Data processing agreement (DPA)

1. Purpose and parties

This agreement is concluded between the merchant customer ("the Controller") and STORAFIX, publisher of Storapulse ("the Processor"). It implements Article 28 of Regulation (EU) 2016/679 (GDPR) and forms part of the terms of sale and use: it applies as soon as they are accepted, to the personal data the Processor processes on the Controller's behalf.

Its structure follows the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/915 of 4 June 2021). It is not a full reproduction of them: on written request, the Controller may sign the complete standard contractual clauses, with the annexes filled in. In case of conflict, the rule most protective of the data subjects prevails.

2. Description of the processing

Subject matter and nature: hosting, storage and automated processing of the data needed for the Storapulse service, including the use of AI models to draft replies and texts.

Purposes: answering the store's customers (customer support), recording consents and unsubscribes, sending the marketing messages the merchant authorises, measuring sending reputation and security, measuring the sales attributed to each channel.

Categories of data: identity and contact details (e-mail, phone), content of customer-support exchanges, order references, proof of consent (source, date, text displayed, fingerprint of the IP address), sending history. Data subjects: the Controller's customers and prospects. No special-category data (GDPR Article 9) is covered; the Controller undertakes not to entrust any.

Duration: that of the subscription, then the deletion period of section 7.

3. Instructions and confidentiality

The Processor processes the data only on the Controller's documented instructions (terms of sale and use, application settings, written requests). It informs the Controller immediately if an instruction appears to infringe the GDPR.

Persons authorised to process the data are bound by confidentiality; their access is limited to what is strictly necessary.

4. Security

The Processor implements the measures of GDPR Article 32: encryption of secrets at rest (AES-256-GCM), HTTPS exchanges, strict per-store isolation (Row Level Security), access control with two-step verification for staff, an audit log, and no address or IP address in clear in the consent and objection tables (salted HMAC fingerprints).

5. Sub-processors

The Controller gives a general authorisation for the sub-processors below. Any addition or replacement is notified to the Controller at least 30 days in advance; the Controller may object on reasonable grounds and, failing agreement, terminate at no cost. Each sub-processor is bound by contract to the same data-protection obligations.

Current list: hosting of the application and database: OVH SAS (France); file storage and customer-support e-mails: Scaleway SAS (France), or Resend or Postmark (United States) if one of them is chosen in the configuration; marketing e-mails sent for the merchant: Amazon Web Services EMEA SARL (Luxembourg), Amazon SES service, in the region chosen in the configuration; AI models called, depending on configuration, only with the data the task needs: Mistral AI (France), Google (Gemini, United States), Alibaba Cloud (Qwen, Singapore), DeepSeek (China), Zhipu AI (GLM, China) and, only if enabled, OpenAI, Anthropic and Perplexity (United States).

Customer support: messages from the merchant's customers and everything derived from them (classification, replies, summaries, checking of replies) are processed only by Mistral AI (France), with no fallback to any other AI model. If Mistral is unavailable, the message waits for a manual reply. The other models listed are used only for other tasks (product pages, SEO texts…).

Any transfer outside the European Union is covered by an adequacy decision or by the standard contractual clauses for transfers (Implementing Decision (EU) 2021/914). Stripe (subscription payment) and Bill (invoicing) do not process the data of the merchant's customers: for these operations, STORAFIX is the controller (see the privacy policy).

6. Data-subject rights, assistance and breaches

The Processor helps the Controller answer requests to exercise rights (access, rectification, erasure, objection, restriction, portability); unsubscribe and deletion are available in the application, and any request received directly is passed on to the Controller. It also assists with security, impact assessments and consultation of the supervisory authority (GDPR Articles 32 to 36).

In the event of a personal-data breach, the Processor notifies the Controller without undue delay and at the latest 48 hours after becoming aware of it, with the useful information (nature, categories and approximate number of records and persons, likely consequences, measures taken).

7. End of the contract

At the Controller's choice, the data is returned (export from the application) and then deleted at the latest 30 days after the end of the contract, unless the law requires retention. Only the irreversible objection fingerprints may be kept, to keep honouring unsubscribes.

8. Audits and information

The Processor makes available the information needed to demonstrate compliance with this agreement and allows reasonable audits, on written notice, once a year, or at any time in the event of a data breach.

9. Express clause: anonymisation for statistics

The Controller expressly authorises the Processor to anonymise the measures of its store (scan scores, visibility in AI assistants, sales by channel) in order to produce aggregated statistics. End customers' personal data never enters these statistics.

To the extent that these measures constitute personal data (for example those of a merchant who is a sole trader), STORAFIX, which alone determines the purpose and means of this anonymisation, acts for this operation and for the resulting statistics as a separate controller (GDPR Articles 4(7) and 28(10)), on the basis of its legitimate interest, and not as processor.

Rules applied: at least 10 stores per figure shown or published (20 for an export), no store above 30% of a total, re-identification prohibited. The merchant may object at any time in Settings, without losing the basic service. Once anonymised, these statistics are no longer personal data (GDPR Recital 26).

10. Term, governing law and contact

This agreement lasts as long as the Processor processes data on the Controller's behalf. It is governed by French law, like the terms of sale and use. Contact for any data question: support@storapulse.com,contact@storafix.com.