Data Processing Agreement

Last updated: October 23, 2026

1. Parties and Scope

This Data Processing Agreement ("DPA") is between Laurence Welch, doing business as The Social Tools, of 3665 Hughes Ave, Los Angeles, California 90034, United States ("The Social Tools," "we," or "us") and the customer that accepts our Terms of Service or installs our Shopify app, Social Tools: Ad Comments ("you"). It forms part of the Terms of Service and needs no separate signature.

It applies whenever we process Customer Personal Data on your behalf under Data Protection Law. If this DPA and the Terms of Service conflict on the protection of personal data, this DPA wins. If the Standard Contractual Clauses apply and conflict with either, the Standard Contractual Clauses win.

2. Definitions

"Customer Personal Data" means personal data we process on your behalf in providing the Service, as described in Annex 1.

"Data Protection Law" means every data protection and privacy law that applies to that processing, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended by the California Privacy Rights Act.

"Subprocessor" means a third party we engage that processes Customer Personal Data.

"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

"Standard Contractual Clauses" means the clauses adopted by European Commission Implementing Decision (EU) 2021/914.

"Controller", "processor", "data subject" and "processing" have the meanings given in the GDPR. Other capitalised terms have the meanings given in the Terms of Service or our Privacy Policy.

3. Roles and Instructions

• You are the controller of Customer Personal Data, or a processor acting for your own controller. We are your processor, or your subprocessor.
• We process Customer Personal Data only on your documented instructions. Those instructions are the Terms of Service, this DPA, and the way you set up the Service: your workflows, links, Connected Accounts and Connected Store. We will tell you if we believe an instruction breaks Data Protection Law.
• You are responsible for having a lawful basis for the processing and for the notices you give the people the data is about, such as your store's customers and the people who comment on your accounts.
• Under the CCPA we act as your service provider. We do not sell or share Customer Personal Data; we do not keep, use or disclose it for any purpose other than providing the Service to you, or outside our direct business relationship with you; and we do not combine it with personal data from other sources except as the CCPA permits.

4. Our Personnel

Only people who need access to provide or support the Service can reach Customer Personal Data, and each of them is bound by a duty of confidentiality.

5. Security

We keep the technical and organisational measures in Annex 2 in place for as long as we process Customer Personal Data. We may change them, but never in a way that lowers the overall protection.

6. Subprocessors

• You authorise us to use the Subprocessors listed in Annex 3.
• We will tell you at least two days before we add or replace a Subprocessor, by email to your account's address and by updating Annex 3. You may object on reasonable data protection grounds within that time. If we cannot resolve the objection, you may stop using the affected part of the Service or end your use of the Service.
• Each Subprocessor is bound by data protection terms that protect Customer Personal Data at least as well as this DPA. We remain responsible to you for their work.

7. Requests from Data Subjects

• The Service lets you find and delete the comments, messages and other records it holds. Where you cannot do something yourself, we will help you answer a request from a data subject.
• If a data subject contacts us directly about Customer Personal Data, we will pass the request to you and will not answer it ourselves unless you ask us to or the law requires it.
• For a Connected Store, Shopify forwards its customers' requests to us. When Shopify forwards a request for a customer's data, we give the store the records we hold for the orders it lists. When Shopify forwards a deletion request, we delete those records within 30 days.

8. Security Incidents

We will notify you without undue delay, and in any event within 72 hours, after we become aware of a Security Incident affecting your Customer Personal Data. We will tell you what happened, what data and which people are affected, and what we are doing about it, giving further details as we learn them. We will take reasonable steps to contain the incident and reduce its effects. Our notice is not an admission of fault.

9. Assistance

Taking into account the nature of the processing and the information available to us, we will give you reasonable help with data protection impact assessments and with consultations with supervisory authorities that concern the Service.

10. Deletion and Return

• Deleting your account or a workspace deletes its Customer Personal Data immediately.
• When you uninstall our Shopify app, we delete the store's access token immediately and stop processing its orders. We delete the store's order data when Shopify sends its store redaction request, 48 hours after the uninstall.
• When your use of the Service otherwise ends, we delete Customer Personal Data within 30 days. Before that, you may ask for a copy in a common machine-readable format.
• We keep data longer only where the law requires it. Any copy that remains in a backup stays isolated and is deleted when that backup expires.

11. Audits

We will make available the information you reasonably need to confirm that we meet this DPA. Once a year, we will answer a written security questionnaire. If that is not enough, or a supervisory authority requires it, you may carry out an audit, or have an independent auditor bound by confidentiality carry one out, on 30 days' notice, during business hours and at your own cost, no more than once a year unless a Security Incident has occurred.

12. International Transfers

We process Customer Personal Data in the United States. Where a transfer from the European Economic Area to us needs safeguards, the Standard Contractual Clauses apply and are incorporated into this DPA as follows:

• Module 2 (controller to processor) applies where you are a controller, and Module 3 (processor to processor) where you are a processor.
• Clause 7 (the docking clause) applies.
• Under Clause 9, option 2 (general written authorisation) applies, with the notice period in section 6.
• The optional wording in Clause 11 does not apply.
• Under Clause 17, option 1 applies: the clauses are governed by the law of Ireland. Under Clause 18, disputes go to the courts of Ireland.
• Annexes I and II of the clauses are completed by Annexes 1 and 2 of this DPA. The competent supervisory authority is the one determined under Clause 13.

For transfers from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner applies, completed with the information in this DPA. For transfers from Switzerland, the Standard Contractual Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the competent authority is the Federal Data Protection and Information Commissioner.

13. Liability and Term

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Law or the Standard Contractual Clauses do not allow it. This DPA lasts for as long as we process Customer Personal Data on your behalf.

Annex 1: Description of the Processing

A. Social media content

• Data subjects: people who comment on, message or otherwise interact with your Connected Accounts, and people who open your tracked links.
• Personal data: platform user ID, username or display name and profile image URL; comment and message text; post content and metadata; engagement counts; the sentiment, intent, topic and language labels we derive from the text. For tracked links: the time of the click, the visitor's country, a broad device class, and a keyed one-way hash of the IP address.
• Special categories: none are processed on purpose. Comment and message text may reveal them incidentally.
• Nature and purpose: ingesting comments and messages; labelling them; applying your workflows; replying, hiding, deleting or messaging on your instruction; AI reply drafts and automated AI replies where you set them up; your inbox and analytics; counting clicks on your tracked links.
• Frequency: continuous, while an account is connected.
• Retention: as set out in section 8 of our Privacy Policy.

B. Shopify order data

• Data subjects: customers who place paid orders in your Connected Store.
• Personal data read: order ID and number; order total, currency and creation time; the discount codes applied; Shopify's summary of the visits that led to the order (the last visit's source, referring URL and UTM parameters, and the first visit's UTM content). We do not read the customer's name, email address, postal address or phone number.
• Personal data kept: for every paid order, a lookup record of the order ID, number, total, currency and creation time. For an order a tracked link led to, also which evidence matched, the link, and the reply or message the link was sent in. The discount codes, the referrer and every UTM value other than our own link token are discarded.
• Nature and purpose: only to work out whether one of your tracked links led to an order, and to show you the result in Shopify admin, in our app, in your Shopify Flow workflows, and through any outgoing webhook you set up. Order data is never used for profiling, advertising, resale or AI model training, and is never sent to an AI model.
• Frequency: each time Shopify tells us an order has been paid.
• Retention: lookup records of orders no tracked link led to are deleted 30 days after the order. Records of attributed orders are kept while the store is connected, for at most 24 months. Uninstalling and redaction requests are handled as in sections 7 and 10.

Annex 2: Technical and Organisational Measures

• All data in transit is encrypted with HTTPS/TLS.
• Our production database is encrypted at rest.
• Social media and Shopify access tokens, and the signing secrets of your outgoing webhooks, are encrypted at rest with AES-256-GCM under a master key held outside the database.
• Every incoming Shopify webhook is verified by its HMAC signature before we read it.
• Every request from our app inside Shopify admin and from its extensions carries a Shopify session token, which we verify before answering.
• Every query for customer data is limited to the workspace it belongs to.
• Access to production systems is limited to the people who need it.
• API keys and secrets are never logged or stored in plain text. Server logs do not contain the content of comments or messages.
• AI request logs hold metadata only, not comment or reply text, and are deleted after 30 days.
• Tracked-link clicks store a keyed one-way hash of the visitor's IP address, never the address itself.
• No third-party scripts, cookies or browser storage are used in our app inside Shopify admin or in its extensions.
• Rate limiting protects the Service against abuse.
• Security Incidents are handled and reported as in section 8.

Annex 3: Subprocessors

• Railway — hosts our application servers and database. United States.
• Cloudflare — network and content delivery; runs our tracked-link redirects and click records, our website crawler and knowledge-base search index; routes every AI request through its AI Gateway; runs the translation model used for some automated replies. Global network.
• Anthropic — the AI models that write reply drafts and automated replies. Receives the comment or message text, the author's display name, the post caption and, for drafts, the author's recent messages. Never receives order data. United States.
• OpenAI — only for workspaces that chose a legacy OpenAI model before it was retired. United States.
• Microsoft — Clarity session recording in our web app, which can capture Customer Personal Data shown on screen. Not used in our app inside Shopify admin. United States.
• Browser push services (for example, Google, Mozilla or Apple) — deliver the web push notifications you turn on. Notifications are encrypted end to end.

Providers that handle only your own account, billing and support details, such as Clerk, Stripe, Loops and Tawk.to, are listed in section 7.1 of our Privacy Policy.

Contact

For questions about this DPA, or for a countersigned copy, contact us at [email protected].