Data Processing Agreement

This Data Processing Agreement ("DPA") supplements the A³ Terms of Service and governs the processing of personal information by A³ (operated by Konstantin Tikhaev, Esek Patur 346571938, Hanna Rovina 2, Haifa 3495402, Israel — "Processor") on behalf of the Merchant ("Controller"). By accepting the Terms, Merchant accepts this DPA.

This DPA satisfies the processor obligations of GDPR Article 28 (Regulation (EU) 2016/679), UK GDPR Article 28, Swiss FADP Article 9, CCPA / CPRA Service Provider obligations, PIPEDA accountability principle, Quebec Law 25, the Australian Privacy Act 1988 (as amended), and the New Zealand Privacy Act 2020. Where the Merchant is a Controller of EU/EEA, UK, or Swiss data, the EU Commission Standard Contractual Clauses (Decision 2021/914) Module 2 (controller-to-processor) and, where applicable, Module 3 (processor-to-processor) are incorporated into this DPA by reference and apply in case of any conflict. The UK International Data Transfer Addendum (ICO template, in force 21 March 2022) applies to UK-origin transfers; the Swiss FDPIC amendments apply to Swiss-origin transfers.

1. Definitions

• Controller means the Merchant. Under CCPA, equivalent term is "Business".
• Processor means A³. Under CCPA, equivalent term is "Service Provider".
• Personal Information means information relating to an identified or identifiable natural person, as defined under applicable law (CCPA, PIPEDA, APPs, etc.).
• Shopper Personal Information means Personal Information of the Merchant's end-customers processed through the A³ Services.
• Sub-processor means any third-party processor engaged by A³ to assist in delivering the Services.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information.

2. Subject matter and duration

A³ processes Shopper Personal Information only to provide the Services to Merchant. Processing continues for the term of the subscription, plus the deletion window in §9.

3. Processing details (Schedule 1)

4. Processor obligations

A³ will:

• Process Shopper Personal Information only on documented Controller instructions, including the Services as configured by Merchant and these Terms. A³ will inform the Controller if an instruction violates applicable law.
• Ensure that personnel authorized to process Shopper Personal Information are bound by confidentiality obligations.
• Implement appropriate technical and organizational measures as described in Schedule 2 (Security).
• Assist Controller in responding to data-subject requests under all applicable laws — including GDPR Articles 15-22, UK GDPR equivalents, CCPA/CPRA, PIPEDA, Quebec Law 25, APP 12-13, and others. A³ will forward requests received directly to the Controller within 5 business days or, where instructed by the Controller, respond on the Controller's behalf within the statutory timeline (GDPR: 1 month extendable to 3; CCPA: 45 days extendable to 90; PIPEDA: 30 days).
• Assist Controller with Data Protection Impact Assessments (GDPR Article 35), prior consultations with supervisory authorities (GDPR Article 36), and equivalent privacy impact assessments under other laws, on reasonable terms.
• For EU/UK/Swiss-origin data, ensure that any onward international transfer to a sub-processor outside an "adequate" jurisdiction is governed by Standard Contractual Clauses (Module 2 or Module 3 as applicable), the UK ICO Addendum, the Swiss FDPIC amendments, or another valid Article 46 transfer mechanism, and that supplementary measures meeting the Schrems II standard are in place (see Privacy Policy §Q).
• Return or delete Shopper Personal Information at the end of processing, per §9.
• Notify Controller of any Personal Data Breach without undue delay, and in any event within seventy-two (72) hours of becoming aware, providing information reasonably required to comply with Controller's own notification obligations.
• Make available to Controller information reasonably necessary to demonstrate compliance with this DPA.

5. Sub-processors

Controller authorizes A³ to engage the sub-processors listed in Schedule 3 (the live list at /legal/subprocessors).

A³ will give Controller at least twenty (20) days' notice before adding or replacing a sub-processor. During the notice window Controller may object on reasonable grounds; if A³ cannot accommodate the objection, Controller may terminate the affected portion of the Services with prorated refund of pre-paid fees.

A³ remains liable for the acts and omissions of its sub-processors as if performed by A³ itself.

6. Data subject rights assistance

A³ provides reasonable assistance to Controller in fulfilling data-subject requests under applicable law. For Shopper requests received directly by A³, we forward them to Controller within 5 business days and assist with verification, retrieval, and deletion as required.

7. Audit rights

Once per twelve (12) months, Controller may, at its own cost and on at least 30 days' written notice, audit A³'s compliance with this DPA. A³ does not currently hold a SOC 2 or equivalent third-party audit report; should A³ obtain one, it may, in its discretion, satisfy this obligation by providing that report instead. Audits must be conducted during business hours and must not unreasonably disrupt A³'s operations. Costs are borne by Controller unless the audit reveals material non-compliance, in which case A³ bears reasonable audit costs.

8. CCPA Service Provider provisions

A³ is a Service Provider under CCPA / CPRA for Shopper Personal Information that A³ processes on Controller's behalf. A³:

• Will not sell or share Personal Information (as "sale" and "share" are defined under CCPA).
• Will not retain, use, or disclose Personal Information for any purpose other than the specific business purpose set out in these Terms, including not for marketing or selling of any other goods or services.
• Will not retain, use, or disclose Personal Information outside the direct business relationship with Controller.
• Will not combine Personal Information received from Controller with personal information from another source, except as permitted by 11 CCR §7050(b) (security and integrity).
• Certifies that A³ understands and will comply with these restrictions.
• Will notify Controller if A³ determines it can no longer meet these obligations, and will permit Controller to take reasonable steps to stop and remediate unauthorized use.

9. Return or deletion

Upon termination of the Services for any reason, A³ will:

• Delete all Shopper Personal Information held in production systems within thirty (30) days of Controller's written request, where technically feasible.
• If no deletion request is received, A³ will automatically delete Shopper Personal Information ninety (90) days after termination, except where retention is required by law or for legal claims.
• Backups may persist for an additional period not exceeding 35 days from deletion in production; the data will not be re-introduced and will be overwritten by normal backup rotation.

Schedule 2 — Technical and Organizational Measures (TOMs)

• Encryption in transit: TLS 1.2+ (1.3 preferred) for all external connections; TLS or IPSec for internal service-to-service.
• Encryption at rest: AES-256 via Google Cloud (Firestore, Cloud Storage) and AWS KMS (S3, EBS).
• Authentication: Firebase Authentication or Shopify Session JWT for end users; SSH keys and IAM roles for personnel; multi-factor authentication required for all administrative access.
• Authorization: least-privilege IAM; tenant-isolation enforced at the Firestore collection level; cross-tenant access denied at the API middleware (see saas-api assertOwnTenant).
• Logging: structured audit logs in Cloud Logging; PII redaction on event-stream writes via the saas-api pii-redact compiler module.
• Vulnerability management: dependency scanning via Dependabot / npm audit; security patches applied within commercially reasonable time.
• Backups: Firestore automated point-in-time recovery; daily snapshots; 30-35 day retention.
• Incident response: documented breach-notification procedure; 72-hour notification commitment to Controllers.
• Data minimization: IP addresses hashed at write time; PII redacted in event payloads; voice audio discarded within 30 seconds of transcription.

Schedule 3 — Sub-processors

The current list is maintained at /legal/subprocessors. Email privacy@triplea.studio with subject "subprocessor-notifications" to receive change notifications.

Schedule 4 — AI Processing Addendum

Because A³'s Services are AI-driven, the following AI-specific commitments supplement the general processor obligations:

1. No training on Shopper conversations by default. A³ will not use Shopper conversation content (transcripts, audio, click events) to train, fine-tune, or improve A³'s base AI models or those of any AI sub-processor (Google Vertex AI, Anthropic via AWS Bedrock). AI sub-processors are contractually prohibited from using A³ customer data to train their own models.
2. Opt-in aggregate analytics. Merchants may opt in (via merchant dashboard) to contribute de-identified, aggregated conversation patterns to improve A³'s persona quality across all stores. This setting is OFF by default and can be revoked at any time.
3. No biometric processing. A³ does not generate, store, or process voiceprints, faceprints, or any biometric identifier as defined under BIPA (740 ILCS 14/), CCPA Sensitive Personal Information, or comparable laws. Voice audio is transcribed in-memory and the raw stream is discarded within 30 seconds.
4. AI output disclosure. The widget displays an explicit AI disclosure modal before microphone activation. Merchant warrants it has not disabled, hidden, or otherwise circumvented this disclosure.
5. FTC AI guidance compliance. A³ follows FTC guidance on AI chatbots, including: (a) clearly identifying the ambassador as AI at the start of each interaction; (b) not making endorsements or material connections without Merchant's knowledge; (c) preserving conversation logs for FTC investigations where legally required.
6. No automated decisions. A³ does not make "significant decisions" about individuals (in the sense of CCPA ADMT regulations or Australian Privacy Act 2024 amendments).

Contact

Questions about this DPA? Email legal@triplea.studio.