Data Processing Agreement

Last updated: 27 July 2026

This Data Processing Agreement (DPA) forms part of the Terms of Service and sets out how Sichta processes data on your behalf under Art. 28 GDPR. It applies whenever you use Sichta to scan or fix your store. No signature is required — installing the app accepts it.

1. Roles

For the store catalog and configuration data Sichta reads to run a scan, you (the merchant) are the controller and Sichta is the processor. Sichta processes this data only on your documented instructions — the instruction being your use of the app's features (scan, generate, fix). Sichta acts as an independent controller only for your own merchant-account data, which is covered by the Privacy Policy, not this DPA.

2. Subject matter, nature and purpose

Subject matter: assessing and improving your store's readiness for AI shopping agents. Nature and purpose: reading product and shop data through Shopify's APIs, computing scores, generating llms.txt and agents.md, and applying merchant-initiated fixes. Duration: for as long as the app is installed.

3. Categories of data and data subjects

Sichta processes business data about your catalogue and shop: product titles, descriptions, prices, images, alt text, metafields, identifiers; shop policies, locales, currency, and domain. It does not process your customers', shoppers', or order data, and does not receive special-category data. There are, by design, no data-subject personal records in scope beyond the merchant contact email you provide for alerts.

4. Our obligations

• Process the data only on your instructions and for the purposes above.
• Ensure the operator is bound by confidentiality.
• Apply appropriate technical and organisational security measures (Section 7).
• Not engage a new subprocessor without notice and the opportunity to object (Section 5).
• Assist you, taking into account the nature of processing, with data-subject requests and with your obligations under Art. 32–36 GDPR.
• Delete the data on termination (Section 8).
• Make available the information needed to demonstrate compliance.

5. Subprocessors

You authorise the subprocessors listed on our Subprocessors page. We remain responsible for their performance. We will give notice before adding or replacing one; if you object on reasonable data-protection grounds, your remedy is to stop using the affected feature or uninstall.

6. International transfers

All processing takes place in the EU (AWS eu-central-1, Frankfurt). Administration from Switzerland relies on the European Commission's adequacy decision for Switzerland. The optional AI-snapshots feature uses EU-resident endpoints only and runs solely with your explicit consent.

7. Security

Encryption in transit (TLS) and at rest; production access limited to the operator over audited sessions with no public admin interface; catalogue contents and webhook payloads are not logged; least-privilege OAuth scopes with no access to orders or customers.

8. Return and deletion

On uninstall we delete your shop's processed data in response to Shopify's shop/redact request (within 48 hours), and we honour Shopify's customers/redact and customers/data_request topics — though Sichta holds no customer data to return or erase. You may also request earlier deletion by email.

9. Audit

On reasonable written request, and no more than once a year unless required by a supervisory authority, we will provide the information reasonably necessary to demonstrate compliance with this DPA.

10. Contact

Data-protection matters: hello@gigliotti.software.