Data Processing Addendum

This Data Processing Agreement (“DPA”) is entered into by and between Wiser AI (acting as the “Data Processor”) and the merchant executing the underlying Terms of Service or installing and using the Wiser AI Shopify application (acting as the “Data Fiduciary” or “Merchant”).

Scope, Purpose, and Roles

• Role Classification: The Merchant acts as the Data Fiduciary, determining the ultimate purpose and means of processing personal data. Wiser AI acts strictly as the Data Processor, handling Personal Data solely on behalf of, and in accordance with, the documented instructions of the Merchant.
• Scope of Processing: Wiser AI will process end-user (shopper) behavior, purchase history, cart data, and device metrics to provide personalized recommendations, upsells, and analytics on the Merchant’s Shopify storefront.
• Duration: This DPA remains effective until the underlying Service Agreement is terminated and all customer data is systematically purged from Wiser AI environments.

Processing Instructions & AI Safeguards

• Strict Compliance: Wiser AI shall process Personal Data exclusively to fulfill its obligations under the Service Agreement. Wiser AI will not process Personal Data for any other purpose unless mandated by applicable digital data protection laws.
• Zero Model Training Guarantee: Wiser AI explicitly agrees that no Personal Data, shopper behavioral inputs, or Merchant datasets processed through the application will be used to train, tune, or improve public or foundational machine learning models owned by Wiser AI or its upstream infrastructure partners.
• Data Anonymization: Wiser AI may utilize fully aggregated, anonymized, and de-identified shopper metrics for the sole purpose of internal algorithmic optimization, provided such data cannot be re-identified or mapped back to a specific Data Principal.

Sub-Processors

• Prior Authorization: The Merchant grants Wiser AI general written authorization to engage third-party infrastructure providers and foundational AI platforms (collectively, “Sub-Processors”) to deliver the personalization services.
• Flow-Down Obligations: Wiser AI warrants that all engaged Sub-Processors are contractually bound by data protection obligations that are at least as stringent as those set forth in this DPA.
• Approved Infrastructure: The Merchant acknowledges and approves the current use of the infrastructure providers listed in Annex I of this agreement.

Technical and Organizational Security

• Safeguards: Wiser AI shall implement and maintain reasonable technical, physical, and organizational security measures to shield Personal Data against unauthorized access, accidental alteration, disclosure, or destruction.
• Confidentiality: Wiser AI ensures that all internal personnel authorized to handle Merchant data have executed strict, binding non-disclosure and confidentiality agreements.

Data Breaches & Notifications

• Immediate Alert: In the event of a confirmed security incident or data leak within Wiser AI’s system or its Sub-Processor network, Wiser AI will notify the Merchant without undue delay (and no later than 48 hours after verification).
• Remediation: Wiser AI will provide the Merchant with all necessary details regarding the nature of the breach, affected data categories, and immediate mitigation steps taken, enabling the Merchant to fulfill its statutory reporting duties to regulatory bodies.

Data Principal Rights & Cooperation

• Assistance: Taking into account the nature of the processing, Wiser AI will assist the Merchant by implementing appropriate technical modules to fulfill the Merchant’s obligation to respond to requests from shoppers (Data Principals) exercising their rights (such as data erasure, correction, or access queries).

Limitation of Liability and Indemnity

• Consequential Damages Waiver: Neither party shall be liable to the other for any indirect, incidental, special, punitive, exemplary, or consequential damages, including but not limited to loss of profits, loss of revenue, loss of business reputation, loss of goodwill, or business interruption, arising out of or in connection with this DPA, even if advised of the possibility of such damages.
• Liability Cap for Data Breaches: Wiser AI’s maximum, aggregate financial liability for all claims, losses, regulatory penalties, or damages arising out of a data breach, security incident, or violation of this DPA shall be strictly limited to the total fees actually paid by the Merchant to Wiser AI during the twelve (12) months immediately preceding the event giving rise to the liability.
• Merchant Indemnity: The Merchant agrees to defend, indemnify, and hold harmless Wiser AI against any third-party claims, regulatory enforcement actions, or statutory fines resulting from the Merchant’s failure to obtain valid consent or lawful authorization from its end-users (shoppers) before transferring data to Wiser AI.
• Allocation of Risk: The parties acknowledge that the pricing of Wiser AI’s services reflects this allocation of risk. Without this strict cap on liability, Wiser AI would not be economically capable of providing the personalization services to the Merchant.

Term and Termination Data Protocol

• Data Deletion: Upon termination of the service or deletion of the Wiser AI application from the Merchant’s Shopify store, Wiser AI shall delete or return all Personal Data within 30 days, unless retained under explicit local legal retention mandates.

ANNEX I: APPROVED SUB-PROCESSORS

To power our real-time recommendation matrices, Wiser AI routes processing pipelines through the following enterprise platforms:

• Shopify Inc. / Shopify APIs: Core e-commerce data retrieval and webhook management.
• Amazon Web Services (AWS) / Google Cloud Platform (GCP): Secure cloud infrastructure, database hosting, and real-time processing environments.
• OpenAI API (Enterprise Tier) / Anthropic API (Enterprise Tier): Advanced contextual understanding and language algorithms (Configured with zero data retention policies for model training).