Merchant Data Processing Agreement

The merchant is the controller or business for data it submits or connects. Aimé acts as processor or service provider and processes that data only on documented merchant instructions, to provide the service, secure it, and meet applicable legal obligations.

Processing may cover account data, merchant content, connected-platform identifiers, product information, and limited order-related commerce data. Shopify v1 excludes customer names, emails, phone numbers, and addresses. Processing lasts for the subscription and the documented deletion period.

• Apply access controls, encryption in transit and at rest, credential encryption, logging, deletion controls, and incident procedures appropriate to the risk.
• Ensure personnel and subprocessors are bound by confidentiality and data-protection obligations.
• Assist merchants with verified rights requests, security incidents, deletion, and reasonable compliance information.
• Not sell merchant personal data or use Shopify customer/order data for cross-merchant AI training.

The current draft register is at /subprocessors. The final DPA will identify the approved transfer mechanism, notice process, objection process, and any required Israel, US-state, GDPR, or UK addenda after counsel review.

Upon verified request, account termination, disconnect, or applicable Shopify privacy webhook, Aimé returns or deletes data according to the published schedule unless a documented legal obligation requires limited retention.

Send DPA questions to privacy@aimecommerce.app. No merchant should rely on this draft until counsel approves it and Aimé publishes an effective version. The signed or electronically accepted approved version will control.