Skip to content

Founding CircleFirst 20 paying stores get Growth for $9.99/mo or Pro for $29.99/mo, locked while subscribed.First 20 paying stores: Growth $9.99/mo.See offer · 20 of 20 spots left

Log inContact us
Any Store AI
Start free trial

Data Processing Agreement

Last updated: 2026-10-24

This Data Processing Agreement ("DPA") supplements the Terms of Service between Sumon Mondal, trading as FroGman, Dhaka, Bangladesh, the provider of Any Store AI ("Processor"), and the merchant ("Controller") whenever the Controller's use of the Service involves personal data of individuals in the EU/EEA or UK ("Data Subjects"), consistent with Article 28 GDPR / UK GDPR. It is a standard starting template, not a countersigned legal instrument on its own. Email the contact address below to countersign a copy.

1. Subject matter and duration

Processor processes personal data on Controller's behalf for the duration of the underlying Terms of Service, solely to provide the chat widget, product search, and cart/checkout assistance features of the Service.

2. Nature and purpose of processing

Processing consists of: receiving customer chat messages, querying the Controller's store catalog and orders, generating AI responses, creating carts/checkout links, and sending the Controller's post-purchase, winback and abandoned-cart emails on the Controller's behalf. Categories of Data Subjects: the Controller's customers and store visitors. Categories of data: chat message content and images a customer sends; customer name and email address; order number, items, totals and fulfilment date; and whether the customer agreed to marketing email. Marketing emails (follow-ups, winback, abandoned-cart reminders) are only sent to customers who agreed to marketing. Processor does not sell personal data, use it for advertising, use it to train AI models, or make automated decisions with legal or similarly significant effects.

3. Sub-processors

Controller authorizes Processor's use of the sub-processors listed in the Subprocessor List, which Processor will keep current. Processor remains liable for each sub-processor's compliance with the obligations of this DPA.

4. Processor obligations

  • Process personal data only on documented instructions from the Controller, including regarding international transfers.
  • Ensure personnel with data access are bound by confidentiality.
  • Implement appropriate technical and organizational security measures: encryption in transit for all traffic, encryption at rest for store credentials, encrypted off-site backups, access-restricted and logged production systems, logging of access to customer conversations, and separate test and production data.
  • Assist the Controller in responding to Data Subject requests (access, deletion, portability) via the deletion/export process described in the Privacy Policy.
  • Notify the Controller without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting their data, with the information the Controller needs to meet its own obligations.
  • Delete or return all personal data at the end of the Terms, except where retention is required by law.

5. Retention

  • Chats are deleted 12 months after their last message.
  • Orders have the customer's email address and items removed 12 months after fulfilment.
  • Abandoned checkouts are deleted after 30 days.
  • Access and audit logs are kept for 13 months.
  • Personal data is also deleted when Shopify sends a customer or shop data deletion request.
  • Unsubscribe records are kept, so an address that opted out is never emailed again.

6. Data Subject rights

Processor will assist Controller in fulfilling Data Subject access, rectification, erasure, and portability requests to the extent the Service's own tooling allows, at no additional charge for reasonable requests.

7. International transfers

Where personal data is transferred outside the EEA/UK, Processor relies on its sub-processors' own Standard Contractual Clauses or equivalent safeguards.

8. Audit rights

Processor will make available information reasonably necessary to demonstrate compliance with this DPA and allow for audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, subject to reasonable notice and confidentiality.

9. Contact

To countersign this DPA or ask questions, contact support@anystoreai.com.