Data Processing Addendum.

This addendum is part of our Terms of Service. It covers personal information from your store and your tools that Elevara handles to run your automations (“your data”): for example your customers’ names, email addresses, phone numbers, shipping addresses, orders and messages.

It doesn’t cover what we collect about you as our client, such as your sign-up and billing details. Our Privacy Policy covers that.

• You decide why and how your data is used. Under privacy laws you’re the “business” or “controller.”
• We handle it only for you, on your instructions. We’re your “service provider,” “processor” or “contractor.”
• Your instructions are these terms, your plan, the settings you choose, and anything else you ask us in writing. If we think an instruction breaks the law, we’ll tell you and won’t follow it.

We use your data only to:

• run the automations on your plan, such as answering customers and sending order updates;
• show you what your automations did, and ask for your approval;
• set up, test, fix and support them;
• keep the service secure and prevent fraud or abuse;
• meet our legal duties.

We read only the data your automations need, and only for as long as they need it.

As your service provider, we won’t:

• sell your data, or share it for cross-context behavioral advertising;
• keep, use or disclose it for any purpose other than the ones above, or outside our relationship with you;
• combine it with personal information we get from anyone else, except as privacy laws allow;
• use it to train AI models.

We will:

• give it the same level of privacy protection that privacy laws require of you;
• tell you if we can no longer meet our duties under those laws;
• let you take reasonable steps to stop and fix any use of your data that isn’t allowed.

• Only Jordan, and anyone working for Elevara who needs to for your automations, can see your data. Everyone with access is bound to keep it confidential.
• We look at your data only to set up, check, fix or support your automations, or when you ask us to.

We use reasonable safeguards for a business our size, including:

• encryption for data moving between your tools, our systems and our providers;
• access keys for your tools kept in encrypted storage, never in emails or documents;
• the narrowest permissions each automation needs, and two-step sign-in on our accounts;
• providers that encrypt the data they store for us;
• records of what our automations do, so problems can be traced.

No system is completely secure, so we can’t guarantee your data will never be accessed without permission.

We use established providers (“subprocessors”) of these kinds to run your automations. Each one is based in the United States, bound by terms that protect your data at least as well as this addendum, and we’re responsible for them.

• Hosting. Runs the Elevara app and the code behind your automations.
• AI models. Read incoming messages and draft replies and summaries. Their business terms bar them from training on your data.
• Email delivery. Receives your forwarded support email and sends replies from your own domain.
• Phone. Answers calls to your store’s number. Only if you have the phone line.
• Data storage. Keeps your automations’ records and settings.
• Billing. Bills your plan. It handles your payment details, never your customers’ data.

The tools you connect, such as Shopify, WooCommerce, QuickBooks or Xero, are yours, not our subprocessors. Their own terms with you apply.

We’ll email you at least 30 days before we add or change a provider that handles your data. If you object for a reasonable data protection reason, tell us. If we can’t solve it together, you can cancel and we’ll refund anything you’ve paid for time after you leave.

• If one of your customers asks us directly to see, correct or delete their information, we’ll pass the request on to you and won’t answer it ourselves unless you ask us to.
• We’ll help you answer requests about data we hold for you, quickly and at no extra cost.

• If we learn that your data was accessed, lost or disclosed without permission, we’ll tell you without undue delay, and within 72 hours of confirming it.
• We’ll tell you what happened, what data was involved, and what we’re doing about it, and help you with any notices the law requires you to send.

• When your plan ends, we disconnect from your tools and revoke our access keys.
• You can ask for a copy of your data within 30 days after that.
• We delete your data within 30 days after that, and from our providers’ backups as they roll over, usually within another 30 days.
• We may keep what the law requires us to keep, and our own billing records with you. They stay covered by this addendum.
• You can also ask us to delete specific data while your plan is running.

When you connect a Shopify store, we also follow Shopify’s requirements for protected customer data: we ask only for the customer data your automations need, use it only for them, protect it as described here, and delete it on the schedule above. Shopify’s own terms for apps apply too.

We and our subprocessors process your data in the United States. If your customers are elsewhere, for example in the European Union or the United Kingdom, tell us before you connect your store so we can agree the safeguards those laws require.

Once a year, or after an incident, we’ll answer a reasonable written security questionnaire about how we handle your data, and give you the information you need to show you’re meeting your own privacy duties.

Questions about your data? Email hello@elevara.agency or call (239) 251-5474.