Effective: This DPA applies as of the date you accept the Cervito Terms of
Service or first use the Cervito Service, whichever is earlier.
Last updated: 2026-09-15 (v1.1)
Which document wins. The binding DPA text is the agreement published at
cervito.io/legal/dpa — that is what the
registration clickwrap references and what you accept. This document is that
agreement's technical annex and its app-served copy. On any conflict it defers
to cervito.io/legal/dpa, with one exception: Annex A (Technical and
Organizational Measures), which lives here and is the operative description of
Cervito's measures. Separately, the canonical sub-processor register is
app.cervito.io/docs/legal/sub-processors;
every sub-processor table elsewhere — including the one in the cervito.io DPA §4
and the one on cervito.io/security — is a mirror of it, and where a mirror
disagrees the canonical register is correct.
This Data Processing Addendum ("DPA") forms part of the agreement between
Cervito (the "Processor", "we", "us") and the merchant entity identified
in your Cervito account (the "Controller", "you") (collectively the
"Parties") for the use of the Cervito AI Shop Assistant service (the
"Service").
This DPA reflects the Parties' agreement with regard to the Processing of
Personal Data, in compliance with Regulation (EU) 2016/679 ("GDPR"), the
United Kingdom Data Protection Act 2018, the California Consumer
Privacy Act ("CCPA") as amended by the CPRA, and other applicable data
protection laws.
By using the Service, you accept this DPA on behalf of the Controller. If
your organization requires a counter-signed copy, email [email protected]
and we will execute one within 10 business days.
Capitalized terms not defined here have the meaning given in the GDPR.
Cervito processes Personal Data for the following purposes:
1. Visitor chat: generating AI responses to storefront visitor messages
using the Controller's Shopify catalog as grounding.
2. Contact management (CRM): deduplicating and merging visitor identity
across sessions/devices to build a unified contact record.
3. Attribution: tracking visitor journeys across chat, product view,
add-to-cart, and purchase events to attribute revenue to the Service.
4. Communications to Controller: transactional emails to the merchant
(daily debriefs, cost-budget alerts, account verification).
5. Service operation: authentication, billing reconciliation, security
monitoring, error diagnostics.
6. Voice input (where enabled by the Controller; on by default):
transcribing a visitor's recorded voice clip to text so it can be handled as
a chat message. The audio is transmitted to the transcription sub-processor
and discarded; only a cost record (provider, model, audio duration, byte
count, latency, status) is retained, carrying no audio and no transcript.
| Category of Data Subject | Personal Data processed |
|---|---|
| Storefront visitors (anonymous) | Visitor session identifier, IP address (for rate-limiting only — not stored persistently in raw form), browser language, page URL viewed, chat messages typed, voice recordings where the Controller has voice input enabled (transient: sent to the transcription sub-processor, discarded after transcription, never stored or logged) and the resulting transcript, products clicked, cart events |
| Storefront visitors (identified, post-email-capture) | All of the above + email address, name (if provided), phone (if provided), order history (linked via Shopify customer record) |
| Merchant users | Name, email, hashed password, Shopify shop ID, Google OAuth ID (if used), dashboard activity logs, billing address (when billing is enabled) |
The Controller represents and warrants that:
Cervito will:
1. Process Personal Data only on documented instructions from the
Controller, including with regard to transfers of Personal Data to a
third country. The Controller's acceptance of the Cervito Terms of
Service and use of the Service's standard features constitute documented
instructions for the purposes listed in Section 3.
2. Ensure that persons authorized to process the Personal Data have
committed themselves to confidentiality.
3. Implement appropriate technical and organizational measures as
described in the TOMs annex (Annex A below).
4. Assist the Controller in fulfilling its obligations to respond to
Data Subject requests (access, rectification, erasure, portability,
restriction, objection) by providing tools and procedures as described
in Section 10.
5. Notify the Controller without undue delay after becoming aware of a
Personal Data Breach affecting the Controller's Personal Data, with the
information then available and further information as it becomes available,
and in sufficient time to allow the Controller to meet its own Article 33(1)
deadline. The 72-hour deadline in Article 33(1) runs against the
Controller, as the party that notifies the supervisory authority; Cervito's
obligation as Processor is prompt notice and assistance, not a
supervisory-authority filing.
6. Delete or return Personal Data at the Controller's choice upon
termination, as described in Section 11.
7. Make available to the Controller all information necessary to
demonstrate compliance with Article 28 GDPR, and allow for and
contribute to audits (subject to the audit terms in Section 12).
The Controller authorizes Cervito to engage the Sub-processors listed at
app.cervito.io/docs/legal/sub-processors
("Authorized Sub-processors").
Cervito will:
Where Personal Data of EU/UK Data Subjects is transferred to a Sub-processor
outside the EEA/UK without an adequacy decision, the transfer rests on the
transfer mechanism in that Sub-processor's own data processing agreement,
which Cervito has accepted and which is named per vendor in the canonical
Sub-processor list. Those agreements incorporate the Standard Contractual
Clauses approved by Commission Implementing Decision (EU) 2021/914 (Modules Two
and/or Three as applicable) and, for UK data, the ICO International Data
Transfer Addendum. Cervito has not executed separate bilateral Standard
Contractual Clauses with each Sub-processor; formal transfer documentation is
being finalized with legal counsel and the relevant clauses will be made
available to the Controller on request. Where a Sub-processor's listing under
the EU-U.S. Data Privacy Framework is recorded as "Active — Re-certification
under Review", the transfer rests on the Standard Contractual Clauses in that
vendor's agreement, not on the Framework.
Transfers from the Controller to Cervito. ⚠ *PROPOSED — FOR COUNSEL /
FOUNDER SIGN-OFF; not in force until executed or published as accepted.* The
Growth Locker FZC is established in the United Arab Emirates, which is not the
subject of a European Commission adequacy decision. Where the Controller is
established in the EEA and Personal Data is transferred to Cervito under this
DPA, the Parties incorporate by reference Module Two (Controller to
Processor) of the Standard Contractual Clauses annexed to Commission
Implementing Decision (EU) 2021/914 of 4 June 2021, with the Controller as
data exporter and The Growth Locker FZC as data importer. Clause 7
(docking) applies. In Clause 9(a) the Parties select Option 2 (general
written authorisation), with the notice period in Section 7. The optional
Clause 11(a) redress body does not apply. For Clause 17 the governing law is
that of the EEA State in which the Controller is established, and for Clause
18(b) the forum is the courts of that State; where that State's law does not
allow third-party-beneficiary rights, the law and forum are those of Ireland.
Where the Controller is established in the United Kingdom, or the transfer is
subject to the UK GDPR, the International Data Transfer Addendum to the EU
Commission Standard Contractual Clauses, version B1.0 (ICO, s.119A(1) DPA
2018) applies, with Tables 1–4 populated from this DPA and "Importer" selected
in Table 4. Annexes I, II and III are populated by Sections 2, 3, 4 and 9 of
this DPA, Annex A, and the canonical Sub-processor list. On any conflict
between those Clauses and this DPA or the Terms of Service, those Clauses
prevail.
Cervito retains Personal Data only as long as necessary to deliver the
Service or as required by law. Default retention windows are:
| Data type | Default retention | Notes |
|---|---|---|
| Visitor chat transcripts (anonymous) | 90 days from last activity | Auto-pruned by cron |
| Visitor chat transcripts (identified) | 365 days from last activity | Tied to identified contact |
| Identified contact records | Until merchant deletes OR account terminated | Subject to merchant deletion |
| Merchant account data | Until merchant deletes OR account terminated | Subject to account closure |
| API call logs (cost + token usage) | 90 days raw, 12 months aggregated | For billing reconciliation |
| Security event logs | 180 days | For incident investigation |
| Admin audit log | 365 days | For founder-impersonation audit trail |
| Shopify GDPR webhook receipts | 7 days (idempotency dedup window) | Then auto-pruned |
Cervito assists the Controller in fulfilling Data Subject requests through:
1. Self-service visitor portal. A Data Subject may request a copy of, or
the erasure of, their Personal Data directly, after verifying control of
their email address. Exports are delivered to the Data Subject; erasure is
executed across the Cervito-powered stores that hold their data. This is the
only path that delivers an export directly to a Data Subject — the
Shopify customers/data_request webhook compiles the export and forwards it
to the Controller to deliver.
2. Automated GDPR webhooks required by Shopify:
- customers/data_request — Cervito generates a JSON export of all
Personal Data tied to the requesting customer and emails it to the
Controller within 5 business days.
- customers/redact — Cervito deletes the customer's contact record,
visitor records, chat transcripts, events, and attribution touches
within the deadline mandated by Shopify (currently 10 days from
webhook receipt).
- shop/redact — Cervito deletes all Personal Data associated with the
Controller's shop within the Shopify-mandated 30 days of webhook
receipt.
3. Manual deletion via the dashboard Contacts page and the Settings →
Delete Account flow.
4. Data export via Contacts CSV export.
If the Controller receives a Data Subject request that requires Cervito's
assistance, email [email protected] with the request details. Cervito
will respond within 5 business days.
Upon termination of the Controller's Cervito account:
The Controller may request earlier deletion at any time by emailing
[email protected].
Once per calendar year, and at the Controller's expense, the Controller
may audit Cervito's compliance with this DPA by:
docs/compliance/ is prepared to SOC-2 control structure but has not been audited.The liability of each Party under this DPA is subject to the limitations
and exclusions in the Cervito Terms of Service.
This DPA is governed by the law specified in the Cervito Terms of Service.
The governing law, the dispute forum and any arbitration seat are being
finalized with legal counsel and will be published in the Terms of Service;
until they are, this DPA states no governing law. Nothing in this section
removes a non-waivable right a data subject or a consumer has under the law of
their country of residence, and the governing-law and forum terms of any
Standard Contractual Clauses incorporated under Section 8 prevail over this
section for matters within those Clauses.
If there is any conflict between this DPA and the Cervito Terms of Service,
this DPA prevails with regard to data protection matters.
Cervito implements the following measures to protect the confidentiality,
integrity, and availability of Personal Data:
admin_actions.
WHERE shop_id = ?.
src/ai/coaching.js, src/ai/attribution.js and src/ai/taxonomy.js: each
has a requireShopId() guard and its functions throw on a missing or blank
shopId, preventing accidental cross-tenant reads. (⚠ Corrected 2026-09-15:
this list previously named assistant.js and cost-cap.js and omitted
taxonomy.js. There is no src/ai/assistant.js — src/routes/assistant.js
is a route file, not a chokepoint module — and src/ai/cost-cap.js is a
spend gate with one such guard, not one of the isolation chokepoints. The
three named above are the primary AI chokepoints; the same requireShopId()
pattern is also applied in other src/ai/ modules, and
tests/coaching-isolation.test.js exercises tenant isolation across the
analytics and AI surface more broadly.)
crypto.timingSafeEqualtoken_invalidate_after for sliding revocation.
httpOnly, secure (in production), sameSite=lax.security_events table for founder-console review.
| Date | Version | Change |
|---|---|---|
| 2026-09-15 | v1.1 | Precedence stated at the top: the binding DPA is cervito.io/legal/dpa and this document is its technical annex + app-served copy, deferring to it except on Annex A; the canonical sub-processor register is app.cervito.io/docs/legal/sub-processors and every other table is a mirror of it. §7 corrected — the promised in-app broadcast notice channel was removed (no merchant-broadcast mechanism exists) and replaced with email to the account email plus a dated changelog entry; the objection addresses (privacy@ or [email protected]) are now stated in the clause. Annex A.3 corrected — the chokepoint list named assistant.js and cost-cap.js, neither of which is a tenant-isolation chokepoint, and omitted taxonomy.js, which is one; the claim that those three are "the set covered by tests/coaching-isolation.test.js" was also wrong and has been replaced. §8 corrected — the clause implied executed bilateral SCCs with Cervito as exporter; it now states the per-vendor mechanism and the interim position, matching sub-processors.md v2, and carries a PROPOSED Module Two clause for the Controller-to-Cervito transfer that is not in force until signed off. §6(5) and Annex A.7 corrected — the Article 33(1) 72-hour deadline runs against the Controller, not Cervito as Processor; the Processor obligation is notice without undue delay plus assistance. §3, §4 and §10 now name voice input and the self-service visitor portal. §12 no longer asserts a SOC 2 Type I completion date. §14 no longer names Romania as the governing law. |
| 2026-05-17 | v1.0 | Initial publication. |