Terms of Service — AI Chat Agent for Supplements & Cosmetics
Version dated 19 October 2026. For new customers, these Terms apply when published and accepted. Changes for existing customers follow Section 15.
1. The agreement
These Terms govern AI Chat Agent for Supplements & Cosmetics, including the Shopify application AI Chat Agent for Supplements & Cosmetics, its storefront widget and the related AI chat pages at https://www.obsedia.ai/ (the "Service"). They are an agreement with Genius Nutrition SRL, trading as OBSEDIA ("OBSEDIA", "we", "us"). Our registered address is Tamasi nr. 20, Buftea, Ilfov, Romania. Our VAT identification number is RO35355847. Contact support@obsedia.ai for support and contractual enquiries, or privacy@obsedia.ai for privacy matters.
The app is offered to merchants for business use. By installing or using it after these Terms have been made available to you, you accept them on behalf of the merchant identified by the installation ("you"). You must be at least 18 and authorised to bind that merchant. If you do not accept, do not install or use the app; for an existing agreement, Section 15 governs changes.
These Terms apply to this AI chat Service. Other OBSEDIA apps and services have separate terms. A shopper's purchase is governed by the merchant's terms and applicable consumer law. OBSEDIA does not become the seller of the merchant's products by supplying the chat.
2. What the Service does
The Service helps merchants answer shopper questions and present relevant product and store information through AI chat. It can use the merchant's catalogue, selected store content, configuration and permitted Shopify integrations. Features depend on the available plan, permissions, configuration and release status. Mention of an optional feature in these Terms does not make it available or enable it.
Where supported, a shopper may choose a product or request an action through the widget. The merchant's current Shopify checkout and applicable purchase terms govern the resulting transaction. A generated message alone does not authorise a payment, override checkout conditions or establish entitlement to a discount.
3. Installation, permissions and merchant responsibilities
You must maintain a valid Shopify store and comply with Shopify's applicable terms. You control installation, authorised staff access, the storefront app embed, store content and supported configuration. Protect credentials and promptly report suspected unauthorised access to support@obsedia.ai.
You are responsible for having rights to the content you supply, maintaining accurate product descriptions, labels, prices and policies, and complying with laws applicable to your business and products. Do not include another person's private information in store knowledge merely because it is available to you.
Provide clear, timely notice that shoppers are interacting with AI, and provide the privacy information required for the chat and any retained transcripts before processing begins. Do not hide or misrepresent the AI nature of the Service. Keep a suitable human contact route for matters requiring a person.
You are responsible for selecting lawful purposes and bases, obtaining any required consents, setting appropriate access and retention choices, and deciding whether the Service is suitable for your audience. You must not enable an optional customer-data function until its required permissions, notices and other conditions are satisfied.
4. AI limitations and health boundaries
AI responses can be incomplete, inaccurate or unsuitable, even when based on current store information. Review the Service's use in your store and investigate reported problems. The Service does not guarantee a sale, conversion rate, revenue increase, regulatory outcome or an error-free response.
The Service is not designed or offered as a healthcare service or a tool for diagnosis or treatment. Its responses are not medical, diagnostic, treatment, legal or other professional advice. Do not use it to diagnose conditions, prescribe treatment, replace professional advice or make unlawful claims about supplements, cosmetics, food or other products. Shoppers should consult an appropriate professional for personal medical questions and use emergency services for emergencies.
Do not solicit medical records, diagnoses, payment-card details, identity documents or other highly sensitive information through the chat. Free-text input is not guaranteed to be sanitised before processing or storage. If inappropriate personal data is submitted, cooperate with us to minimise, restrict or delete it as required.
5. Acceptable use
Do not use the Service to:
- Break the law, infringe rights, make misleading or prohibited claims, or offer unlawful products or services.
- Obtain another merchant's information, bypass permissions or safety controls, interfere with tenant separation or access data without authority.
- Introduce malware, probe or disrupt the Service without authorisation, or abuse it through automated traffic that defeats normal usage controls.
- Submit content you have no right or lawful basis to process, or use the Service for consequential decisions about individuals for which it is not intended.
- Present AI responses as guaranteed professional advice or as a substitute for the merchant's own responsibilities.
6. Privacy and data processing
Our Privacy Policy at https://www.obsedia.ai/privacy/supplements explains processing and retention. Annex A below is the Data Processing Addendum for personal data we process on your behalf and forms part of this agreement. It does not depend on a separate, unnamed DPA being signed.
You retain responsibility for controller decisions and instructions. We process merchant-controlled personal data only to provide the agreed Service, on documented instructions and as required by applicable law. Privacy notices do not create permission for unrelated uses or remove data subjects' statutory rights.
7. Plans, charges and cancellation
Where a paid plan or usage charge is available, the applicable prices, currency, billing period, included allowance, billable unit, overage rate, cap and any trial conditions are those disclosed in the relevant Shopify plan and approval flow. You must review them before approving. A marketing estimate or an internal usage counter does not itself authorise a charge. These Terms do not create a particular trial, free allowance or price.
App charges are handled through the applicable Shopify billing process. We do not collect your full payment-card details for those charges. Changes that require merchant approval must go through the applicable approval process. We will not activate a new paid obligation solely by posting updated Terms.
You can stop using the app and use Shopify's uninstall or subscription controls to cancel. Check the resulting Shopify confirmation and invoice. Charges validly incurred before cancellation can still appear on a later invoice. Refunds or credits are handled under the accepted plan, Shopify's applicable billing process and mandatory law; contact support@obsedia.ai to raise a specific billing issue. Deleting chat data alone is not a subscription cancellation request.
8. Content and intellectual property
You retain your rights in your catalogue, store content and other materials. You grant us the limited rights needed to host, transmit, process and use those materials to provide, secure and support the Service under this agreement and your documented instructions. You must have the necessary rights to grant that permission. It does not authorise use of raw shopper conversations or your store content to train public AI models.
We retain rights in the app, software, designs, documentation and our brand. Subject to this agreement and any applicable plan, we grant you permission to use the Service for your own authorised store operations. Do not copy or resell the Service or remove proprietary notices except as permitted by mandatory law or an express written agreement.
You may use generated responses in your store subject to applicable law and third-party rights. AI output may be similar to other output and may not qualify for exclusive intellectual-property protection. We do not guarantee uniqueness, accuracy or ownership of rights that do not legally exist. Personal data remains governed by applicable law and Annex A, rather than by an ownership label.
9. Confidentiality
Each party must protect the other's non-public information received in connection with the Service, use it only for the agreement and disclose it only to people or providers who need it and are subject to appropriate confidentiality duties. This does not cover information independently developed, lawfully received without restriction or already public without a breach. Legally compelled disclosure is permitted; where lawful, give notice and limit the disclosure to what is required. Personal data remains subject to the stronger applicable protection.
10. Availability, support and changes to features
We provide the Service with reasonable care and skill. Availability depends in part on Shopify, AI and infrastructure providers, internet connections and maintenance. The Service may be interrupted or limited, and no uptime or response-time service level is promised by these Terms. Support is available at support@obsedia.ai. We give notice of planned material disruption where reasonably practicable.
We may correct, maintain and update the Service. Material contractual or pricing changes follow Section 15 and the applicable Shopify process. We do not use a feature update to authorise a new purpose for personal data or new merchant charges without the required steps.
11. Suspension and termination
You may end use by uninstalling, subject to applicable billing obligations already incurred. We may suspend affected access where reasonably necessary to address a security issue, unlawful use, loss of Shopify authorisation, a material breach or an unpaid valid obligation. We give notice and a reasonable opportunity to resolve a remediable breach where practicable, but may act immediately where needed to protect people, data, the Service or legal obligations. We explain the reason unless disclosure is prohibited or would undermine security.
On termination, your permission to use the app ends. Data is returned or deleted in accordance with Annex A, the Privacy Policy and applicable law. Request any required export before uninstalling where possible, because service data may enter deletion processing. Retention for security, required legal records and isolated recovery copies does not create continued ordinary service access. Clauses that need to continue, including confidentiality, data protection, accrued payments, liability and dispute provisions, survive as applicable.
12. Warranties and responsibility for claims
Apart from the express commitments in this agreement and mandatory legal requirements, the Service is provided on an "as available" basis. To the extent permitted by law, we do not give additional implied warranties of fitness for a particular purpose, uninterrupted availability or error-free AI output. This does not remove the commitment to reasonable care and skill or any protection that cannot lawfully be excluded.
You are responsible for third-party claims caused by your unlawful products, your infringing content or your use of the Service in material breach of this agreement. We are responsible for third-party claims that the Service supplied by us infringes intellectual-property rights, except to the extent caused by your content, unauthorised changes or use outside this agreement. A party seeking assistance with a claim must give timely notice, reasonable cooperation and a fair opportunity to address it. Neither party may agree to a settlement imposing an admission or obligation on the other without that party's consent. Liability remains subject to Section 13 where legally permitted.
13. Liability
To the extent permitted by law, neither party is liable to the other for indirect or consequential loss arising from this agreement. Our aggregate liability in any twelve-month period is limited to the fees you paid for the Service during that period.
These limitations do not exclude or limit liability for fraud, intentional misconduct, gross negligence, death or personal injury where the law prohibits such limitation, or any other liability that cannot lawfully be excluded or limited. They do not restrict a data subject's statutory compensation or other rights, a supervisory authority's powers, or liability that applicable data-protection law requires to remain enforceable.
14. Governing law and general provisions
Romanian law governs this agreement, and disputes are subject to the competent courts of Romania, without removing mandatory rights to another court or protections under applicable consumer or data-protection law. A shopper's rights against the merchant remain unaffected.
If a provision cannot be enforced, the remaining provisions continue to the extent legally possible. A failure to enforce a right immediately is not a waiver. Any separately agreed written terms take precedence for their stated scope; Annex A takes precedence for processing of personal data on the merchant's behalf. Shopify's applicable platform and billing rules continue to govern the Shopify relationship.
15. Updates and contact
We identify each version of these Terms. For existing customers, we give at least 30 days' advance notice by email of material contractual changes, including the changes introduced by this version, before they apply. Publication alone does not shorten that notice. A shorter period may apply only to changes strictly required sooner by law or an urgent security need, to the extent legally permitted; we explain that reason and give notice as soon as practicable.
If you do not accept a material change, you can end use before it takes effect. Continued use after the applicable effective date constitutes acceptance to the extent permitted by law. A new charge or data-processing activity still requires any separate approval, notice or consent required for it.
Contact support@obsedia.ai about these Terms and privacy@obsedia.ai about Annex A or personal data. Postal contact: Genius Nutrition SRL, trading as OBSEDIA, Tamasi nr. 20, Buftea, Ilfov, Romania.
Annex A. Data Processing Addendum
A1. Scope, parties and precedence
This Addendum applies where OBSEDIA processes personal data on the merchant's behalf to provide the Service. The merchant identified by the installation is the controller, or a processor authorised by its controller to appoint OBSEDIA as subprocessor. Genius Nutrition SRL, trading as OBSEDIA, is the processor or subprocessor accordingly. The parties' identification and contacts are those in the installation, account records and Section 1. Data-protection terms have the meanings given by the applicable GDPR or other applicable data-protection law.
This Addendum forms a binding part of the accepted Terms and prevails over conflicting provisions for this processing. It does not govern information OBSEDIA independently controls for its own business administration, which is addressed in the Privacy Policy.
A2. Processing details and duration
Subject matter and purpose: operating the merchant's AI shopper assistance, relevant store-information retrieval, supported shopper actions, conversation continuity, limited transcript access where enabled, and associated support, security, privacy and deletion operations. Optional order support or analytics is included only to the extent separately available, lawfully enabled and instructed.
Nature: receiving, organising, retrieving, transmitting to authorised service providers, generating AI responses, temporarily storing, making available to authorised users, protecting, returning and deleting relevant data. Processing includes the restricted recovery and backup operations necessary for those purposes.
Data subjects: the merchant's shoppers and prospective shoppers, and merchant staff or other people whose information is lawfully included in the instructed service data.
Data categories: chat messages and responses; relevant product, store and conversation context; conversation/request identifiers; locale and country/market; selected products and supported cart/action information; technical access and security data; and any additional customer/order data strictly necessary for a lawfully enabled optional function. Store content or messages may contain personal data even when not linked to a named account.
Sensitive data: the Service is not intended to collect special-category data or criminal-offence data. Do not instruct it to solicit such data. If it is incidentally entered, its presence does not make it anonymous or automatically lawful: the merchant must assess the applicable legal conditions and instruct appropriate restriction, minimisation or deletion, with our assistance.
Duration: while needed to provide the agreed Service and complete lawful return/deletion obligations. The Privacy Policy's separate live limits apply, including the one-hour command recovery window, up to 24-hour operational context/display retention, and, where enabled, transcripts expiring 25 days from first capture. Backups and required legal records are handled under A9. These limits do not authorise retention for an unrelated purpose.
A3. Instructions and merchant obligations
The accepted agreement, lawful service configuration and authenticated requests are the documented instructions, including for necessary transfers. Additional instructions must be lawful, documented and within the agreed Service. We process only on those instructions unless Union or Member State law applicable to us requires otherwise; where that law requires processing, we inform the merchant before processing unless the law prohibits that information on important grounds of public interest.
The merchant determines purposes and lawful bases, provides notices, obtains required consents and permissions, and ensures its instructions and supplied data comply with applicable law. We immediately inform the merchant if, in our opinion, an instruction infringes applicable data-protection law and do not implement that instruction while the issue remains unresolved. These obligations do not transfer our own legal duties to the merchant.
A4. Confidentiality and security
We ensure that people authorised to process the data are bound by confidentiality or an appropriate statutory duty. Access is limited to what their role requires.
Taking account of the state of the art, cost, nature, scope, context and purposes of processing and the risks to individuals, we implement appropriate technical and organisational measures under Article 32 GDPR. These include authenticated access; separation of merchant data; restricted database and infrastructure permissions; protected transport; encryption of operational recovery content; privacy-conscious logging; retention and deletion controls; and procedures for incident handling and controlled restoration. We regularly assess the suitability of these measures. We do not materially reduce the overall protection of the processing during the agreement.
A5. Assistance and personal-data breaches
Taking account of the nature of processing and information available to us, we assist the merchant with data-subject requests through appropriate technical and organisational measures and with its duties under Articles 32 to 36 GDPR, including security, breach assessment and notification, impact assessments and prior consultation where required.
If we receive a request relating to data we process for a merchant, we inform or direct it to that merchant as appropriate and do not independently disclose the merchant's data without lawful authority. We cooperate with proportionate identity and record-location checks.
We notify the merchant without undue delay after becoming aware of a personal-data breach affecting that processing. We provide available information about its nature, affected data and people where known, likely consequences, mitigation and contact route, and provide further information in phases as it becomes available. The merchant remains responsible for its own legally required notifications; our assistance does not postpone their deadlines.
A6. Subprocessors
The merchant gives general written authorisation to use OpenAI for AI inference and Railway for application and data hosting, including the applicable entities and authorised subprocessors in their service chains. OpenAI's EEA service terms identify OpenAI Ireland Ltd. as the contracting entity for EEA customers; Railway's DPA identifies Railway Corporation. The relevant provider descriptions are available at https://openai.com/policies/data-processing-addendum/ and https://railway.com/legal/dpa. Their current subprocessor information is available at https://openai.com/policies/sub-processor-list/ and https://trust.railway.com/item/subprocessors. Shopify provides the merchant's platform integration under its own applicable relationship and terms.
We maintain and provide, on request to privacy@obsedia.ai, the applicable service-specific subprocessor information. We inform the merchant by email of intended additions or replacements before their use for that merchant's personal data, giving a meaningful opportunity to object on reasonable data-protection grounds. We discuss a justified objection and a practical alternative; if no compliant solution is available, the affected processing must end before the disputed subprocessor is used for it.
We impose data-protection obligations on subprocessors that provide the protection required by Article 28(4) GDPR, including appropriate security. We remain responsible to the merchant for their performance of those obligations. Authorisation is not permission for a subprocessor to use merchant-controlled data for its own unrelated purposes.
A7. International transfers
We make a restricted international transfer only where the applicable requirements of Chapter V GDPR or other applicable transfer law are met. This may require an adequacy decision or appropriate safeguards, such as the relevant European Commission standard contractual clauses, a transfer assessment and supplementary measures where required. We provide the merchant information reasonably needed to assess the transfer and a copy of applicable safeguards where required, with appropriate protection for confidential information.
This Addendum is an Article 28 processing agreement; it is not itself a substitute for an applicable international-transfer instrument. Where separate transfer terms are legally required, they must be in place before the restricted transfer. No EU-only location, provider certification or special zero-retention arrangement is promised by these Terms.
A8. Information and audit
We make available the information necessary to demonstrate compliance with this Addendum and Article 28 GDPR, and allow for and contribute to audits, including inspections, conducted by the merchant or an auditor it mandates. The parties coordinate reasonable arrangements to protect security, confidentiality and other customers' data, without frustrating statutory audit rights or supervisory powers. We cooperate with competent supervisory authorities as required by law.
A9. Return, deletion and recovery copies
At the merchant's choice, we return or delete the personal data after the end of the relevant services and delete existing copies unless Union or Member State law requires storage. The merchant should request return before uninstalling or before applicable scheduled deletion, because the service's retention limits can remove records sooner. We provide reasonable assistance with a lawful request without recreating data already deleted.
Any data that must temporarily remain in isolated backups or recovery copies stays protected, is excluded from ordinary service use and is deleted under the documented backup/recovery lifecycle or when the legally required retention ends. Routine daily backup retention is six days; manual snapshots and retained recovery volumes have their own cleanup lifecycle. They are not exempt from deletion obligations. If restored, deletion restrictions and required deletion replay apply before data returns to ordinary use. We retain only what is lawfully necessary and can explain the applicable exception on request.
A10. Contact and continuing effect
Send processing instructions, subprocessor enquiries, audit requests and privacy concerns to privacy@obsedia.ai. Both parties must keep suitable records of instructions and cooperation. This Addendum continues for as long as we retain merchant-controlled personal data and does not restrict the rights or remedies of data subjects or supervisory authorities.