OBSEDIA AI CHAT AGENT — MERCHANT DATA PROCESSING AGREEMENT
Version 1.0 | Dated: 3 November 2026
1. Parties, scope and effectiveness
This Data Processing Agreement (DPA) is between the merchant expressly accepting it (the Merchant) and Genius Nutrition S.R.L., trading as Obsedia (Obsedia), Business Logistic Center, Tamasi Street No. 20, Hall 6A, Buftea, Ilfov, 070000, Romania; registration J23/4568/2015; VAT RO35355847. Contact: agents@obsedia.ai.
This DPA forms part of the agreement governing Obsedia AI Chat Agent for Shopify (the Service). It applies to personal data that Obsedia processes on the Merchant's behalf through the enabled Service (Merchant Personal Data). The Merchant acts as controller and Obsedia as processor, or, where the Merchant is itself a processor acting for a controller, Obsedia acts as its subprocessor.
The DPA becomes effective when an authorized Merchant representative expressly accepts the identified version through an acceptance process linked to the full text, or when the parties otherwise agree to it in writing. The acceptance record identifies the Merchant's shop/installation, authorized representative reference, document version/digest and UTC acceptance time. Installation permissions and Shopify billing approval are separate from acceptance of this DPA.
Obsedia's separate controller processing for its own necessary account administration, business records and service security is described in the Privacy Policy and is not converted into instructed processor activity by this DPA.
2. Definitions and details of processing
Applicable Data Protection Law means the personal-data protection laws applicable to the processing, including the EU GDPR, UK GDPR and applicable US state privacy laws where relevant. Controller, processor, personal data, processing, data subject and personal-data breach have their meanings under that law.
The subject matter, nature, purpose, categories and duration of processing are set out in Annex A. The technical and organizational measures are in Annex B; the authorized provider schedule is in Annex C. The Merchant's documented instructions comprise this DPA, the enabled Service, approved content/configuration and subsequent verified written instructions consistent with the agreement.
3. Instructions and permitted use
Obsedia will process Merchant Personal Data only on the Merchant's documented instructions, including for international transfers, unless applicable law requires otherwise. In that case Obsedia will inform the Merchant of the legal requirement before processing unless the law prohibits doing so. Obsedia will promptly inform the Merchant if, in its opinion, an instruction infringes applicable data-protection law and may pause that instruction while the parties resolve it.
Obsedia will not sell Merchant Personal Data, share it for cross-context behavioral advertising, use it for independent advertising or cross-merchant profiling, or use it to train public general-purpose AI models. It will not retain, use or disclose it outside the permitted service relationship or combine it for independent purposes, except as permitted by applicable law and the documented instructions. Obsedia will inform the Merchant if it determines it can no longer meet an applicable processor/service-provider obligation and cooperate on appropriate corrective steps.
The Merchant determines the lawful purposes, provides required notices, obtains necessary permissions/consents, respects individuals' choices and ensures it may disclose the information to Obsedia. The Merchant must limit instructions and data to what the Service needs and verify authority for rights requests and customer disclosures.
4. Confidentiality and access
Obsedia will ensure that people authorized to process Merchant Personal Data are bound by confidentiality or an appropriate statutory duty and receive access only as necessary for their functions. Merchant data must remain isolated from unrelated merchants' data, with authorization enforced server-side.
Shopper identity must not be assumed from a name, email or order reference typed into chat. The merchant customer panel is limited to authorized merchant access and permitted Shopify information. Its profile/order results are not automatically added to AI input; existing chat and authorized order-support processing remain as described in Annex A.
5. Security
Obsedia will implement and maintain technical and organizational measures appropriate to the nature, scope, context, purposes and risks of processing, including the measures in Annex B. It will assess their effectiveness, address identified material weaknesses and maintain appropriate records. Measures may evolve provided the overall protection is not materially reduced below the obligations in this DPA.
The Merchant is responsible for its own access administration, devices, store settings, notices, source material and required actions within its control. Neither party may treat the other's responsibilities as replacing its own obligations under applicable law.
6. Subprocessors
The Merchant gives general written authorization for Obsedia to engage the subprocessors described in Annex C for their stated functions, including their disclosed authorized subprocessors under the applicable provider arrangements. Obsedia will impose data-protection obligations appropriate to the delegated processing and remains responsible to the Merchant for performance of the obligations it delegates, as required by applicable law.
Obsedia will provide at least 30 days' advance notice of a proposed new direct subprocessor or material replacement before allowing it to process Merchant Personal Data, allowing the Merchant to object on reasonable data-protection grounds. Where an urgent security or legal requirement reasonably prevents that notice period, Obsedia will notify the Merchant as soon as practicable and preserve an opportunity to object.
The Merchant may object by emailing agents@obsedia.ai during the notice period and explaining the data-protection concern. The parties will seek a reasonable solution, such as additional safeguards or an available alternative. If no solution permits lawful continuation, the Merchant may stop the affected processing or terminate the affected Service in accordance with the agreement. Provider changes do not authorize an unrelated processing purpose.
7. International transfers
Obsedia will ensure that a restricted international transfer has an applicable lawful transfer mechanism and any required supplementary safeguards. These may include an applicable adequacy decision, the relevant EU Standard Contractual Clauses and, for UK data where required, the UK addendum or another recognized mechanism.
The primary production hosting/database region does not guarantee that all inference, provider support or subprocessor processing occurs exclusively in that region. Obsedia will provide reasonably requested information about the relevant transfer arrangements. This DPA does not replace a transfer instrument that the law requires the relevant parties to conclude.
8. Assistance with rights and compliance
Taking account of the processing and available information, Obsedia will assist the Merchant with its obligations concerning data-subject rights, security, personal-data breaches, impact assessments and required regulatory consultation. Assistance includes available relevant records, proportionate technical measures and cooperation with verified instructions.
If Obsedia receives a request concerning Merchant-controlled data, it will, where legally permitted, refer or communicate it to the Merchant and will not independently disclose the Merchant's data without authorization or a legal obligation. The Merchant remains responsible for determining the request's validity and responding within applicable deadlines.
A request acknowledgment is not fulfillment. Unverified or mixed-account conversation history requires careful review to prevent disclosure of another person's information. Shopify privacy webhooks must be authenticated and handled idempotently, with incomplete deletion work continued until completed.
9. Incidents
Obsedia will notify the Merchant without undue delay after becoming aware of a personal-data breach affecting Merchant Personal Data. It will provide available information about the incident, affected categories, likely consequences, mitigation and a contact point, and provide further information as it becomes available.
Obsedia will investigate, take appropriate containment and remediation steps, preserve necessary evidence and assist with the Merchant's legally required notices. The Merchant remains responsible for notifications it must make as controller. Obsedia will meet its separate Shopify incident-reporting obligations, including the applicable 24-hour reporting requirement to Shopify. A notice is not an admission of fault or liability.
10. Information and audits
Obsedia will make available information reasonably necessary to demonstrate compliance with this DPA and will allow and contribute to proportionate audits or inspections by the Merchant or its mandated independent auditor where required by applicable law. The parties will agree practical arrangements protecting security, confidentiality and other merchants' data. Reasonable advance notice and business-hour scheduling apply where appropriate, but must not prevent a legally required or incident-related audit.
Existing reports or control evidence may be used where sufficient. No independent audit or certification is implied by this DPA. Each party will keep appropriate processing and compliance records within its responsibilities.
11. Duration, return and deletion
This DPA applies for the duration of relevant processing, including the necessary termination/deletion process. On termination or upon a valid instruction, Obsedia will, at the Merchant's choice and subject to applicable law, return or delete Merchant Personal Data and existing copies. Return must protect other individuals' data and use an appropriate structured, commonly used, machine-readable format where required.
Conversation messages ordinarily expire 90 days from their original timestamps; active AI session state has a separate 24-hour lifetime. Customer-panel profiles/order summaries are read on demand rather than copied into a permanent customer directory. Earlier valid deletion requirements override ordinary retention.
Native daily production backups rotate after six days, are encrypted and are restricted from ordinary processing. Deletion obligations must be reapplied before restored data returns to service. Where Shopify's API terms require deletion following uninstall, loss of necessity or an enforceable request, originals and copies must be deleted within the applicable 30-day period unless applicable law prohibits or varies that requirement. Backup rotation is not an exception to that deadline.
Records retained because the law requires them must be isolated, protected and used only for that obligation. Necessary restricted deletion/rights records may be kept to fulfill requests and prevent deleted data from being restored, subject to applicable law and minimization. Obsedia will communicate any legally required retention that prevents an otherwise applicable deletion instruction where permitted.
12. Priority and governing terms
This DPA prevails over conflicting agreement terms concerning Merchant Personal Data. Mandatory law and an applicable transfer instrument prevail where required. The commercial agreement's liability provisions apply only to the extent permitted by applicable data-protection law and do not restrict data-subject rights or a supervisory authority's powers.
This DPA does not change Shopify plan prices, usage measurement, allowances, billing approval or other accepted commercial terms. Romanian law and the agreement's jurisdiction provisions apply subject to mandatory requirements. Contact agents@obsedia.ai for instructions or questions.
ANNEX A — PROCESSING DESCRIPTION
Service and purpose: merchant-controlled, grounded storefront sales/support conversations; explicit product/cart actions; merchant inspection of retained conversations; verified customer/order context for authorized support; necessary account, security and rights-handling operations on the Merchant's behalf.
Nature of processing: collection, receipt, verification, organization, temporary storage, retrieval, transmission to necessary providers, AI inference for enabled functions, display to authorized users, restriction, return and deletion. Processing is ongoing while enabled and includes individual on-demand customer/order reads.
Data subjects: store shoppers and visitors, customers, authorized Merchant representatives and other individuals whose information is lawfully provided for the enabled Service.
Data categories: conversation messages/replies and original timestamps; language/locale; tenant, installation, session and conversation references; verified Shopify customer references; permitted name, email, phone and relevant address; relevant customer/order summaries, spending/currency and statuses; limited verification/order-support facts; and necessary agreement, rights and technical/security metadata.
AI scope: shopper messages, relevant approved content and limited authorized facts needed by existing order-support flows may be sent for inference. The merchant customer panel does not automatically send its profile or purchase-history results to the model.
Special categories: intentional processing of special-category data, criminal-record information, payment-card credentials or identity documents is not part of the ordinary instructed Service and requires separate written assessment and safeguards.
Duration: for the enabled Service and the limited purposes/periods in section 11. The Merchant may instruct earlier lawful deletion. Legally required separate records remain restricted to their applicable purpose.
ANNEX B — TECHNICAL AND ORGANIZATIONAL MEASURES
- Authenticated Shopify installation/session, signed storefront and webhook boundaries; server-side authorization for merchant and customer-context access.
- Tenant-scoped data access, database row-level security, restricted runtime identities and separation of production and test data.
- Encrypted hosted storage and native backups, protected public/API transport and protected private service networking.
- Restricted internal access, strong passwords, two-factor authentication, credential protection and controlled secret handling.
- Access-audit and minimized operational logging designed to exclude credentials, raw transcripts and unnecessary personal data.
- Bounded pagination, per-message archive expiry, earlier rights/termination deletion, authenticated request handling and continuation of incomplete work.
- Daily native production backup rotation after six days, controlled restoration and reapplication of deletion requirements before restored data is used.
- Data-loss-prevention and incident-response procedures, designated responsibility, incident investigation and appropriate review/testing of safeguards.
These measures describe obligations for the enabled Service; they are not a claim of an independent certification.
ANNEX C — PROVIDERS AND PROCESSING FUNCTIONS
Railway Corporation — application hosting, PostgreSQL/Redis infrastructure and native backups. Scope: data actually hosted in those components for the Service. Primary production infrastructure is configured in the Europe region; authorized support/subprocessor activity and legal transfer safeguards remain governed by the applicable arrangements. Provider DPA: https://railway.com/legal/dpa
OpenAI, through the applicable API services contracting entity and its authorized providers — AI inference. Scope: chat input and approved source/order facts necessary for the enabled AI functions, not an automatic transfer of the merchant customer panel's full profile/order-history results. Applicable entities, locations, safeguards and provider security/retention processing are governed by the API services arrangements. Provider DPA: https://openai.com/policies/data-processing-addendum/
Shopify — the Merchant's platform and API/identity source, with its separate merchant relationship and platform purposes. It is not designated as Obsedia's subprocessor merely because the App obtains authorized platform data or uses Shopify billing. Shopify's applicable privacy and contractual terms govern that separate relationship.
Obsedia will provide further reasonably requested information about the direct provider arrangements and relevant authorized subprocessors through agents@obsedia.ai. Source control and development checks are intended for source and synthetic test data, not production shopper payloads.