Contents
This Data Processing Addendum ("DPA") forms part of the Merchant Terms of Service ("Terms") between GIXODIA L.L.C-FZ ("GIXODIA", "Processor", "we") and the merchant that uses Tycoon: AI Store Agent ("Merchant", "Controller", "you"). Tycoon Agent is a brand of GIXODIA L.L.C-FZ. You accept this DPA in the App together with the Terms, and we record that acceptance. No separate signature is needed; if you need a countersigned copy, write to tycoonagent6@gmail.com.
1. Scope and precedence#
1.1 This DPA applies to personal data that GIXODIA processes on your behalf when providing the Service ("Merchant Personal Data").
1.2 It does not apply to personal data that GIXODIA processes as an independent controller, namely: your account, login and staff contact data; billing data received from Shopify; support communications; Demo requests and marketing leads; security logs; service metrics that identify no Shopper; and the de-identified output of the Improvement Program. That processing is described in our Privacy Policy.
1.3 If this DPA conflicts with the Terms, this DPA prevails for the processing of Merchant Personal Data. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail.
2. Definitions#
2.1 "Data Protection Laws" means all laws on the protection of personal data that apply to the processing under this DPA, which may include: Regulation (EU) 2016/679 ("GDPR"); the UK GDPR and the Data Protection Act 2018; the Swiss Federal Act on Data Protection; the California Consumer Privacy Act as amended ("CCPA") and other US state privacy laws; the Israeli Privacy Protection Law, 5741-1981, as amended by Amendment 13, and the Privacy Protection (Data Security) Regulations, 5777-2017 ("PPL"); and the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL").
2.2 "Controller", "processor", "data subject", "personal data", "processing", "personal data breach" and "supervisory authority" have the meanings given in the GDPR and include the equivalent terms in other Data Protection Laws, such as "business", "service provider" and "consumer" under the CCPA, "controller of a database" and "holder" under the PPL, and "controller" and "processor" under the PDPL.
2.3 "Sub-processor" means a third party that GIXODIA engages to process Merchant Personal Data.
2.4 "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914. "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
2.5 Other capitalised terms have the meanings given in the Terms.
3. Roles of the parties#
3.1 Merchant as controller. For Merchant Personal Data you are the controller and GIXODIA is your processor. Where you act as a processor for another controller, you confirm that your instructions are authorised by that controller, and GIXODIA acts as your sub-processor (SCCs Module 3 where relevant).
3.2 Your duties. You are responsible for having a lawful basis for the processing, for telling Shoppers what the law requires (including that your store uses a third-party AI assistant whose chats are saved and processed by our AI providers), and for collecting consent where required, including through your consent banner and Shopify's customer privacy tools.
3.3 Shopify. Shopify is not our Sub-processor. You use Shopify under your own agreement with it. The Service reads Store Data through Shopify's APIs and writes certain data, such as cart attributes, into your store, where Shopify holds it for you.
4. Details of the processing#
The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex I.
5. Processing on documented instructions#
5.1 We process Merchant Personal Data only on your documented instructions, unless the law to which we are subject requires otherwise; in that case we will tell you before processing, unless the law prohibits it on important grounds of public interest.
5.2 Your documented instructions are the Terms, this DPA, your configuration and settings in the App, and other written instructions you give us that are consistent with the Terms. They include processing for the features your plan and settings include: answering Shoppers; need diagnosis and product recommendations; product cards with live prices and stock; cart actions on request; offers and discount codes under your Owner Rules; order status for logged-in Shoppers who ask; the leave-a-message form; human hand-off; conversation review, knowledge gaps and analytics; Store Manager reports from order, return, fulfilment and inventory data without customer identity fields; owner emails; and measurement with an attribution identifier where the Shopper's analytics consent is signalled.
5.3 We will inform you immediately if, in our opinion, an instruction infringes Data Protection Laws.
6. No training; the Improvement Program#
6.1 We do not use Merchant Personal Data, or any data received from Shopify (including anonymised, aggregated or derived forms), to create, develop, train, fine-tune or improve any machine learning or AI system, and our contracts with AI providers prohibit them from doing so.
6.2 If you join the optional Improvement Program described in Section 11.3 of the Terms, you instruct us to de-identify data from your store before anything is stored for the Program: Shopper personal data, numbers, email addresses, links, order and tracking numbers, discount codes and store-identifying terms are removed, and any record that cannot be cleaned is dropped. The de-identified output is held in a separate store keyed by a pseudonym, used only in aggregates that include at least 5 stores, and never used to train, fine-tune or evaluate an AI model. For that output GIXODIA is the controller. You may withdraw in the App at any time; we then stop collection immediately and delete your store's Program records.
7. Confidentiality#
We ensure that every person we authorise to process Merchant Personal Data is bound by a duty of confidentiality, contractual or statutory, and accesses it only as needed to provide, secure and support the Service.
8. Security#
8.1 We implement and maintain the technical and organisational measures in Annex II, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to individuals, as required by Article 32 GDPR, the Privacy Protection (Data Security) Regulations and the PDPL.
8.2 We may update these measures, provided the overall level of protection does not decrease.
9. Sub-processors#
9.1 General authorisation. You give us general written authorisation to engage Sub-processors. The current Sub-processors are listed in Annex III and on our Sub-processors page.
9.2 Notice. We will give at least 30 days' notice before a new Sub-processor starts processing Merchant Personal Data, by updating the Sub-processors page and notifying you by email and in the App. In an emergency that threatens the continuity or security of the Service, we may engage a replacement sooner and will notify you as soon as possible.
9.3 Objection. You may object on reasonable data protection grounds within the notice period by writing to tycoonagent6@gmail.com. We will discuss your concerns in good faith and, where possible, offer an alternative. If we cannot resolve the objection, you may terminate the Terms by uninstalling the App before the change takes effect, and we will refund through Shopify any prepaid fees for the period after termination.
9.4 Flow-down and responsibility. We impose on each Sub-processor, by written contract, data protection obligations that provide at least the same level of protection as this DPA. We remain fully liable to you for each Sub-processor's performance of those obligations.
10. International transfers#
10.1 Locations. GIXODIA is established in the United Arab Emirates. Merchant Personal Data is processed in the United Arab Emirates and in the locations listed in Annex III.
10.2 From the EEA. The United Arab Emirates does not have an adequacy decision from the European Commission. To the extent Merchant Personal Data subject to the GDPR is transferred to GIXODIA, or onward to a Sub-processor, the SCCs are incorporated into this DPA by reference: Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor, with the elections in Annex IV. The parties' acceptance of this DPA is acceptance of the SCCs.
10.3 From the UK. For restricted transfers under the UK GDPR, the UK Addendum applies, read with the SCCs as elected in Annex IV.
10.4 From Switzerland. For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with the Swiss adjustments in Annex IV.
10.5 Onward transfers. Where a Sub-processor processes Merchant Personal Data in a country without an adequacy finding, we rely on the SCCs (Module 3), the UK Addendum where relevant, or the Sub-processor's certification under the EU-U.S. Data Privacy Framework and its UK Extension, together with any supplementary measures needed, such as encryption and data minimisation.
10.6 From Israel. Transfers of Merchant Personal Data from Israel are made in line with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, including our written undertaking in this DPA to protect the data, to use it only for the purposes in Annex I and not to transfer it onward except under equivalent terms.
10.7 From the UAE. Transfers of Merchant Personal Data outside the United Arab Emirates are made to countries with an adequate level of protection or under the binding contractual safeguards in this DPA and in our contracts with Sub-processors, as the PDPL permits.
10.8 Government access. If we receive a request from a public authority for Merchant Personal Data, we will notify you unless the law prohibits it, challenge requests we consider unlawful, and disclose only the minimum required.
11. Assistance with data subject requests#
11.1 Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures in responding to requests from individuals exercising their rights.
11.2 Shopify privacy webhooks. We process Shopify's mandatory privacy requests as follows:
- (a) Customer data request (customers/data_request): we identify conversations held while the customer was logged in, using a keyed one-way code derived from the Shopify customer ID, and conversations linked to the orders named in the request through the attribution identifier, and make a machine-readable JSON export available to you in the App for 45 days.
- (b) Customer redaction (customers/redact): using the same matching, we delete the linked conversations, messages, leave-a-message submissions, events, hand-off records, chat memory, AI call records, usage counters and order attribution records.
- (c) Shop redaction (shop/redact): see Section 14.
11.3 Limits and manual requests. Because we do not receive Shoppers' names, emails or phone numbers from Shopify, a chat held while a Shopper was not logged in and never linked to an order cannot be matched automatically. You can search your store's conversations in the App by date, conversation ID or text, and export or delete the results. We will help with any such request you send us.
11.4 Requests sent to us. If a Shopper contacts us directly about Merchant Personal Data, we will forward the request to you without undue delay and will not respond ourselves except to confirm that it was forwarded, unless you instruct us or the law requires otherwise.
12. Personal data breaches#
12.1 We will notify you without undue delay after becoming aware of a personal data breach affecting Merchant Personal Data, and we aim to do so within 48 hours.
12.2 The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the contact point for more information, the likely consequences, and the measures taken or proposed. We will provide further information in phases as it becomes available.
12.3 We will take reasonable steps to contain, investigate and remedy the breach, help you meet your obligations to notify supervisory authorities and individuals, and notify Shopify where its terms require. Our notice is not an admission of fault or liability.
13. Assistance with compliance#
We will give reasonable assistance, taking into account the nature of the processing and the information available to us, with your obligations on security, breach notification, data protection impact assessments and prior consultation, including information about how the AI features work that you reasonably need for those assessments.
14. Deletion and return#
14.1 During the Terms. You can export conversations from the App and delete conversations, including chat memory and knowledge-gap records. Retention in Annex I applies automatically.
14.2 On uninstall. When you uninstall the App we stop processing Merchant Personal Data except to complete deletion. Shopify sends a shop redaction request 48 hours after uninstall, and we delete all Merchant Personal Data within 24 hours after receiving it. If the request does not arrive, we delete it 7 days after uninstall, and in every case within 30 days, unless you reinstall first or the law requires us to keep it. Returning data means making the export in Section 14.1 available before you uninstall.
14.3 Backups and provider copies. We do not keep separate backups. Our database provider's point-in-time recovery history expires within 30 days; if we restore from it, we repeat every deletion recorded after the restore point using a deletion log that contains only identifiers, never message text or contact details, and is itself deleted after 60 days. Copies held by AI providers expire under the periods in Annex III.
14.4 Data in your store. Data the Service wrote into your Shopify store, such as cart attributes saved on orders, is held in your store and controlled by you.
15. Audits and information#
15.1 We will make available to you the information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR, including, once a year on request, a written summary of our security measures and our answers to a reasonable security or privacy questionnaire.
15.2 If that information is not sufficient, or a supervisory authority requires it, you may carry out an audit, yourself or through an independent auditor bound by confidentiality, on at least 30 days' written notice, during business hours in the Dubai time zone, no more than once in any 12 months (unless after a personal data breach or at a supervisory authority's request), remotely where possible, and without access to other customers' data or to information that would compromise security. Each party bears its own costs, unless the audit reveals a material breach of this DPA by us.
16. California and other US state laws#
16.1 Where the CCPA applies, GIXODIA is your service provider. We process Merchant Personal Data only for the limited and specified business purposes in Annex I, which you disclose to us for those purposes. We will not: (a) sell or share it; (b) retain, use or disclose it for any purpose other than those business purposes, including any commercial purpose, or outside the direct business relationship between you and us; or (c) combine it with personal information we receive from or on behalf of others, or collect from our own interactions with consumers, except as the CCPA and its regulations allow.
16.2 We will comply with the CCPA, provide the same level of privacy protection the CCPA requires of you, notify you if we can no longer meet our obligations, and allow you to take reasonable and appropriate steps to ensure we use the data consistently with your obligations and to stop and remediate unauthorised use. We certify that we understand and will comply with these restrictions.
16.3 For other US state laws based on the controller and processor model, this DPA provides the required processor terms, including confidentiality (Section 7), deletion or return (Section 14), information and assessments (Section 15) and Sub-processor contracts with an opportunity to object (Section 9).
17. Israel#
Where the PPL applies, you are the controller of the database and GIXODIA is the holder that processes it on your behalf. We: (a) process Merchant Personal Data only for the purposes in Annex I; (b) apply the measures required by the Privacy Protection (Data Security) Regulations at the security level that applies to the database under those regulations (basic, medium or high), as you inform us; unless you inform us that the high level applies, we apply at least the measures of the medium level; (c) bind our staff and Sub-processors to confidentiality and security duties; (d) report security incidents under Section 12; (e) return or delete the data under Section 14; and (f) report to you once a year, on request, on how we meet these obligations.
18. United Arab Emirates#
Where the PDPL applies, GIXODIA acts as processor and: processes Merchant Personal Data only on your instructions and for the agreed purposes and period; applies appropriate technical and organisational measures; keeps a record of processing carried out on your behalf; notifies you of breaches under Section 12 so that you can notify the UAE Data Office and individuals where required; deletes the data at the end of processing under Section 14; and transfers data outside the UAE only as set out in Section 10.7.
19. Other jurisdictions#
Where another Data Protection Law requires specific processor terms, the terms of this DPA apply as the closest equivalent, and we will agree in good faith to any additional terms that law requires.
20. Liability#
Each party's liability under this DPA is subject to the limitations and exclusions in the Terms. Nothing in this DPA limits either party's liability to data subjects, or under the SCCs, where Data Protection Laws or the SCCs do not allow it to be limited.
21. Term, changes and governing law#
21.1 This DPA lasts as long as we process Merchant Personal Data for you and survives termination of the Terms until deletion under Section 14 is complete.
21.2 We may update this DPA to reflect changes in law, guidance from supervisory authorities, Shopify's requirements or the Service, with at least 30 days' notice of material changes as set out in the Terms. An update will not reduce the overall level of protection for Merchant Personal Data without your agreement, unless the law requires it.
21.3 This DPA is governed by the law and dispute-resolution terms of the Terms, except that the SCCs are governed by the law and courts elected in Annex IV, and mandatory provisions of Data Protection Laws apply. Data subjects' rights to bring claims in their place of habitual residence are not affected.
Annex I: Parties and details of processing#
A. Parties#
| Data exporter | Data importer | |
|---|---|---|
| Name | The Merchant, as identified by its Shopify store and account | GIXODIA L.L.C-FZ (brand: Tycoon Agent) |
| Address | As in the Merchant's Shopify account | Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. |
| Contact | The store owner's email in the Shopify account or the App | tycoonagent6@gmail.com |
| Activities | Operating an online store on Shopify | Providing the Tycoon AI sales associate and dashboard |
| Role | Controller (or processor for its own controller) | Processor (or sub-processor) |
| Signature and date | Acceptance in the App, recorded with date and time | Acceptance of this DPA by publication and the Merchant's recorded acceptance |
B. Description of processing#
| Item | Description |
|---|---|
| Subject matter | Provision of the Tycoon AI sales associate and dashboard to the Merchant's Shopify store |
| Duration | The term of the Terms plus the deletion period in Section 14 |
| Nature | Collection through the storefront chat, storage, retrieval, structuring, use to generate answers, transmission to Sub-processors, analysis for the Merchant's dashboard, export and deletion |
| Purposes | Answering Shoppers and recommending products; product cards with live prices and stock; cart actions on request; offers under Owner Rules; order status for logged-in Shoppers who ask; leave-a-message and human hand-off; conversation review, knowledge gaps and analytics for the Merchant; Store Manager reports; measurement with consent; security, abuse prevention and rate limiting; support |
| Data subjects | Shoppers and visitors who use or see the Agent; the Merchant's customers whose order data (without identity fields) is in Store Data; the Merchant's staff who test the Agent |
| Personal data | Chat messages and transcripts, including anything a Shopper chooses to type; leave-a-message submissions (name, email or phone number and message, and an order number if typed); knowledge-gap questions; random session identifiers and session tokens; cart contents (variant IDs and quantities), page type and path; store language, country and currency; attribution identifier (with analytics consent); salted hashes of IP addresses for rate limiting (raw IP addresses are not stored); for logged-in Shoppers who ask about orders, the Shopify customer ID (in memory only) and their order status, items and tracking (shown, not stored); hashed order identifiers, totals, order lines, returns and fulfilment timing without customer identity fields |
| Not collected | Shoppers' names, email addresses, phone numbers and postal addresses from Shopify; payment card data (card numbers detected in messages are removed) |
| Special categories | Not intended. Shoppers are not asked for sensitive data; anything a Shopper volunteers is processed only within the conversation and deleted on the normal schedule |
| Frequency | Continuous while the App is installed |
| Retention | Chat text, leave-a-message submissions and knowledge-gap questions: the plan's transcript period (Free 7 days, Starter 30 days, Growth 90 days, Tycoon 365 days, Empire as agreed, by default 365 days). Chat memory: the plan's transcript period, at most 90 days. Events without text: 120 days. Hashed order and attribution records: up to 400 days. Order lines, returns and fulfilments: 120 days. Rate-limit counters: 35 days. Customer data request exports: 45 days. Everything: deleted on shop redaction under Section 14 |
| Sub-processors | As listed in Annex III |
Annex II: Technical and organisational measures#
- Encryption in transit. All traffic to and from the Service uses TLS (HTTPS); internal calls between our services are authenticated.
- Encryption at rest. Our hosting provider encrypts stored data at rest. In addition, Shopify access and refresh tokens are encrypted with envelope encryption: each token is sealed with its own AES-256-GCM data key bound to the store and field, and that data key is wrapped by a key-encryption key with AES-256-GCM. Storefront tokens are sealed per store. Plaintext tokens exist only in memory.
- Key management and rotation. Secrets are held in Cloudflare's Secrets Store or as write-only Worker secrets, never in source code, CI or on disk. Symmetric keys use two slots for rotation without downtime, carry a key identifier, are rotated on a fixed schedule of 6 to 12 months and immediately on suspected compromise, and token data keys are re-wrapped automatically after rotation. Shopify access tokens expire after 1 hour and refresh tokens rotate on every use.
- Store isolation. Every record is keyed by store. The store's identity is taken only from a verified Shopify App Proxy signature, session token or webhook HMAC, never from the request body; for privacy and uninstall webhooks the signed body must name the same store as the header.
- Access control. Merchant access is through Shopify authentication or the standalone dashboard login with optional two-factor authentication. Our internal operations tools sit behind Cloudflare Access with single sign-on or one-time PIN, and the application verifies the Access token and an allow-list of staff emails itself. Internal operations views show counts and store-level information, never Shopper chat text. Comparisons of secrets are constant-time.
- Audit logs. Security-relevant events (privacy webhooks, deletions, alerts, key rotations) are recorded; Cloudflare account audit logs record who changed secrets or deployed code.
- Redaction and minimisation. Every application log line passes through an automatic redaction filter that removes keys, tokens and credentials. Logs record route or job, error type, store domain and counts, not message text. The AI provider receives no IP addresses, Shopify customer IDs or tracking details. Card numbers are removed from messages where detected.
- Abuse prevention. Rate limits apply per session, per address (salted hash) and per store, with caps on conversations and hand-offs, and the demo form is protected by Cloudflare Turnstile.
- Guarded AI output. Every AI draft passes automated guards before it is shown; prices, stock and codes are read live; no answer is streamed.
- Testing. Guards and the Improvement Program de-identification are tested against red-team corpora (including attempts in several languages to extract personal data), with zero accepted escapes as a release condition; security red-team reviews and threat modelling are documented and repeated after significant changes.
- Secure development. Dependency vulnerability checks block high-severity issues in the build pipeline; repositories are scanned for leaked secrets.
- Retention and deletion. Automatic daily retention jobs apply the periods in Annex I; deletions are logged by identifier so that they can be repeated after any database restore.
- Incident response. A documented procedure covers alerts, containment, key rotation, investigation, notification of merchants and Shopify, and a written record of each incident.
- Personnel. Access to production systems and to Merchant Personal Data is limited to authorised personnel bound by confidentiality, on a need-to-know basis.
Annex III: Sub-processors#
| Sub-processor | Service | Personal data | Location | Transfer safeguard | Provider retention |
|---|---|---|---|---|---|
| Cloudflare, Inc. (United States) | Hosting and edge computing (Workers), database (D1), key-value storage (KV), object storage (R2), queues, Secrets Store, logs, Access, owner email sending, Turnstile | All Merchant Personal Data stored by the Service | United States and Cloudflare's global network | Cloudflare's data processing addendum with SCCs and UK Addendum; EU-U.S. Data Privacy Framework certification | Stored data: as we instruct and as set out in Annex I; logs: Cloudflare's log retention settings, containing no message text |
| Anthropic, PBC (United States) | AI model that writes the Agent's answers | Conversation content and context sent for each turn | United States | Anthropic's commercial terms and data processing addendum with SCCs; no training on customer content | Inputs and outputs deleted within 30 days; content flagged for a usage-policy breach may be kept up to 2 years |
| Google LLC (United States), only if we switch on the Gemini fallback | Back-up AI model used only when the primary provider is unavailable; switched off by default | Same as Anthropic, when used | United States and Google's facilities | Google's Gemini API paid-service terms and data processing terms with SCCs; no use of prompts or responses to improve Google's products | Logged for a limited period for abuse monitoring under Google's terms |
We will give 30 days' notice under Section 9 before switching on any provider that is not listed above.
Annex IV: SCC and UK Addendum elections#
| Item | Election |
|---|---|
| Modules | Module 2 where the Merchant is a controller; Module 3 where the Merchant is a processor |
| Clause 7 (docking clause) | Included |
| Clause 9(a) (sub-processors) | Option 2, general written authorisation, with 30 days' notice as in Section 9 |
| Clause 11(a) (redress) | Optional language not included |
| Clause 13 (supervision) | The supervisory authority determined under Clause 13(a) by the Merchant's establishment or, if none in the EU, by its Article 27 representative or, failing that, where the data subjects are |
| Clause 17 (governing law) | The law of Ireland |
| Clause 18 (forum) | The courts of Ireland |
| Annex I.A and I.B | Annex I of this DPA |
| Annex II | Annex II of this DPA |
| Annex III | Annex III of this DPA |
| UK Addendum | Table 1: the parties in Annex I.A; Table 2: the SCCs with the modules and elections above; Table 3: Annexes I to III of this DPA; Table 4: both the importer and the exporter may end the UK Addendum as set out in its Section 19 |
| Switzerland | References to the GDPR are read as references to the Swiss Federal Act on Data Protection; the Federal Data Protection and Information Commissioner is the competent authority for Swiss transfers; "Member State" includes Switzerland so that data subjects there may sue in their place of habitual residence |
Contact and operator#
GIXODIA L.L.C-FZ (جيكسوديا ش.ذ.م.م-منطقة حرة), Limited Liability Company, Meydan Free Zone, Dubai, United Arab Emirates Formation number 2644769 · Business licence number 2644769.01 Registered address: Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. Privacy and data protection contact: tycoonagent6@gmail.com
Tycoon Agent is a brand of GIXODIA L.L.C-FZ.
Version history
No earlier versions yet. When a version is replaced, it is kept at /legal/archive/ and linked here.