Data Processing Agreement

Effective date: October 23, 2026

Parties and priority

This Addendum forms part of the accepted Autivis Terms of Service or the parties' written service agreement when Autivis processes personal information on the merchant's behalf.

The merchant identified in the accepted agreement is the controller or business, called “Merchant.” Autivis LLC, a Florida multi-member limited liability company at 5645 Coral Ridge Dr, Suite 427, Coral Springs, FL 33065, is the processor or service provider, called “Autivis.” Contact: autivis@gmail.com; 954-903-8385; https://autivis.com.

Each party remains responsible for personal information it processes as an independent controller, such as its own business contacts, billing administration and legal obligations. This Addendum prevails over the service agreement for a conflict about processing on Merchant's behalf. Applicable mandatory data-protection law prevails over a conflicting contractual limitation. The Terms' merchant-facing direct-damages limit and exclusions also apply to contractual damages claimed by Merchant under this Addendum, including the one-month current-plan-price basis, to the extent permitted by law. This does not cap a data subject's statutory claim, regulatory powers, an applicable SCC remedy or any liability that cannot lawfully be limited. It does not excuse performance of processing, security, assistance, deletion or other required obligations. Nothing creates a second cumulative cap or an additional privacy cap; nothing amends Autivis's independent obligations to Shopify. The mandatory provisions of a valid applicable transfer arrangement prevail over an inconsistent contractual cap.

Scope and instructions

The subject, duration, purposes, information categories and data subjects are described in Schedule 1. Merchant's documented instructions consist of the accepted agreement, this Addendum and lawful actions by authorized Merchant users through the app, including selected activities, settings, schedules and approved connections. Instructions cannot expand processing beyond available permissions or an applicable Shopify approval.

Autivis will process personal information only on those instructions and as necessary to provide the agreed service, unless applicable law requires otherwise. Where legally permitted, Autivis will tell Merchant before processing required by law. Autivis will promptly inform Merchant if an instruction appears to violate applicable data-protection law and may suspend that instruction while the parties resolve it.

Merchant is responsible for its lawful basis, notices, permissions and the accuracy of its instructions. Neither party will instruct the other to process unnecessary or prohibited personal information. The public MVP requests read_inventory, read_locations, read_products and write_products. It does not request protected Shopify customer or order data. Mandatory privacy requests may contain the shop and subject identifiers needed to respond to those requests. This Addendum does not authorize access outside that scope. Any later feature requiring such information needs the relevant permissions and approvals before activation.

Confidentiality and security

Autivis will limit access to authorized personnel and providers who need it to perform their duties and are bound by confidentiality. It will maintain technical and organizational measures appropriate to the information and risk, including the measures in Schedule 2, and review them as processing changes. A change must not materially reduce the agreed level of protection.

Autivis will not store Merchant's connected-service passwords. Required access/session credentials will be encrypted, scoped to the Merchant and required connection permissions, limited to their expiry and deleted on disconnect or uninstall within the applicable connection scope.

Service-provider restrictions

Autivis will not sell or share Merchant personal information for cross-context behavioral advertising, use it for an independent commercial purpose unrelated to the agreed service, or combine it with information from unrelated sources except as permitted by applicable service-provider law and Merchant's instructions. Autivis will not use Merchant data to train its own generalized AI models, instruct a provider to train generalized models on that data, or enable provider training/data-sharing opt-ins through the service. For a provider account separately owned and connected by Merchant, Merchant controls its account-level settings and its provider agreement applies; Autivis does not warrant inspection or control of settings the provider does not expose to it. This allocation does not diminish Autivis's obligations for its own processing or for sub-processors it engages. AI inference for a selected feature is processing to provide that feature and is not authorization for model training.

By entering this Addendum, Autivis undertakes to understand and comply with the applicable service-provider restrictions; this undertaking does not represent a third-party certification. It will notify Merchant if it determines it can no longer meet those obligations. Merchant may take reasonable steps to verify compliance and stop or remedy unauthorized processing, consistently with this Addendum.

Sub-processors

Merchant gives general authorization for the providers in Schedule 3 to perform the stated functions when the corresponding services are enabled. Autivis will bind each sub-processor to data-protection obligations appropriate to its processing and materially equivalent to the relevant obligations here, including confidentiality, security, instruction limits and restrictions on training. Autivis remains responsible for its sub-processors' performance of those obligations.

Autivis will give at least 30 days' notice of a material new sub-processor or material replacement before it begins processing Merchant personal information, unless a shorter period is necessary to address an urgent security or legal issue. Merchant may object on reasonable data-protection grounds during that period. The parties will seek a workable alternative; if none is available, Merchant may stop the affected feature or end that portion of the service before the change takes effect, without affecting obligations already accrued. Urgent changes will be explained promptly and retain appropriate safeguards.

A service Merchant connects under its own agreement may act as Merchant's separate controller or processor, rather than Autivis's sub-processor. Autivis will identify that relationship and the data flow; optional connection does not make every function of the external platform part of Autivis's processing.

Requests and assistance

Taking account of the processing and available information, Autivis will reasonably assist Merchant with individual requests for access, correction, deletion, restriction, objection or portability, security obligations, impact assessments and regulator consultation. Autivis will forward a request directed to Merchant and will not disclose Merchant data to an individual without verified authority, except where law requires it.

Shopify customer-redaction requests will be fulfilled within 30 days. Customer data requests will be compiled from the information retained for the identified subject and made available securely to the store owner. Merchant remains responsible for any response it must give directly to the individual.

Incidents

Autivis will notify Merchant without undue delay after becoming aware of a personal-data breach affecting information processed on Merchant's behalf, and in any event within 48 hours, unless law requires an earlier notice. The notice will include the known nature of the incident, affected categories, likely consequences, response measures and a contact for follow-up. Information may be supplied in stages as the investigation develops.

Autivis will investigate, contain and remediate the incident and provide information reasonably needed for Merchant's legal duties. The notice is not an admission of fault. Merchant determines notifications to individuals and regulators unless the parties agree that Autivis will make a permitted notice on Merchant's behalf. Each party must still meet its own mandatory deadlines. The proposed 48-hour merchant notice does not extend a shorter duty: Shopify API terms separately require notification to Shopify immediately and no later than 24 hours after awareness of an actual or suspected Merchant Data breach.

Information and audits

Autivis will provide information reasonably necessary to demonstrate compliance with this Addendum and cooperate with competent supervisory authorities. Existing relevant security reports and evidence may be used first. Where they do not reasonably resolve Merchant's concern, Merchant may conduct or commission a proportionate audit with an independent auditor bound by confidentiality.

Routine audits ordinarily require at least ten business days' notice and occur no more than annually, during reasonable hours, without access to other merchants' information or unnecessary disruption. Those limits do not prevent an additional audit reasonably needed for a material incident, substantiated concern or regulator requirement. The parties will agree reasonable scope and safeguards; fees must not prevent a mandatory legal right. Autivis will address material findings without undue delay.

Return, deletion and retention

On Merchant's choice and where technically applicable, Autivis will return or delete the personal information it processes on Merchant's behalf after the affected service ends. Merchant should export needed information before uninstalling. Autivis will erase shop data within 48 hours after receipt of Shopify's shop/redact request, which Shopify ordinarily sends 48 hours after uninstall. Operational logs are retained for 30 days and change/undo evidence for 90 days while the app remains installed.

Only information subject to a specific legal retention duty may be retained beyond the applicable deletion period. It must remain restricted to that duty, be protected and be deleted when the duty ends. Restoring a backup must not reintroduce erased Merchant information. Autivis will limit completion records to the minimum identifiers, timestamps and counts needed to identify an installation and prevent erased data from being restored; completion records must not contain the erased customer or product content. Disconnect or uninstall ends authorized provider access independently of the later Shopify shop-redaction delivery.

International transfers

Autivis will make a restricted international transfer only after the parties establish the safeguard required by applicable law. Where standard contractual clauses or a UK addendum are needed, the appropriate instrument must identify the relevant parties, roles, transfer, safeguards and required annex details and be validly incorporated or entered into before that transfer. Required assessments and supplementary measures must be completed. Applicable mandatory transfer protections prevail over conflicting limitations in the service agreement.

This Addendum does not by itself represent that transfer documentation has been executed, that every provider is certified under an adequacy framework, or that all processing occurs in the United States. Autivis must identify the applicable recipient, data location and lawful arrangement for each restricted transfer.

Schedule 1 Processing details

Subject and purpose: operating the selected Shopify commerce activities, storing settings and schedules, authenticating authorized users, preparing and verifying governed product changes, maintaining limited change history, supporting Merchant and fulfilling privacy instructions.

Duration and frequency: during the service and the applicable deletion period; authentication and selected scheduled or user-triggered processing recur as needed. Processing stops when the applicable permission or service ends.

Data subjects: Merchant's authorized staff and business contacts; individuals whose information Merchant lawfully includes in an enabled feature; customers only if a later approved and authorized feature actually requires their information.

Information: shop identity and installation state, signed staff identifiers, settings, documents, photos, instructions and limited operational/audit information. Active v1 product records are not protected Shopify customer/order data. Later approved features may involve the minimum customer/order identifiers and other data described in their notices and permissions. Special-category, medical, financial-account, government-identity and children's personal information are excluded unless separately agreed with appropriate safeguards.

Operations: collection, authentication, storage, organization, feature-specific AI inference, retrieval, display to authorized users, instructed changes, secure export and erasure. Training generalized models is excluded.

Schedule 2 Security measures

Encrypted network transport; managed encryption for stored credentials; authenticated and scoped access; tenant and applicable app/shop/connection boundaries; least necessary permissions; confidentiality for authorized personnel; restricted and time-limited logging; monitored errors and security events; managed backups with erasure reconciliation required before restored data is served; connection revocation and credential deletion; and documented privacy-request processing with completion records limited to metadata and counts. Measures apply according to the processing and must be maintained in the released service.

Schedule 3 Provider inventory

Provider	Function and applicable data flow
Google Cloud	Hosting, PostgreSQL, object storage, managed encryption and logging. Configured regions and approved processing arrangements control location.
OpenAI API	Merchant-connected API inference for public Intake/Sweep and Governor; merchant account terms and sharing settings also apply. Training opt-ins are not authorized by this Addendum.
Shopify	Commerce data, signed authentication, app events and subscription billing; also processes under Merchant's own Shopify agreement.

This Schedule covers the public Settings, Intake/Sweep and Governor MVP. Vertex AI, Document AI, Drive/Search Console, Creatomate, OneUp, social platforms, mailbox services and CommentSold are outside that scoped offering. They require a revised provider/data-flow disclosure and the applicable authorization before use in it. Their code elsewhere in the platform does not establish active public-MVP processing.

Only enabled, authorized data flows are permitted. An inactive integration does not process Merchant information merely because it appears in this inventory. Autivis must maintain the applicable processing agreements and no-training restrictions for each active sub-processor.