Data Processing Agreement

Capitalized terms used in this Data Processing Agreement (“DPA”) have the meanings given in the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and equivalent terms in the UK GDPR and California Consumer Privacy Act, including: “Personal Data,” “Processing,” “Controller,” “Processor,” “Sub-processor,” “Data Subject,” “Supervisory Authority,” and “Personal Data Breach.”

“Antigency,” “we,” and “us” refer to Antigency Inc.. “Customer,” “you,” and “your” refer to the merchant who has agreed to the Antigency Terms of Service.

Antigency Processes Personal Data on behalf of Customer in connection with providing the Antigency service.

The duration of Processing is the term of Customer’s subscription. Personal Data is deleted when the app is uninstalled (through Shopify’s app-uninstall / redact webhooks) or upon Customer’s deletion request, in accordance with the Privacy Policy.

The nature and purpose of Processing are described in the Privacy Policy at /legal/privacy. Processing is bound by the Terms of Service at /legal/terms.

Types of Personal Data: (a) end-customer records read from Customer’s Shopify store — the Shopify customer id, order count, total amount spent, and created and last-updated dates; (b) order records read from Customer’s Shopify store — order number, totals, dates, line items (variant id, quantity, unit price), the order’s customer id, and order attribution attributes. Attribution attributes can contain advertising click and cookie identifiers (such as gclid, fbclid, fbc, fbp) and UTM parameters; where a tracking app writes an email address, IP address, or browser user agent there, Antigency discards it in memory and does not store it; (c) identifiers received through Shopify’s mandatory privacy webhooks — customer id, email address, and phone number — held encrypted only while the request is processed, deleted when it completes, and in any event within about 72 hours; a keyed, non-reversible hash of them is kept as the compliance record that the request was honoured; (d) end-customer free text from tools Customer connects — product review text (Judge.me) and email reply text (Klaviyo); reviewer names are not collected, and email addresses and phone numbers are removed from replies before storage; (e) other data from integrations Customer authorises — Google Analytics 4, Google Search Console, Google Ads, Klaviyo, Meta Ads, and Google Merchant Center — read as traffic, query, campaign, flow, list, and feed data; (f) Customer’s team members’ names and email addresses and, where Customer uses Slack, their Slack identifiers and the messages they send Antigency there. Antigency does not request end-customer name, postal address, email, or phone fields from Shopify’s customer APIs.

Retention: the records in (a), (b), (d), (e), and (f) are kept for the term of the subscription and deleted on uninstall or request as described in Sections 2 and 13, subject to the backup, audit-log, and Slack terms in the Privacy Policy. The identifiers in (c) are deleted when the request completes, and in any event within about 72 hours; the keyed hash in (c) is kept as the compliance record.

Categories of Data Subjects: Customer’s end customers (including people who review Customer’s products or reply to Customer’s emails, where Customer connects those tools); Customer’s team members.

For Personal Data relating to Customer’s end customers, Customer is the Controller and Antigency is the Processor.

Customer is responsible for ensuring there is a lawful basis for Processing under applicable data protection law.

Antigency Processes Personal Data only on Customer’s documented instructions, including as documented in the Terms of Service, the Privacy Policy, and the configuration choices Customer makes in the dashboard.

Customer authorizes Antigency to engage the following sub-processors:

• Vercel — hosting and serverless compute
• Supabase — database, authentication, and file storage
• Fly.io — hosting for the per-merchant agent containers
• Stripe — payment processing and subscription billing
• Inngest — background job orchestration
• Shopify — commerce platform integration and merchant billing
• Resend — transactional email delivery
• Upstash — rate limiting and caching
• Sentry — error monitoring and session replay for the dashboard — United States
• Third-party AI model providers — large language model inference used to analyse the data Customer connects and to draft content. Antigency selects these providers and may change them as the service evolves.

Antigency maintains a current list of sub-processors — grouped by category, with their purpose and processing locations — at /legal/sub-processors, and updates it before a new sub-processor processes Customer Personal Data. Customer may object to a new sub-processor on reasonable grounds. Where Antigency cannot accommodate an objection, Customer’s remedy is to stop using the affected feature or to terminate this Agreement.

Antigency remains liable to Customer for the acts and omissions of its sub-processors with respect to the Processing of Personal Data.

Recipients. Antigency also shares Personal Data with the following recipient that is not a sub-processor:

• Slack — Slack Connect messaging: delivering briefs, findings, decision summaries, approval prompts, and chart images to private channels in Antigency’s Slack workspace, and receiving Customer’s team messages and approval actions there

Slack is a recipient of this messaging, not a sub-processor, and is not engaged under a processor agreement.

Antigency implements appropriate technical and organizational measures, including:

• Row-level security enforcing tenant isolation in the application database
• Encryption of stored credentials with AES-256-GCM
• TLS in transit for all client and inter-service traffic
• Role-based access controls for staff
• Audit logging of administrative actions and agent runs
• Deployment-safety controls preventing accidental data exposure
• Principle of least privilege for staff access

Antigency is working toward SOC 2 Type II readiness; status will be published as it becomes available.

Antigency assists Customer in responding to Data Subject requests for access, rectification, erasure, portability, restriction, and objection.

Direct Data Subject requests received by Antigency are forwarded to Customer within 5 business days, except where applicable law requires Antigency to respond directly.

Antigency notifies Customer without undue delay, and in any event within 72 hours after becoming aware of a confirmed Personal Data Breach. Notification includes: the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed to address the breach.

Antigency provides reasonable assistance to Customer with Data Protection Impact Assessments and prior consultations with Supervisory Authorities, where required by Articles 35 and 36 GDPR or equivalent provisions.

Antigency’s primary infrastructure is located in the United States. For Personal Data originating in the European Economic Area, the United Kingdom, or Switzerland, Antigency relies on the European Commission’s Standard Contractual Clauses (Module 2, Controller-to-Processor) and the UK International Data Transfer Addendum, attached as Annex A to this DPA and incorporated by reference.

Where additional safeguards are required by law, Antigency implements supplementary measures such as encryption in transit and at rest, access controls, and contractual restrictions on government access requests.

Customer may audit Antigency’s compliance with this DPA no more than once per twelve-month period, with at least 30 days’ written notice, during normal business hours, and subject to reasonable confidentiality obligations.

Antigency’s most recent third-party audit report (such as a SOC 2 report, when available) satisfies this audit right unless Customer reasonably requires additional information.

In the event of a confirmed Personal Data Breach affecting Customer’s data, the notice period may be reduced.

This DPA terminates simultaneously with the underlying Terms of Service.

On termination, Antigency returns or deletes all Personal Data — through the app-uninstall / redact process or upon Customer’s request — within 90 days of the termination request, in accordance with the Privacy Policy, except for backups, which are handled as described in the Privacy Policy, and except where applicable law requires longer retention.

Messages already delivered to Slack remain there until Customer or we delete them.

Liability under this DPA is governed by the limitations and exclusions in Section 10 of the Terms of Service, except where applicable data protection law (including Article 82 GDPR) provides for joint and several liability of Controllers and Processors, in which case those statutory provisions apply.

This DPA takes effect on the start date of Customer’s subscription and is incorporated by reference into the Terms of Service. A standalone signed version is available on request for enterprise customers; contact us via the address listed in the Privacy Policy.

The Standard Contractual Clauses (Module 2: Controller-to-Processor) adopted by the European Commission in Implementing Decision (EU) 2021/914, and the UK International Data Transfer Addendum issued by the Information Commissioner’s Office, are incorporated into this DPA by reference. The current text of those clauses is published by the European Commission and the ICO respectively, and a copy will be provided on request.

For purposes of the Standard Contractual Clauses:

• Data exporter: Customer (Controller).
• Data importer: Antigency (Processor).
• Governing law: Republic of Ireland.
• Competent supervisory authority: the supervisory authority of the EU member state where the data exporter is established.