Data Processing Addendum

This Addendum forms part of the Terms of Service between ShopMeta and the Customer. It applies whenever ShopMeta processes personal data on the Customer's behalf.

1. Definitions

• Customer Personal Data means personal data within Customer Data that ShopMeta processes on the Customer's behalf.
• Data Protection Laws means the United States federal and state privacy laws that apply to that processing, such as the California Consumer Privacy Act (CCPA).
• Subprocessor means a third party ShopMeta engages to process Customer Personal Data.
• "Business", "service provider", "sell" and "share" have the meanings given in the CCPA. "Controller" and "processor" have the meanings given in the other state privacy laws that use those terms. A "personal data breach" is a breach of security that leads to the accidental or unlawful destruction, loss or alteration of Customer Personal Data, or to unauthorized disclosure of or access to it.

2. Roles

• The Customer is the business (or controller) of Customer Personal Data, or acts as a service provider for its own clients. ShopMeta is the Customer's service provider (or processor).
• ShopMeta acts on its own account only for the account information described in its Privacy Policy.

3. The Customer's instructions

• Processing on instructions only. ShopMeta processes Customer Personal Data only on the Customer's documented instructions. The Terms, this Addendum and the Customer's use and configuration of the service are those instructions. Connecting a source, asking a question, setting who has access, scheduling a report and connecting an AI tool are each an instruction.
• Quality and improvement. The Customer instructs ShopMeta to monitor the quality of the service and to improve it for the Customer. For that purpose authorized ShopMeta staff may review the Customer's questions, answers and feedback. What ShopMeta learns this way is applied to the Customer's own organization. ShopMeta does not use Customer Personal Data to improve the service for anyone else, or to train general-purpose AI models.
• Unlawful instructions. ShopMeta will tell the Customer if it believes an instruction breaks Data Protection Laws. This is not legal advice.
• Limits on use. ShopMeta will not sell or share Customer Personal Data. It will not keep, use or disclose it for any purpose other than providing the service as this section describes, or outside its direct business relationship with the Customer. It will not combine it with personal data from another source, except as the law allows a service provider to do.
• The Customer's part. The Customer is responsible for the lawfulness of its instructions, for the notices and consents its own customers are owed, and for not sending the categories of data the Terms prohibit.

4. People who handle the data

ShopMeta limits access to Customer Personal Data to the people who need it to provide and support the service, and binds them to confidentiality.

5. Security

ShopMeta maintains the technical and organizational measures in Annex II. It may update them, provided the level of protection is not reduced. The Customer is responsible for how it configures the service, including who it gives access to and the logins it supplies for its sources.

6. Subprocessors

• General authorization. The Customer authorizes ShopMeta to use Subprocessors. The current list is Annex III.
• Same obligations. ShopMeta binds each Subprocessor by contract to data-protection obligations no less protective than this Addendum, and remains responsible for what they do.
• Notice of changes. ShopMeta will give at least 30 days' notice, by email to the Customer's owners, before adding or replacing a Subprocessor.
• Objection. The Customer may object on reasonable data-protection grounds within 15 days of the notice. If the parties cannot resolve the objection, the Customer may end the affected service and receive a refund of prepaid fees for the unused period.
• Who is not a Subprocessor. Providers the Customer chooses itself are not ShopMeta's Subprocessors. These are the Customer's own AI model account, AI tools its people connect, the services it connects, and the channels it sends reports to.

7. Requests from individuals

• Forwarding. If an individual contacts ShopMeta about their personal data, ShopMeta will pass the request to the Customer promptly and will not answer it, except to say that it has done so.
• Assistance. ShopMeta will give the Customer reasonable help in responding. The underlying records stay in the Customer's own sources, so corrections and deletions are made there.
• Assessments. ShopMeta will give reasonable help with the data protection assessments the law requires of the Customer, where they concern the service.

8. Security incidents

• Notice. ShopMeta will notify the Customer without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
• What the notice says. What happened, the kinds of data and approximate number of people affected, the likely consequences, and what ShopMeta has done and proposes to do. Where not everything is known at once, ShopMeta will follow up as it learns more.
• Response. ShopMeta will take reasonable steps to contain and remedy the breach. A notice is not an admission of fault.
• Who tells whom. The Customer decides whether to notify regulators and individuals. ShopMeta will help.

9. Return and deletion

• During the agreement. The Customer can delete chats, files, dashboards, automations and connections in the service at any time.
• At the end. For 30 days after the agreement ends, ShopMeta will on request give the Customer a copy of the Customer Data stored in the service, in a common format.
• Deletion. ShopMeta will then delete Customer Data within 30 days, and from backups within 90 days, unless the law requires it to be kept. Saved credentials are deleted when a connection is removed or the account is closed.
• Source data. Data in the Customer's own systems is unaffected.

10. Audits

• Information first. On request, no more than once a year, ShopMeta will give the Customer the information reasonably needed to show that it complies with this Addendum: a description of its security measures, answers to a reasonable questionnaire, and independent audit reports once ShopMeta has them.
• Audit. If that is not enough and Data Protection Laws require it, the Customer may audit on 30 days' notice, during business hours, under confidentiality, at its own cost, and without access to any other customer's data.

11. Where data is processed

• Where processing happens. ShopMeta stores Customer Personal Data in the United States and processes it there. The one exception is named in Annex III: the AI model provider may process a request in another region.
• European data. The service is offered to businesses in the United States. This Addendum does not include the European Standard Contractual Clauses or their United Kingdom and Swiss equivalents. If the Customer needs them because its data includes personal data protected by those laws, the parties will add them at the Customer's request.
• Government requests. If a public authority demands Customer Personal Data, ShopMeta will challenge the demand where it has grounds to, disclose only what is required, and tell the Customer unless the law forbids it.

12. Liability and order of documents

Each party's liability under this Addendum is subject to the limits in the Terms. [Decision for your lawyer: a separate, higher cap for data-protection breaches.] Where this Addendum and the Terms differ about personal data, this Addendum applies.

Annex I: Details of the processing

Annex II: Security measures

In place today

• Encryption in transit. All connections to the service use TLS. Connections from the service to a Customer's source require TLS.
• Encryption of credentials. Saved credentials for connected sources are encrypted with AES-256-GCM, using a key held outside the application database. Passwords are stored only as salted hashes.
• Separation between customers. Every record belongs to one organization, and every request is limited to the organization of the person making it. Automated tests cover attempts to reach another organization's data.
• Access control. Roles (owner, admin, member, billing) and groups decide who may use each connection and each store. They are checked on every request, including requests from connected AI tools, which sign in as a person and inherit that person's access.
• Read-only access to sources. The service only reads warehouses and databases. Custom queries pass a guard that refuses anything other than a single read, and results are limited in size and time.
• Outbound protection. The service refuses to connect to private or internal network addresses.
• Network. Servers sit behind a firewall that admits only web traffic and administrative access by key. Password sign-in to servers is disabled, and the administration panel is not reachable on its own port.
• Throttling. Repeated sign-in attempts are limited per visitor, and requests from AI tools are limited per person and per organization.
• Two-step sign-in. Every person signs in to the service with a second step: a code from an authenticator app, or a passkey. A password alone opens nothing. Repeated wrong codes lock the second step for a time, and a session that appears far from where it was last used is asked for the second step again.
• Logging. Changes to a team and its access are logged. Requests from connected AI tools are logged for 180 days.
• Updates and testing. Servers install security updates automatically. Changes to the software run through automated tests before release.
• Encryption at rest. The application database is kept on a volume that is encrypted at rest.
• Backups. The application database is backed up every day to storage that is encrypted at rest. Backups are kept for 90 days, and restoring from one has been tested.
• Monitoring. A check that runs outside the servers tests the service every minute, and the service checks itself as often. ShopMeta's operators are alerted when it stops answering, when a backup fails and when a release fails to build.

To be put in place before this Addendum is published

• [A written procedure for responding to a security incident, with named people and contact details.]
• [Two-step sign-in for every person with access to production systems, and a list of who they are.]

Annex III: Subprocessors