Data Processing Agreement

This Data Processing Agreement is between Elevate Digital Media AB (“we”) and the merchant that uses Cyrano (“you”). It is part of our Terms of Service and applies whenever we handle personal data for you. You are the controller of that data and we are your processor.

1. Details of the processing

Subject matter and duration. We handle personal data to provide Cyrano to you, for as long as you use Cyrano and until the data is deleted as section 8 describes.

Nature and purpose. We read your shoppers’ details and orders from your Shopify store and their messages from your helpdesk, and store what Cyrano needs to answer them; replace personal details with placeholders before AI models read them, unless you switch this off for an agent; draft replies, and send them, take store actions and email shoppers copies of their order confirmations as you set Cyrano up; look up deliveries; check messages for attempts to trick the agent and images for signs of manipulation; and keep records to find and fix mistakes.

Types of personal data. Shoppers’ names, email addresses, phone numbers and shipping addresses; their orders, refunds and tracking numbers; the messages and images they send; the names and email addresses of the people who write in your helpdesk’s tickets; and any personal data in your knowledge base.

Categories of people. Your shoppers; other people who write to your helpdesk; your staff whose names appear in tickets; and people named in messages or in your knowledge base.

AI models. Cyrano’s agent uses AI models run by other companies, reached through Vercel’s AI Gateway; our sub-processor page names them. Before your shoppers’ messages and your store’s data reach a model, Cyrano replaces the personal details it recognises, such as names, email addresses, phone numbers and street addresses, with placeholders. The shopper’s first name, the domain of their email address, their city and their country stay visible, so the agent can help. You can switch this off for an agent: once you publish it, that agent’s own requests carry the shopper’s details as written, while Cyrano’s own checks and its memory writing still receive placeholders.

Vercel states that its gateway keeps no prompt or response and does not train on them. Each request that carries your data through the gateway also asks the model’s host to keep nothing and not to train on it, and may reach only the hosts on our sub-processor page. Vercel states that it passes such a request only to a host it has an agreement with to keep nothing, and that the request fails when no such host can take it. The one exception is the check of each draft reply for harmful content, which goes to OpenAI’s moderation service.

Marketing choices. When a shopper asks to start or stop receiving your store’s marketing, the agent can record that choice in your Shopify store, for email or for text messages. By default you must approve the change first. You can switch this off, or let it happen without approval.

Our own record. Our staff tools record which of your conversations they show to which of our staff, and when. We keep that record for our own security and decide about it ourselves, as our Privacy Policy describes, so this agreement does not cover it.

2. Your instructions

We handle the personal data only on your documented instructions: these terms, this agreement and the settings you choose in Cyrano. That includes sending it outside the EEA, which happens only as section 10 describes.

We do not use it to train AI models, we do not analyse it across merchants, and we do not sell it or share it for advertising.

If the law requires us to handle it in another way, we tell you first, unless the law forbids that. If we think an instruction breaks data protection law, we tell you straight away.

3. Confidentiality

Everyone we allow to handle the personal data is bound to keep it confidential.

4. Security

We protect the personal data with the measures on our Security page, as Article 32 of the GDPR requires.

5. Sub-processors

You allow us to use sub-processors to handle the personal data: the companies on our sub-processor page that receive personal data we handle for merchants. Each is bound by written data protection terms that give the protection this agreement gives, and we remain responsible to you for them.

Before a new sub-processor receives your data, we tell you by email at the address on your Cyrano account, at least 15 days in advance. You may object within 10 days of that email. If you object, you may end this agreement.

Your own Shopify store and your Zendesk or Gorgias helpdesk are your providers, not ours: Cyrano reaches them for you, under your own agreements with them.

6. Help with people’s requests

We help you answer requests from people using their rights under the GDPR.

When Shopify passes us a shopper’s request, we act on it. For an erasure request, we delete the shopper’s data, with the exceptions section 8 names; the words exchanged in their conversations and the replies drafted for them also stay, as your record of what was said. For a request for their data, we gather it into a file and email you, at the address on your Cyrano account, a link to download it. For any other request, write to privacy@meetcyrano.com and we carry it out.

7. Help with security and breaches

We help you meet your duties on security, breach notices, impact assessments and consultations with the supervisory authority, with the information we have about our processing.

8. Deletion or return

When you stop using Cyrano and ask us to close your account, we delete the personal data we handle for you within 30 days, and before we delete it, we can give you a copy if you ask.

When you remove Cyrano from your Shopify store, Shopify tells us, and we erase your store’s shopper data within 30 days.

When we delete or erase personal data, copies in our daily database backups remain until the backups age out, about a week later, and copies our sub-processors keep stay for as long as each one’s terms for our plan set. Our record of actions is kept, as our Security page describes. Where the law requires us to keep data, we keep it.

9. Information and audits

We give you the information you need to show that we keep to this agreement.

If you want to check further, we first answer your questions in writing. If that is not enough, an independent auditor bound to confidentiality may check our processing, after reasonable notice.

10. Data leaving the EEA

Our database and our server functions run in London, in the United Kingdom, which the European Commission recognises as protecting personal data adequately. A sub-processor that handles the data outside the EEA does so under the safeguard our sub-processor page names for it.

11. US state privacy laws

Where US state privacy laws, such as the California Consumer Privacy Act, apply to the personal data we handle for you, you are the business and we are your service provider. We keep, use and disclose that data only to provide Cyrano to you, as these terms and this agreement set out.

We do not sell it or share it, as those laws define those words. We do not combine it with personal data we receive from anyone else or collect ourselves, except as those laws allow.

We give it the level of protection those laws require, and we tell you if we find that we can no longer meet our duties under them. You may take reasonable steps to make sure we use it as those laws require, and, after telling us, to stop and put right any use they do not allow.

12. Liability

The limits of liability in section 6 of our Terms of Service apply to this agreement.

13. Changes to this agreement

Before a change to this agreement that affects you takes effect, we email the address on your Cyrano account. If you keep using Cyrano after it takes effect, the changed agreement applies.

14. Law and courts

The law and the courts that section 9 of our Terms of Service names apply to this agreement.

15. Contact

Elevate Digital Media AB, Fagerstagatan 58, 163 53 Stockholm, Sweden. Email: privacy@meetcyrano.com.