Data Processing Agreement

This Data Processing Agreement ("DPA") applies where Cipzo processes personal data on your behalf as a processor.

Roles

You are the data controller of your store and customer data. Cipzo is a processor acting on your documented instructions (your use of the service).

Scope of processing

Cipzo processes the commerce data you authorize via Shopify to provide analytics, recommendations, and AI features. Processing lasts for the duration of your subscription plus the 30-day retention window.

Security measures

Row-level security on every shop-scoped table, encryption in transit (TLS 1.3) and at rest, audit logging of privileged actions, and a strict customer-PII denylist. See the security page.

Sub-processors

We use the sub-processors listed in our privacy policy. We will give notice of material changes.

Data subject requests

We will assist you in responding to data subject requests as required by applicable law.

Deletion

On termination, your data is deleted after the 30-day retention window, or sooner on request, except where retention is legally required.

Contact

To execute a signed DPA, contact hello@cipzo.com.