Data Processing Agreement (DPA)

This agreement (version 2026-08) is entered into between the merchant installing Replyed (the controller) and Aguilar Global LLC, 30 N Gould St Ste N, Sheridan, Wyoming 82801 (USA), operating Replyed as processor. It is accepted at install time and we record who accepted it and when.

1. Subject matter and roles

The merchant decides the purposes and means of processing their customers' data. Replyed processes it only on the merchant's documented instructions, namely the app configuration and normal use of the service. We do not use the data for our own purposes, do not sell it, and do not use it for advertising or AI training.

2. Data and data subjects

• Data subjects: end customers contacting the store and store buyers.
• Data: name, email address, support message content, order data (number, amount, currency, payment and fulfillment status, tracking and dates) and payment dispute data.
• No card data, payment credentials or special categories of data are processed.

3. Sub-processors

The merchant expressly authorises the following sub-processors:

• Anthropic PBC (USA) — AI generation of support replies. Receives the conversation text and strictly necessary order data. Does not use content to train its models.
• Supabase Inc. — database and service hosting.
• Amazon Web Services (Amazon SES, Ireland region) — sending and receiving support email to and from end customers.

Replyed imposes data protection obligations on each sub-processor equivalent to those in this agreement and remains liable for their performance. Changes or additions are announced on this page at least 30 days in advance; if you object, you may uninstall the app before the change takes effect.

4. International transfers

Some sub-processors are located in the United States. Those transfers rely on the European Commission's standard contractual clauses together with additional encryption and data minimisation measures.

5. Security

• Encryption in transit and encryption of store credentials at rest.
• Per-store isolation enforced with row level security.
• Audit log of every access to end-customer personal data.
• Staff access limited to what is strictly necessary for support.

6. Retention and deletion

• Conversations and messages: deleted automatically after 24 months (merchant-adjustable).
• After uninstall: full deletion after 90 days, or within 48 hours if Shopify requests it.
• Individual erasure requests: executed immediately.
• Every deletion run is logged and visible to the merchant.

7. Assistance to the controller

Replyed automatically handles official access and erasure requests received from Shopify and assists the merchant with data subject rights, impact assessments and supervisory authority enquiries.

8. Security incidents

Replyed notifies the merchant of any personal data breach without undue delay and at the latest within 72 hours of becoming aware of it, with the information needed for the merchant to meet its own obligations. The full procedure is in the incident response policy.

9. Audit

On reasonable request, once per year, Replyed provides the information needed to demonstrate compliance with this agreement.

10. Termination and contact

On termination, data is deleted as described in section 6. Data protection contact: privacy@getreplyed.io.