Contents
1. Who we are and what this page covers#
1.1 Tycoon Agent is a brand of GIXODIA L.L.C-FZ, Meydan Free Zone, Dubai, United Arab Emirates (formation no. 2644769), Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
1.2 This page lists the companies we engage to process personal information for which we are a processor under our Data Processing Addendum, mainly shoppers' chats on merchants' stores. The same companies also process personal information for which we are the controller, such as website leads and merchant accounts, as described in our Privacy Policy. This page is the public version of Annex III of the Data Processing Addendum.
2. Definitions#
- Sub-processor: a third party we engage to process personal information on our behalf, under a written contract and our instructions.
- Merchant personal data: personal information in store data and chat data that we process for a merchant.
- SCCs: the Standard Contractual Clauses adopted by the European Commission for transfers of personal data to countries outside the EEA (Commission Implementing Decision (EU) 2021/914).
- DPF: the EU-U.S. Data Privacy Framework, with its UK Extension and the Swiss-U.S. Data Privacy Framework.
3. Current sub-processors#
| Sub-processor | Purpose | Personal data | Location | Transfer safeguard | Status |
|---|---|---|---|---|---|
| Cloudflare, Inc. (United States) | Hosting and edge computing (Workers), databases (D1), key-value storage (KV), object storage (R2), queues, secrets storage, logs, access control for our staff tools, sending emails to merchants, bot checks (Turnstile) | All merchant personal data stored by the service, website leads and merchant account data. Logs contain no chat text, shopper identifiers or IP addresses | United States and Cloudflare's global network | Cloudflare's data processing addendum with SCCs and the UK Addendum; DPF certification | Active |
| Anthropic, PBC (United States) | The AI model that writes the assistant's answers, and the agent in the personal demo | The conversation text and the store context sent for each turn. Never the name, email or phone from the leave-a-message form or the demo form | United States | Anthropic's commercial terms and data processing addendum with SCCs; contractually no training on our content | Active. Deletes inputs and outputs within 30 days; content flagged by its safety systems may be kept up to 2 years |
| Google LLC (United States) | Backup AI model (Gemini), used only when the primary provider is unavailable | The same as Anthropic, only when used | United States and Google's facilities | Google's Gemini API paid-service terms and data processing terms with SCCs; prompts and responses not used to improve Google's products | Switched off. Processes nothing unless we switch it on |
4. Not sub-processors#
4.1 Shopify. Tycoon is a Shopify app. Shopify provides store data to us through its APIs, holds the cart attributes the assistant adds, and bills merchants. Shopify acts under its own agreement with each merchant and its own privacy policy, not as our sub-processor.
4.2 The merchant's own tools. When a shopper chooses to contact a store through WhatsApp, email, phone or the store's help desk, that contact goes directly to the store's chosen service, not through a sub-processor of ours.
4.3 Professional advisers and authorities that receive information only where the law requires it are not sub-processors.
5. How we choose and control sub-processors#
5.1 We engage a sub-processor only under a written contract that gives at least the same protection as our Data Processing Addendum, including confidentiality, security, deletion, help with rights requests and breach notice.
5.2 We send each sub-processor only the data it needs. For example, the AI model receives the text of a conversation and the store information needed to answer, never the shopper's contact details from the leave-a-message form.
5.3 We remain responsible to merchants for our sub-processors' performance.
6. Changes and the right to object#
6.1 Notice. We give at least 30 days' notice before a new sub-processor starts processing merchant personal data, including before we switch on a listed backup such as Google. We do this by updating this page and by notifying merchants by email and in the Tycoon app.
6.2 Emergencies. If a sub-processor's failure threatens the continuity or security of the service, we may engage a replacement sooner and will notify merchants as soon as possible.
6.3 Objection. A merchant may object on reasonable data protection grounds during the notice period by writing to tycoonagent6@gmail.com. We will discuss the concern in good faith and, where possible, offer an alternative. If we cannot resolve it, the merchant may end the service by uninstalling the app before the change takes effect, as described in the Data Processing Addendum.
6.4 History. Each update to this page carries a new version number and date.
7. Contact#
GIXODIA L.L.C-FZ (Tycoon Agent), Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. Email: tycoonagent6@gmail.com.
A Hebrew version of this page is available at tycoonagent.ai/he/subprocessors. If the versions differ, the English version governs, unless the law that applies to you requires otherwise.
Version history
No earlier versions yet. When a version is replaced, it is kept at /legal/archive/ and linked here.