Data processing agreement

1. How this agreement works

This data processing agreement (the “DPA”) is between you, the business using Strathly (the “Customer”), and HEAVENLYTRADE S.R.L. SEMPLIFICATA, Via Roma 114, 81100 Caserta (CE), Italy, VAT IT04635090618 (“Strathly”). It forms part of our terms of service (the “Terms”) and applies whenever we process personal data on your behalf while providing the Service. It takes effect when you accept the Terms and lasts as long as we process such data.

It is written for the EU General Data Protection Regulation (“GDPR”) and applies in the same way under the UK GDPR and the Swiss Federal Act on Data Protection. Words like controller, processor, personal data and data subject have the meaning the GDPR gives them.

2. Roles

• You are the controller of the personal data of your shoppers and customers and of the content of your store's conversations, including the names and messages of your team members as they appear in them. You decide to offer the chat on your store and what Ivy may do.
• Strathly is your processor. We process that data only to provide the Service to you.
• For the account data of you and your team members (their accounts, sign-in, how they use the app and the iOS app, notifications) and for billing, Strathly is a controller, and the privacy policy applies.

You are responsible for having a legal basis for the processing, for telling your shoppers about it (for example in your store's privacy policy), for asking their consent where your law requires it (for example through your store's cookie banner, which the chat follows), and for the lawfulness of your instructions.

Under the EU AI Act, Strathly is the provider of the chat's AI system and you are its deployer. We designed the chat so shoppers are told they are talking with an AI (“Ivy is an AI assistant.” under the message box, in the shopper's language for English, Italian, Spanish, French and German, and in English otherwise). You must not hide or alter that notice, or present Ivy as a person.

3. Details of the processing

4. Our obligations

We will:

• process the personal data only on your documented instructions: these Terms, this DPA and the settings you choose in the app, including for transfers outside the EEA, unless the law requires otherwise (in which case we tell you first, unless the law forbids it);
• tell you if we believe an instruction breaks data protection law;
• make sure everyone authorized to process the data is bound by confidentiality;
• take the security measures in section 5 and keep them up to date;
• respect the conditions in section 6 for using subprocessors;
• help you, as far as we reasonably can, with data protection impact assessments and consultations with authorities about the Service;
• keep a record of the processing we carry out for you.

5. Security measures

The technical and organizational measures we apply include:

• Encryption in transit: every connection to the app, the chat and the APIs uses HTTPS.
• Encrypted backups, rotated and kept for up to 30 days.
• Hosting in the European Union, in Hetzner data centers certified to ISO/IEC 27001.
• Passwords stored only as one-way hashes; Shopify access tokens encrypted with AES-256-GCM.
• Access by role inside each store (owner, admin, agent), and sessions you can review and end from Settings.
• Each store's data is kept apart from every other store's, and access by our staff is limited to what support and security need.
• Rate limits on sign-in and on the chat's public endpoints, against abuse.
• Ivy shares an order's status only when its number and the email on the order both match; she changes an order only after the shopper proves who they are (signed in to your store, confirmed by Shopify, or with a one-time email code). Order changes wait a few seconds so your team can undo them, and each is recorded.
• Only a hash of each one-time code is stored, and codes expire after minutes.

More on the security page. We may change these measures as long as the overall level of protection does not go down.

6. Subprocessors

You authorize us to use the subprocessors listed on the subprocessors page. Before a new subprocessor starts processing personal data for you, we tell you at least 30 days in advance by email (to account owners and to anyone who subscribed to changes). You can object on reasonable data protection grounds within that time. If we can't address the objection, you may end the affected Service and we refund any prepaid amount for the time after it ends.

We bind each subprocessor by written contract to data protection obligations at least as protective as this DPA, and we remain responsible to you for their work. Today they are Hetzner, OpenAI, Resend, Apple, Cloudflare.

Some companies receive data because of what you ask the Service to do but are not our subprocessors, because they decide for themselves how they use it, under their own terms: Shopify, Google (Maps Platform). Shopify is your own platform, governed by your agreement with Shopify, which also bills you for the Service; Google Maps Platform (Places API) receives from our server only the partial address a shopper types in the address form, the country and the language, never who they are, and uses it under Google's controller terms for Maps.

7. International transfers

We store and run the Service in the European Union (Germany (European Union)). Some subprocessors process data outside the European Economic Area, in the United States: OpenAI, Resend, Apple and Cloudflare (see the subprocessors page for what each one does). Every such transfer is covered by an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework for certified providers) or by the Standard Contractual Clauses adopted by the Commission in 2021 (module three, processor to processor), together with the additional measures they require.

If your business is established outside the European Economic Area, the data we return to you is covered by module four of the same Clauses (processor to controller), which are part of this DPA for that purpose. For data subject to the UK GDPR, the Clauses apply as amended by the UK Addendum issued by the Information Commissioner; for data subject to Swiss law, as adapted for the Swiss Federal Act on Data Protection. Google Maps Platform receives the partial addresses typed in the address form as an independent company (section 6), in the United States, under the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.

8. Personal data breaches

If we become aware of a breach of security that affects personal data we process for you, we notify you without undue delay and in any case within 48 hours. We tell you what happened, what data and how many people are likely affected, what we are doing about it, and who you can talk to, and we keep you updated as we learn more, so you can meet your own obligations to notify authorities and the people affected.

9. Helping you answer requests

Shoppers and others can ask to access, correct, delete or receive their data. The app lets your team see every conversation and a shopper's details; when Shopify sends us a customer's erasure request for your store, we delete that shopper's conversations and details, the orders tied to them and their words quoted in unanswered questions automatically. When Shopify sends us a customer's request for their data, your owner and admins are alerted in the app and by email at once, and so is our support; they can download a file with everything we hold about that customer (details, cached Shopify record, conversations with notes and summaries, orders tied to them, codes sent), so you can answer within 30 days. For anything the app does not do yourself, write to us and we help you within the time the law gives you. If a request reaches us directly, we pass it on to you and do not answer it ourselves unless you ask us to.

10. Deletion at the end

When you uninstall Strathly in Shopify, Shopify asks us 48 hours later to erase your store's data, and we delete the store and all of its data. When you delete your account, the stores you own alone are deleted with it. If you want a copy of your data before that, ask us and we send it in a common machine-readable format. Deleted data leaves our database at once and our encrypted backups within 30 days, as they are replaced; we keep nothing after that unless the law requires us to. Before then, each conversation is deleted on its own 24 months after its last message. The only record that outlives a store is ours, not yours: its Shopify domain, trial dates and balance of extra conversations, so the same shop gets one free trial and keeps its extra conversations (no shopper data, names or conversations).

11. Audits

We make available to you the information needed to show that we meet this DPA, and we answer reasonable security and privacy questionnaires. If that is not enough, you (or an independent auditor bound by confidentiality) may audit us once a year, with at least 30 days' written notice, during business hours, in a way that does not disrupt the Service or expose other customers' data, and at your own cost. Audits required by an authority are always possible. For our subprocessors we rely on their certifications and audit reports.

12. Liability and precedence

Each side's liability under this DPA is subject to the limits in the Terms, as far as the law allows. If this DPA and the Terms conflict on data protection, this DPA prevails; if the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail. This DPA is governed by the same law as the Terms, the laws of Italy, and disputes go to the same courts: the courts of Caserta, Italy (Foro di Caserta).

13. U.S. state privacy laws

Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), or a similar U.S. state law applies, Strathly is your service provider (or processor) for the personal information we process for you. We do not sell or share it (as the CCPA defines those words); we do not retain, use or disclose it for any purpose other than the business purpose of providing the Service to you, or outside our direct business relationship with you; we do not combine it with personal information we receive from others or collect ourselves, except as the CCPA allows; and we comply with the CCPA's obligations and give it the same level of protection the CCPA requires. We tell you if we can no longer meet these obligations, and you may take reasonable steps to stop and remedy unauthorized use.

14. Get a signed copy

You don't need to sign anything: this DPA applies to every store as part of the Terms. If your company needs a countersigned copy for its records, we send one.