopify, customer and shop redaction requests are carried out automatically through Shopify's privacy webhooks.
• We help you meet your own obligations on security, breach notification and data protection impact assessments, taking into account what information we have.

4. Sub-processors

You authorise us to use the following sub-processors, each bound by data protection terms at least as protective as this DPA:

• Supabase, Inc. — database hosting.
• Hetzner Online GmbH — application servers (Germany).
• OpenAI, L.L.C. — generating assistant replies and search embeddings. API inputs are not used for model training.
• Resend — transactional email.
• Paddle.com Market Ltd — subscription billing (merchant data only).
• Shopify Inc. and Meta Platforms, Inc. — only for merchants who connect those platforms, as the platforms the data comes from and goes back to.

We will give at least 30 days' notice by email before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot address the objection, you may terminate the affected service.

5. International transfers

Where personal data is transferred outside the EEA, UK or Switzerland (for example to OpenAI in the United States), the transfer relies on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism offered by the sub-processor.

6. Personal data breaches

We notify you without undue delay, and no later than 72 hours after becoming aware of a personal data breach affecting your data, with what happened, the data and number of shoppers affected, the likely consequences and the measures taken. Where Shopify merchant or customer data is involved we also notify Shopify within 24 hours. We keep a written incident response policy and review it after every incident.

7. Retention, return and deletion

• Chat transcripts: 12 months. Leads and handoff tickets: 24 months. Analytics events: 24 months. Instagram messages: 90 days. Records of staff and API access to personal data: 12 months. Older records are deleted automatically every day.
• When you uninstall ChatAxon or close your account, we delete your store's personal data within 30 days on request; on Shopify this happens automatically when Shopify sends the shop redaction request after uninstall.

8. Security measures

• Encryption: all traffic over HTTPS/TLS; data encrypted at rest and in backups by our database provider; platform access tokens (Shopify, Instagram) additionally encrypted with AES-256.
• Access control: production credentials held only in server environment variables; database row level security with no public access; every API read is restricted to the caller's own store; staff accounts protected with strong passwords and two-factor authentication.
• Logging: reads of shoppers' personal data through our API are logged (who, what, when, from where).
• Separation: development and testing use separate data from production.
• Resilience: daily encrypted backups with periodic restore tests; signed webhooks (HMAC) from Shopify, Meta and WooCommerce.

9. Audits

On request we provide the information reasonably needed to show compliance with this DPA. Requests: support@chataxon.com.