Terms of Service

1. Scope and contract documents

Your agreement with us consists of the following documents. Where they conflict, the document listed earlier prevails for the subject it governs:

• these Terms;
• Annex 1 (Data Processing Addendum), which applies automatically and requires no separate signature;
• the plan and price you selected at checkout, as confirmed by Stripe and shown in your dashboard;
• our Privacy Policy, for the processing we carry out as controller.

Your own purchase terms, vendor conditions or supplier portal terms do not apply, even if we do not expressly object to them.

We may issue a new version of these Terms as described in section 21.

2. Definitions

• "Merchant", "you" means the business that registers for or uses the Service.
• "Shopper" means an end user who interacts with your Storefront. Shoppers are your customers, not ours.
• "Storefront" means the hosted AI shopping chat we serve for you, on a hostname you configure and control.
• "Assistant" means the AI shopping assistant that answers Shoppers on your Storefront, configured by you in the dashboard.
• "Catalog Data" means the product and store information you or your systems transmit to us, including product records, descriptions, prices, availability, images, policy texts and FAQ entries.
• "Conversation Data" means Shopper messages, Assistant replies, related analytics events, and any conversation snapshot created through the sharing feature.
• "Merchant Content" means Catalog Data, Conversation Data and any other content you, your systems or your Shoppers submit through the Service.
• "Integration" means a connection between the Service and a store or data source, such as a WooCommerce store, a Shopify store or a product feed.
• "Interaction" means one Shopper message processed by the Assistant. Interactions are counted per calendar month against your plan.
• "Subscription" means the paid plan you select, billed through Stripe.

3. The Service

The Service is a multi-tenant software-as-a-service platform. In summary: we receive your Catalog Data, convert it into a searchable index, and serve an AI shopping assistant that helps your Shoppers find products. Subject to your plan, the Service includes:

• a hosted AI shopping Storefront served on a hostname you configure, including domain verification and managed TLS certificates through our infrastructure provider;
• a dashboard for configuring the Assistant, including its appearance, persona, product presentation and store information;
• an inbox in which you can review, triage and delete Shopper conversations;
• analytics on conversations, search queries, product impressions and Shopper actions;
• collections, which let you curate the subset of your catalog the Assistant may recommend;
• catalog ingestion through our WordPress plugin for WooCommerce, our Shopify application, product feed retrieval and file import;
• a sharing feature that allows a Shopper to create an unlisted, read-only link to their own conversation.

An embeddable chat script remains available for historical reasons. It is maintained on a best-efforts basis, is not part of our roadmap, and may be withdrawn on reasonable notice.

What the Service is not

This allocation matters, so we state it explicitly. We are a software provider only. We are not:

• a payment service provider, payment institution, acquirer or bank. No Shopper payment is processed by us or passes through our systems at any point;
• the merchant of record, seller or supplier for anything sold to your Shoppers;
• a marketplace, reseller or distributor of your products;
• an order management system. We do not create, modify, cancel or fulfil orders in your store;
• affiliated with, endorsed by or acting on behalf of WooCommerce, Automattic, WordPress, Shopify, Google, OpenAI or any other third party we integrate with.

We develop the Service continuously and may add, change or discontinue features. We will not materially degrade the core functionality of your paid plan during a paid period without reasonable notice and, where a change is materially adverse to you, the termination right in section 21.

4. Account, eligibility and business use

To register you must be at least 18 years old, have full legal capacity, and be authorised to enter into this agreement for the Merchant.

You must provide accurate registration and billing information and keep it current. We rely on the billing contact on file to reach you about payment problems and material changes.

You are responsible for all activity under your account, for keeping credentials and API keys confidential, and for the acts and omissions of your personnel and contractors. Notify us without undue delay at the address in section 25 if you suspect unauthorised access.

The Service is not offered to consumers. If you are acting as a consumer, do not subscribe. Nothing in these Terms limits statutory rights that apply to you notwithstanding this restriction.

5. Plans and limits

The Service is offered in tiered plans. Your plan determines quantitative limits, which currently comprise the number of connected domains, the number of Assistants, the number of products you may promote into collections, the number of collections, and the number of Interactions per calendar month. The limits for each plan are shown on our pricing page and in your dashboard.

How limits behave

Limits are enforced in the product rather than billed as overage. When a limit is reached the affected action is refused with an explanation and an upgrade path. We do not invoice excess usage, and we do not silently exceed your plan on your behalf.

When your monthly Interaction limit is reached, the Assistant stops answering Shoppers on your Storefront until the next monthly period begins or you upgrade. Shoppers see a neutral message that does not disclose your billing status. Please account for this when choosing a tier.

Interactions are counted per calendar month for the whole account, including on annual plans, and reset at the start of each period. Product limits are counted as distinct products promoted into collections across your account.

We may adjust plan limits for future periods. Where we reduce a limit in a way that is materially adverse to you, section 21 applies.

6. Fees, billing, taxes and trial

Billing runs through Stripe

Subscriptions are purchased and managed on checkout and customer portal pages hosted by Stripe. Card details are entered on Stripe pages and are never transmitted to or stored by us; we receive subscription status only. You authorise Stripe to charge your payment method for the recurring fee.

Fees are stated at checkout in the currency shown there and are charged in advance for each billing period. Subscriptions renew automatically for successive periods until cancelled as described in section 7.

Free trial

Where offered, a free trial lasts seven days. A valid payment method is required to start a trial, and no charge is made before the trial ends. A trial is available once per account: it is not available on upgrades, downgrades, or a new Subscription after a previous cancellation.

During the trial, structural limits follow the plan you selected, but Interactions are capped at a lower trial allowance shown in your dashboard. Unless you cancel before the trial ends, the Subscription converts automatically to the paid plan and the first charge is made.

Fees are exclusive of VAT and other applicable taxes, which are calculated and added at checkout. You may enter a VAT identification number during checkout where applicable. You are responsible for all taxes arising from your use of the Service, other than taxes on our income.

Invoices are issued through Stripe and can be downloaded at any time in the customer portal, which is linked from your dashboard.

We may change prices for future billing periods. We will give you at least 30 days notice before a change applies to your Subscription, and you may cancel before it takes effect.

Refunds

Fees for a period that has already begun are non-refundable, and cancelling does not entitle you to a refund of the current period. We may grant a refund voluntarily on a case-by-case basis; doing so once creates no entitlement. This does not affect mandatory statutory rights or the refunds we commit to in sections 20 and 21.

7. Payment problems, plan changes and cancellation

Failed payment and grace period

If a renewal payment fails, the Subscription is marked past due and we continue to honour your plan for a grace period of seven days from the end of the paid period, so that you can update your payment method. Your dashboard shows a billing warning during that window.

If payment is not recovered within the grace period, or the Subscription ends for another reason, the Service is restricted: the Assistant stops answering Shoppers on your Storefront, catalog synchronisation is refused, and no new Assistants, domains or collections can be created. Your configuration and data are not deleted at that point and remain subject to section 14.

Upgrades take effect promptly and raise your limits immediately. Downgrades take effect at the end of the current paid period. Before a downgrade applies, bring your usage within the limits of the lower plan; resources exceeding the target plan may become read-only.

You may cancel at any time in the Stripe customer portal, reachable from your dashboard. Cancellation takes effect at the end of the current paid period and stops further renewals. A new Subscription after cancellation does not include a further free trial.

We may suspend the Service or an individual Storefront with immediate effect where required by law, where there is a credible security or fraud risk, where your use threatens the integrity or availability of the Service for others, or on a material breach of section 12. We will notify you and, where the cause is curable, restore access once it is cured.

8. Integrations and your systems

The Service connects to systems you control. You are responsible for those systems, for the credentials and access tokens you grant us, and for the lawfulness and accuracy of the data you send.

• For WooCommerce you install our WordPress plugin in your own store. We grant you a non-exclusive, revocable, non-transferable licence to install and use the plugin solely to use the Service for the term of your Subscription. Keep the plugin reasonably current; we support recent versions.
• For Shopify you install our application and grant it the access scopes it requests. Billing for the Service runs through your AgenticCart Subscription and not through Shopify billing.
• For product feeds and file imports you supply a feed location or file and are responsible for its availability, format and content.

We are not responsible for third-party platforms, plugins, hosting or services you use, for their availability, or for changes they make. If a third party changes or withdraws an interface we rely on, we may adapt or discontinue the affected Integration on reasonable notice.

Securing your own store, hosting, administrative accounts and server environment remains your responsibility.

9. Commerce actions and Shopper transactions

How a commerce action works

Where you enable it, a Shopper can trigger an action such as adding a product to a cart or proceeding to checkout from within the Storefront. Technically, the Shopper's own browser submits a request to your store's domain; your store then executes the action in the Shopper's session and, for checkout, takes the Shopper to your own checkout. No part of the transaction is executed on our systems.

These actions are currently available for WooCommerce Integrations only, are opt-in, and are switched off by default. For other Integrations, cart and wishlist functions in the Storefront are held locally in the Shopper's browser and create no state in your store or ours.

You are the seller

All contracts for products are concluded solely between you and the Shopper. You are exclusively responsible for prices and their presentation, product information and safety, pre-contractual and consumer information, withdrawal and returns handling, delivery, warranty and after-sales support, invoicing, and VAT and other taxes.

The Assistant presents information derived from the Catalog Data you supply. If that data is incomplete, stale or wrong, the Storefront reflects it. Keeping prices, availability and product information accurate and synchronised is your responsibility.

10. The AI Assistant

How the Assistant works

The Assistant combines search over your own catalog with a large language model operated by a third-party provider. We currently use OpenAI as our model and embedding provider. We may change or add providers; where a change affects the processing of personal data, Annex 1 governs it and our published subprocessor list is updated.

What is transmitted to the model provider

To generate a reply we transmit to the model provider: the Shopper's current message, a limited window of recent messages from the same conversation, the product records relevant to the request including their descriptions and prices, and the store information and FAQ entries you configured. Shopper messages are additionally sent to the provider's embedding endpoint in order to run the product search.

No training on your data

We do not use Merchant Content, Catalog Data or Conversation Data to train, fine-tune or otherwise improve any machine learning model, whether ours or a third party's, and we contract with our model provider on terms that exclude such use. Any offering described as custom model training would require a separate written agreement and is not part of the Service under these Terms.

The Assistant can be wrong

Language models produce probabilistic output. The Assistant may state something inaccurate, incomplete or unsuitable, may misinterpret a request, and may not reflect the most recent state of your catalog. It is a discovery and sales aid, not a source of binding statements. Information a Shopper relies on for a purchase decision must be verifiable in your own store, and we recommend that you say so in your own terms.

Mandatory AI disclosure

The Storefront informs Shoppers that they are interacting with an AI system, from the start of the first interaction and in the Shopper's language. This notice is a mandatory component of the Service. You may not remove, obscure or disable it, and you may not present the Assistant as a human being or give it a persona that implies human interaction.

Roles under AI rules

For the purposes of Regulation (EU) 2024/1689 (the AI Act) we act as the provider of the AI system and you act as its deployer. We are responsible for the transparency obligations attaching to the system as provided. You are responsible for how you configure and use it, including the persona and instructions you set, the store information you supply, and obligations arising from your own use.

Uses the Assistant is not built for

The Assistant must not be configured or used to give medical, legal, financial, insurance or other regulated advice, to make or support decisions about individuals that produce legal effects or similarly significant effects for them, to infer emotions, or to process special categories of personal data. It is intended for product discovery and shopping support.

11. Merchant Content and rights granted to us

Merchant Content remains yours. Nothing in these Terms transfers ownership of it to us.

You grant us a non-exclusive, worldwide, royalty-free licence, for the term of your Subscription, to host, store, copy, transmit, normalise, index, create vector embeddings from, display and otherwise process Merchant Content, in each case only as necessary to provide, secure and support the Service for you. Where Merchant Content contains personal data, Annex 1 applies in addition.

You warrant that you hold the rights necessary to grant this licence, that Merchant Content does not infringe third-party rights, and that transmitting it to us and having us process it breaches no obligation you owe to a third party.

We may compile aggregated, de-identified statistics about use of the Service in order to operate, secure and improve it. Such statistics identify neither you, your Shoppers nor your catalog, and we will not publish them in a form that permits identification.

12. Acceptable use

You must not, and must not permit any third party to:

• use the Service unlawfully, or in breach of consumer protection, advertising, product safety, competition, sanctions or data protection law;
• upload content that is unlawful, infringing, deceptive or misleading, including inaccurate prices or availability;
• submit special categories of personal data, payment card data, or the personal data of children;
• probe, scan, attack, overload or attempt to gain unauthorised access to the Service or to another tenant's data;
• circumvent plan limits, rate limits, authentication, tenant separation or billing;
• attempt to make the Assistant ignore its instructions or safety behaviour, including through prompt injection embedded in catalog or store content, or use the Service to attack a third party's AI system;
• scrape, harvest or bulk-extract the Storefront, its responses, or another merchant's catalog, or use automated means to generate Interactions other than for reasonable testing of your own Storefront;
• use output of the Service to develop, train or improve a competing product or machine learning model, or to benchmark the Service for publication without our prior written consent;
• resell, sublicense or make the Service available to third parties as a service of your own, unless we agree in writing;
• copy, modify, decompile or reverse-engineer the Service, except where such a restriction is unenforceable under applicable law.

We may throttle, restrict or suspend use that breaches this section, as described in section 7.

13. Availability, maintenance and support

We aim for high availability and operate the Service with reasonable care, but we do not guarantee uninterrupted or error-free operation, and no service level agreement applies unless separately agreed with you in writing.

We may perform maintenance, deploy changes and carry out urgent work at any time. Disruptive maintenance is scheduled outside peak hours where practicable; emergency work may occur without notice.

Support is provided in the scope described for your plan, by email to the address in section 25. Support tier names describe priority relative to other plans; they are not guaranteed response or resolution times. We aim to reply to support requests within one business day.

Where a component runs in your environment, such as our WordPress plugin, updates may be necessary for continued operation, and we may cease to support outdated versions.

14. Data protection

Roles

For Catalog Data and Conversation Data we act as processor and you act as controller: they are processed on your behalf, on your instructions, for your purposes. For our own account, billing, security and marketing data we act as controller, as described in our Privacy Policy. Annex 1 sets out our processor obligations and forms part of these Terms.

Shoppers are your data subjects. Providing the information required by Articles 13 and 14 GDPR to your Shoppers, and having a lawful basis for the processing, is your responsibility. The Storefront can display links to your own privacy policy and terms; we deliberately do not substitute ours for yours, because the Storefront runs under your brand.

Retention

We apply the following maximum retention periods to Shopper data, which we may shorten but will not silently extend: Shopper conversations and their messages are deleted 365 days after the conversation was last active; analytics events are deleted after 30 days on entry-level and inactive plans and after 365 days on higher plans, consistent with the retention stated on our pricing page; conversation share snapshots are deleted 90 days after creation. Short-lived processing caches are held for no more than one hour.

Data subject requests

You can delete an individual Shopper conversation from your inbox at any time, which removes its messages, any share snapshot and the associated analytics events. We will assist you with data subject requests as set out in Annex 1. Requests that Shoppers address to us directly are referred to you as controller.

We do not store Shopper IP addresses or user agent strings in connection with Storefront conversations. Where an IP address is needed transiently for abuse prevention, it is used for that purpose only and is not written to our conversation records.

15. Confidentiality

Each party may receive information of the other that is marked confidential or that a reasonable business person would treat as confidential. The receiving party will use it only to perform this agreement, protect it with at least the care it applies to its own confidential information, and disclose it only to personnel, professional advisers and subprocessors who need it and are bound by confidentiality obligations.

These obligations do not apply to information that is or becomes public without breach, was lawfully known before disclosure, is independently developed, or must be disclosed by law or by a competent authority. Where disclosure is compelled, the receiving party will notify the other in advance where lawful.

16. Intellectual property

The Service, including its software, prompts, interfaces, documentation and trade marks, and all improvements to it, belongs to us or our licensors. These Terms grant a right to use the Service during your Subscription and nothing more; no rights are granted by implication.

If you send us feedback, ideas or suggestions, we may use them without restriction and without owing compensation. We will not identify you as their source without your consent.

You may state factually that you use AgenticCart. Use of our name or logo in marketing beyond that requires our prior written consent.

17. Warranties and disclaimers

Each party warrants that it has the authority to enter into this agreement.

Except as expressly stated in these Terms, and to the fullest extent permitted by law, the Service is provided "as is" and "as available". We disclaim all other warranties, whether express, implied or statutory, including fitness for a particular purpose, merchantability, non-infringement, and any warranty that the Service will be uninterrupted, error-free, or will produce any particular commercial result.

In particular, we do not warrant that Assistant output is accurate, complete, current or suitable, that recommendations will be commercially effective, or that the Assistant will always reflect your latest prices and availability. Section 10 applies.

Nothing in this section excludes liability or warranties that cannot lawfully be excluded.

18. Limitation of liability

To the fullest extent permitted by law, neither party is liable for indirect or consequential loss, or for loss of profit, revenue, goodwill, anticipated savings or data, however caused. For clarity, and without limiting the foregoing, we are not liable for lost sales or reputational harm arising from inaccurate, unsuitable or absent Assistant responses, from gaps or delays in catalog synchronisation, from unavailability of the Storefront, from configuration applied by you or your personnel, or from acts and omissions of the third-party platforms and providers described in section 8.

Our total aggregate liability arising out of or in connection with this agreement is limited to the fees you paid for the Service in the twelve months preceding the event giving rise to the claim.

These exclusions and this cap do not apply to liability for death or personal injury caused by negligence, for intent or gross negligence, for fraud, or to any other liability that cannot be limited under applicable law. Statutory liability under data protection law is neither extended nor limited beyond what the law permits.

You acknowledge that the fees reflect this allocation of risk, and that you remain responsible for operational safeguards appropriate to your business, including reviewing what the Assistant tells your Shoppers and keeping your catalog accurate.

19. Indemnification

You will defend and indemnify us against third-party claims, and against fines and reasonably incurred costs, arising from:

• Merchant Content, your products or services, or your advertising and pricing;
• your breach of these Terms, in particular section 12;
• your unlawful use of the Service, including breaches of consumer protection, product safety or data protection law;
• disputes with your Shoppers, including claims about orders, delivery, returns or refunds;
• claims by a platform, provider or authority arising from your configuration of the Service or your use of an Integration.

We will notify you of a claim without undue delay, allow you to control the defence of claims that can lawfully be settled by payment, and cooperate reasonably at your expense. You may not settle in a way that imposes an obligation on us without our consent.

20. Term, termination and your data

This agreement applies from your first use of the Service and continues until terminated. Your Subscription runs for the billing period you selected and renews automatically until cancelled.

You may cancel your Subscription in the Stripe customer portal, effective at the end of the current paid period. You may delete your account in your dashboard; deletion is blocked while a paid Subscription is still active, so cancel first.

We may terminate for cause on a material breach that you do not cure within 14 days of our notice, or with immediate effect where the breach cannot be cured, where required by law, or on insolvency. We may terminate without cause on 30 days notice, in which case we refund fees for any unused paid period.

What happens to your data

Restriction of the Service for non-payment does not delete your data. On deletion of your account we delete your account record and the data linked to it, including Catalog Data, Assistant configuration, connected domains and Shopper conversations. Please retain your own copies before deleting, because deletion cannot be reversed. We do not currently offer a self-service export; if you need a copy of your data before leaving, contact us at the address in section 25 and we will assist within a reasonable time.

Some data persists after deletion for legitimate reasons: billing records and invoices held by us or by Stripe for statutory retention periods, security and audit logs for their retention period, and encrypted backups until they expire on their normal cycle. Annex 1 governs deletion of personal data processed on your behalf.

Sections 11, 15, 16, 17, 18, 19, 26 and 27 survive termination, together with any provision that by its nature is intended to survive.

21. Changes to the Service and to these Terms

We may amend these Terms. We will publish the new version with an updated "Last updated" date and, where a change is material, notify you by email or in the dashboard at least 30 days before it takes effect.

If a material change is adverse to you, you may terminate your Subscription before it takes effect, and we will refund fees for the unused remainder of the paid period. Continuing to use the Service after the effective date means you accept the new version.

Changes required by law, or needed to address a security risk, may take effect immediately.

22. Beta and experimental features

We may make features available that are labelled beta, preview or experimental. They are provided as is, may be incomplete or unstable, may change or be withdrawn at any time, and are excluded from any support commitment and from the warranties in section 17. Please do not rely on them for anything you cannot afford to have fail.

23. Export controls and sanctions

Each party will comply with applicable export control and sanctions law. You confirm that you, your beneficial owners and your Integrations are not subject to restrictive measures, and that you will not make the Service available to a sanctioned party or from an embargoed territory.

24. Assignment and subcontracting

You may not assign or transfer this agreement without our prior written consent, which we will not unreasonably withhold.

We may assign this agreement to an affiliate, or in connection with a merger, reorganisation or sale of the business to which it relates. We may engage subcontractors and subprocessors to provide the Service; we remain responsible for their performance, and Annex 1 governs subprocessors that process personal data.

25. Notices and contact

Send legal notices, data protection enquiries and support requests to:

Legal and data protection: legal@agenticcart.ai
Support: support@agenticcart.ai

We send notices to the email address on your account and, for operational matters, may also use in-product messages. Please keep your contact address current; a notice sent to the address on file is deemed received.

Our full provider details, including postal address and register information, are set out in our Imprint. /imprint

26. Governing law and venue

This agreement is governed by Austrian law, excluding its conflict-of-laws rules and excluding the United Nations Convention on Contracts for the International Sale of Goods.

The courts of Vienna, Austria have exclusive jurisdiction. This does not affect any mandatory place of jurisdiction that applies notwithstanding this clause.

Consistent with our Imprint, we are neither obliged nor willing to participate in consumer arbitration proceedings.

27. Final provisions

If a provision is or becomes invalid or unenforceable, the remainder stays in force and the invalid provision is replaced by an enforceable one that comes closest to its commercial purpose.

These Terms, together with the documents listed in section 1, constitute the entire agreement between the parties on their subject matter and supersede all prior arrangements about it, including the Terms of Service dated 20 October 2025.

A failure or delay in exercising a right is not a waiver of it. Amendments and waivers must be in writing; email is sufficient.

The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency or employment relationship.

These Terms are provided in English and may be made available in other languages for convenience. In case of discrepancy, the English version governs.

Annex 1: Data Processing Addendum

This Annex is the agreement required by Article 28(3) GDPR for our processing of personal data on your behalf. It applies automatically to every Merchant, forms part of these Terms, and requires no separate signature. Where this Annex conflicts with the rest of these Terms, this Annex prevails for the processing of personal data.

A1. Subject matter, duration, nature and purpose

We process personal data contained in Catalog Data and Conversation Data in order to provide the Service described in section 3: to ingest and index your catalog, to operate the Storefront and the Assistant, to record conversations for your inbox and analytics, and to support and secure the Service. Processing lasts for the term of your Subscription and, for the limited residual periods set out in A8, thereafter.

A2. Categories of data subjects and personal data

Data subjects: your Shoppers, and any individuals whose personal data you include in Catalog Data or store information.

Personal data: the content of Shopper messages, which may contain whatever a Shopper chooses to type; a pseudonymous session identifier; the language and originating storefront of the conversation; search terms; product interaction events; and, where a Shopper creates a share link, a snapshot of that conversation.

The Service is not intended for special categories of personal data under Article 9 GDPR, for criminal-offence data, or for payment card data. You must not route such data through the Service.

A3. Our obligations as processor

We undertake that:

• we process personal data only on your documented instructions, which comprise these Terms, your configuration of the Service and any further written instruction you give; we will inform you if in our opinion an instruction infringes data protection law;
• we do not process personal data for our own purposes, and in particular do not use it to train, fine-tune or improve machine learning models;
• persons authorised to process the data are bound by confidentiality and are appropriately instructed;
• we implement the technical and organisational measures described in A5;
• we assist you, taking into account the nature of the processing, in fulfilling your obligations under Articles 32 to 36 GDPR;
• we make available the information necessary to demonstrate compliance with this Annex.

A4. Subprocessors

You give general authorisation for us to engage subprocessors. We will ensure that each subprocessor is bound by data protection obligations that are no less protective than this Annex, and we remain responsible for their performance.

Our current subprocessors, including the model provider that processes Shopper messages, are listed in the annex to our Privacy Policy. That list is the single authoritative register; we deliberately do not maintain a second list here, to avoid divergence.

Open the subprocessor list in our Privacy Policy

We will announce an intended addition or replacement of a subprocessor at least 30 days in advance, by updating that list and notifying you by email or in the dashboard. You may object on reasonable data protection grounds within that period; if we cannot accommodate your objection, you may terminate the affected part of the Service and we will refund fees for the unused paid period.

A5. Technical and organisational measures

We maintain measures appropriate to the risk, including: encryption of data in transit using current TLS; encryption at rest for databases and backups; logical separation of tenants enforced both in the application and in the search index; least-privilege access control with individual accounts for personnel; audit logging of administrative actions; management of secrets outside application code; vulnerability patching; monitoring and alerting; and regular backups with restore testing.

You are responsible for the measures in your own sphere, including securing your store and hosting, managing who in your organisation has dashboard access, and protecting the API keys and access tokens you hold.

A6. Assistance with data subject requests

The Service gives you direct means to fulfil the most common requests: you can open a conversation in your inbox and delete it, which removes its messages, its analytics events and any share snapshot. For requests you cannot fulfil with those tools we will assist within a reasonable period and, where the effort is substantial and not attributable to a fault of ours, we may charge our reasonable costs after telling you in advance.

If a data subject contacts us directly about data we process on your behalf, we will not respond substantively and will refer them to you, unless we are legally required to act.

A7. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf, and will provide the information available to us that you need for your obligations under Articles 33 and 34 GDPR, supplementing it as the investigation progresses. Notification is not an acknowledgement of fault. Notifying supervisory authorities and data subjects is your responsibility as controller.

A8. Deletion and return

During the term, personal data is deleted in accordance with the retention periods in section 14. On termination we delete personal data processed on your behalf, subject to the following: deletion propagates to encrypted backups only as those backups expire on their normal cycle, and we retain data where and for as long as Union or Member State law requires. On request before termination we will provide a copy of the personal data we hold on your behalf in a commonly used electronic format.

A9. International transfers

Our infrastructure is operated in the European Union. Where a subprocessor processes personal data outside the European Economic Area, we rely on an adequacy decision where one applies and otherwise on the European Commission's Standard Contractual Clauses, together with a transfer impact assessment and supplementary measures where required. The Standard Contractual Clauses are incorporated into this Annex by reference for such transfers, with us acting as data exporter on your behalf. Copies are available on request.

A10. Audits

On reasonable written request, and no more than once per calendar year unless a supervisory authority or a personal data breach requires otherwise, we will provide the documentation reasonably necessary to demonstrate compliance with this Annex and answer a written security questionnaire. An on-site audit takes place only where that documentation is genuinely insufficient, with at least 30 days notice, during business hours, without disrupting operations, subject to confidentiality, and at your cost.