Data Processing Addendum (DPA)

Effective date: 16 June 2026 · Version 1.0

This DPA forms part of the Terms of Servicebetween Agentic Cart ("Processor") and the customer ("Controller"). It governs processing of personal data on behalf of the Controller under UK GDPR and EU GDPR.

Roles

You are the data controller for your customers' personal data within Store Data. We act as data processor when handling such data to provide the Service.

Subject matter and duration

Processing covers Store Data accessed via Shopify OAuth for the duration of your active subscription, plus retention periods stated in our Privacy Policy.

Sub-processors

• Supabase (database & auth) — EU region
• Vercel (frontend hosting) — EU region
• Railway (backend hosting) — EU region
• Shopify Inc. (platform OAuth and billing)

Security measures

Encryption at rest and in transit, short-lived JWT sessions, HMAC verification on Shopify callbacks, least-privilege access control, and immutable audit logging.

Data subject requests

We respond to Shopify GDPR webhooks (customers/data_request, customers/redact, shop/redact) as described in our Privacy Policy and Terms.

To request a signed copy of this DPA, email legal@agentic-cart.com.