Data Processing Addendum

You are the controller and we are the processor of the personal data described in Annex 1. Each party complies with the Data Protection Laws that apply to it.

We process personal data only on your documented instructions, which are these Terms, this DPA and your use and configuration of the App, unless required to do otherwise by law (in which case we will inform you unless the law prohibits it). We will tell you if we believe an instruction infringes Data Protection Laws.

Anyone we authorize to process personal data is bound by confidentiality obligations.

We implement the technical and organizational measures described in Annex 2, appropriate to the risk of the processing.

You authorize us to use the sub-processors listed in Annex 3. We impose data protection obligations on each sub-processor that are no less protective than this DPA, and remain responsible for them. We will announce new sub-processors on this page and by email or in the App at least 14 days before they start processing your data. You may object on reasonable data protection grounds; if we cannot address the objection, you may stop using the App and uninstall it.

We are located in Japan, which the European Commission has recognized as providing an adequate level of protection. Where personal data is transferred to a sub-processor in a country without an adequacy decision, the transfer is covered by the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) or another lawful transfer mechanism.

Taking into account the nature of the processing, we help you respond to requests from data subjects and meet your obligations on security, breach notification, data protection impact assessments and prior consultation. Requests that Shopify forwards to the App (customer data requests and redaction requests) are handled automatically as described in our Privacy Policy.

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information reasonably available to help you meet your notification obligations.

When you uninstall the App, we stop processing and delete your personal data after Shopify’s shop redaction request (sent 48 hours after uninstalling), except where the law requires us to keep it. Retention during use is described in Annex 1.

On request, we will provide the information reasonably necessary to demonstrate compliance with this DPA. If that information is not sufficient, you may audit our compliance once a year with at least 30 days’ notice, at your own cost, in a way that does not disrupt our business or compromise other customers’ data.

If this DPA conflicts with the Terms of Service, this DPA prevails with respect to the processing of personal data.

• Subject matter and nature: providing the AltraAIO app to the Controller.
• Purpose: generating and writing image alt text, SEO meta titles and descriptions and their translations, rollback, catalog summaries (llms.txt), billing and service emails.
• Types of personal data: the store contact email address and store name (which may identify a person, for example a sole trader), and any personal data that you include in product information such as product descriptions or images. The App does not process customer or order data.
• Categories of data subjects: the merchant’s staff and owners, and any individuals who appear in product information.
• Special categories of data: none.
• Duration and retention: for as long as the App is installed; deleted after Shopify’s shop redaction request. Request logs at our hosting provider are deleted within a few days.

• Encryption in transit (TLS) for all traffic; encryption at rest by our hosting provider.
• Shopify access tokens are additionally encrypted with AES-256-GCM; encryption keys are stored as secrets, separate from the data.
• Requests from Shopify (webhooks, app proxy) are verified with Shopify’s signatures; the app runs only inside the authenticated Shopify admin.
• Data minimization: the App requests only the API permissions it needs and does not request customer names, emails, phone numbers or addresses.
• Data of each store is separated by store identifier in every database query.
• Access to production systems is limited to the operator and protected with multi-factor authentication.
• Automatic deletion according to the retention periods in Annex 1, and deletion of all store data on Shopify’s shop redaction request.
• Error monitoring and logging configured to avoid collecting personal data where possible.