Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the Kartwise Terms of Service between the Merchant (controller) and Double Cart LLC (processor). Effective 2026-10-14. It applies when we process personal data on the Merchant's behalf, and is intended to meet Article 28 of the GDPR/UK GDPR and similar laws.
1. Subject matter, duration, nature and purpose
- Subject matter: providing the Kartwise AI assistant, order lookup and claims features to the Merchant's store.
- Duration: while the app is installed, plus the deletion periods below.
- Nature and purpose: collecting, storing, retrieving, using and deleting personal data to answer customer questions, look up orders, receive and manage claims, notify the Merchant, and secure the service.
2. Data subjects and categories of data
- Data subjects: the Merchant's customers and website visitors; the Merchant's staff.
- Personal data: chat messages; email addresses; names; order numbers and order details read from Shopify; claim descriptions and photos; pages viewed (with consent); IP addresses; Shopify staff user IDs.
- Special categories: not intended. The chat asks customers not to share sensitive data.
3. Our obligations as processor
We will:
- Process personal data only on the Merchant's documented instructions — which are these Terms, this DPA and the Merchant's use and settings of the app — unless the law requires otherwise (we'll tell the Merchant unless that's prohibited).
- Ensure everyone authorised to process the data is bound by confidentiality.
- Apply the technical and organisational measures in Annex A.
- Use subprocessors only as set out in section 4.
- Help the Merchant respond to data subject requests, including through Shopify's data request and erasure webhooks.
- Help the Merchant meet its security, breach-notification and impact-assessment obligations, taking into account the information available to us.
- Notify the Merchant without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting the Merchant's data, with the information reasonably available.
- Delete the Merchant's personal data at the end of the service (Shopify's shop data-deletion request, 48 hours after uninstall) and according to the retention periods below, unless the law requires us to keep it.
- Make available the information reasonably needed to demonstrate compliance with this DPA, and allow for reasonable audits (normally by written questionnaire, at most once a year, with 30 days' notice).
4. Subprocessors
The Merchant authorises the subprocessors listed below and on our Subprocessors page. We'll give at least 14 days' notice of new subprocessors (in the app or by email); the Merchant can object on reasonable data protection grounds, and if we can't address the objection the Merchant may stop using the app. We impose data protection terms on each subprocessor that are no less protective than this DPA and remain responsible for them.
| Subprocessor | Purpose | Location |
|---|---|---|
| Shopify Inc. | Platform the app runs on; billing; order, product and customer-account APIs | Global |
| Fly.io, Inc. | Application hosting | United States |
| Amazon Web Services, Inc. | Primary database (encrypted at rest, with periodic encrypted snapshots) | United States (us-east-1) |
| MongoDB, Inc. (Atlas) | Search index of the store's products, pages and FAQs | United States |
| Upstash, Inc. | Short-lived cache and rate limiting | United States |
| OpenAI, L.L.C. | Generates chat replies; reads product photos customers upload for search | United States |
| Twilio Inc. (SendGrid) | New-claim notification emails to the merchant (only if enabled) | United States |
5. International transfers
Where personal data is transferred outside the EEA/UK to a country without an adequacy decision, the transfer is made under the EU Standard Contractual Clauses (and the UK Addendum where relevant) or another lawful transfer mechanism.
6. Retention
| Data | How long we keep it |
|---|---|
| Chat conversations (messages) | 90 days after the last message, then deleted |
| Claims (order number, name, email, description) | Archived after 60 days without activity; deleted 1 year after archiving |
| Claim photos | Deleted 14 days after the claim is resolved or declined, or 30 days after it is archived, whichever comes first |
| Orders a customer looked up in chat (summary) | 2 hours (short-term cache) |
| Customer sign-in tokens | Valid 1 hour; deleted 1 day after they expire |
| Usage analytics (no message content) | 90 days |
| Staff access logs | 1 year |
| Everything for a store | Deleted when Shopify sends the store's data-deletion request (48 hours after the app is uninstalled) |
7. Merchant responsibilities
The Merchant is responsible for the lawfulness of the processing it instructs, for informing its customers (including in its store privacy policy that it uses an AI chat assistant and these subprocessors), and for its store's consent settings.
8. Order of precedence
If this DPA conflicts with the Terms of Service on personal data, this DPA applies.
Annex A — Technical and organisational measures
- Encryption: TLS for all data in transit; database and backups encrypted at rest.
- Backups: periodic encrypted database snapshots, used for recovery.
- Access control: production access limited to authorised staff; strong unique passwords and two-factor authentication on all provider accounts; access removed promptly when no longer needed.
- Least data: order lookups don't return or store addresses, phone numbers or payment details; claim photo metadata (including location) is removed; transcripts shown to staff are redacted.
- Retention and deletion: automated deletion on the schedule in section 6, and on Shopify's data deletion requests.
- Logging: staff access to claims and chat transcripts is logged and kept for 1 year.
- Separation: each store's data is kept separate and only accessible to that store.
- Consent: shoppers' browsing data is only used when they've allowed personalisation in the store's cookie banner.
- Incident response: a documented incident response procedure with breach notification within 72 hours.
Contact
Double Cart LLC · 30 N Gould St Ste R, Sheridan, WY 82801 · hello@double-cart.com