Data Processing Addendum
Last updated 13 October 2026. This Addendum forms part of our Terms of Service. How we handle personal data for our own purposes — your account, billing and messages you send us — is described in our Privacy Policy.
Parties
Processor: Dario Tino, doing business as Axyom
Gapetschstrasse 29, 9494 Schaan, Liechtenstein
UID CHE-331.960.860 · kontakt@axyom.ch
Controller: the business that installs the Axyom Shopify app or creates an account on axyom.ch (“you”). You conclude this Addendum by accepting our Terms of Service.
This Addendum applies where Axyom processes personal data on your behalf, and is concluded under Article 28(3) GDPR. Liechtenstein is part of the EEA, so the GDPR applies to us directly. Where the Swiss FADP applies, references to the GDPR are read as references to the equivalent Swiss provisions.
1. Roles
For personal data relating to your customers and store visitors, you are the controller and Axyom is the processor. We process that data only on your documented instructions, which consist of our Terms of Service, this Addendum, the app's settings, and any further instruction you give in writing. If we believe an instruction infringes data protection law, we will tell you.
2. Subject matter, duration, nature and purpose
| Subject matter | Answering questions from your store's visitors, and reporting the status of a shopper's own order where enabled. |
|---|---|
| Duration | For as long as the app is installed or your account exists, plus the erasure periods in section 8. |
| Nature | Collection, storage for the limited periods in section 8, transmission to the sub-processors in section 5, generation of an answer, and erasure. |
| Purpose | Providing the service. No profiling, no advertising, no sale of data, and no training of third-party models. |
3. Categories of data subjects and personal data
| Data subjects | Personal data |
|---|---|
| Visitors to your store who use the assistant | The content of their messages, and a session identifier. Message content is whatever the visitor chooses to type, which may include an email address or order number. |
| Customers who sign in to check an order | Order number, date, total, payment and fulfilment status, tracking information and ordered items — read live and not stored (section 8). An encrypted authorisation token is held for at most 30 minutes. |
We do not request or process customer name, email address, telephone number or postal address. Our Shopify access is limited to protected customer data Level 1, and the order query is written to exclude those fields.
4. Confidentiality
Access to production systems is limited to the processor named above, who is bound by a duty of confidentiality. Any future personnel will be bound in writing before access is granted.
5. Sub-processors
You authorise the sub-processors below. We bind each of them by written contract to data protection obligations that offer at least the protection of this Addendum, and we remain responsible to you for their performance.
| Sub-processor | Purpose | Location |
|---|---|---|
| OpenAI Ireland Ltd, using OpenAI, L.L.C. | Generating answers; building the search index. API data is not used to train OpenAI's models; abuse-monitoring logs are deleted after at most 30 days. | Ireland; processing in the United States |
| Infomaniak Network SA | Hosting, database, outbound email | Switzerland |
| GitHub, Inc. | Hosting our public website | United States |
| Shopify Inc. | The platform your store runs on | Canada |
We will give you at least 30 days' notice before adding or replacing a sub-processor, by email and in the app. If you object on reasonable data protection grounds within that period, you may terminate without penalty for the remainder of the paid term.
6. International transfers
Transfers to the United States rely on the European Commission's Standard Contractual Clauses, which are incorporated in our data processing agreement with OpenAI. Switzerland benefits from an adequacy decision; Canada benefits from an adequacy decision for commercial organisations.
7. Security
Taking account of the state of the art, cost, and the risks to data subjects, we implement:
- Encryption in transit — TLS on every connection.
- Encryption at rest — the data volume is encrypted, and authorisation tokens are additionally encrypted at the application layer. API keys and session identifiers are stored only as cryptographic hashes.
- Access control — production access limited to the processor; API keys scoped to a specific merchant domain and refused from any other origin.
- Data minimisation by design — the order query is written to exclude name, email, telephone and address.
- Resilience and restoration — backups held on the same encrypted volume, restorable on request.
- Testing — an automated test suite covering the security boundaries above runs before each deployment.
8. Retention and erasure
| Data | Retained |
|---|---|
| Chat messages | 90 days, then deleted automatically |
| Order data | Not stored — read live for a single answer |
| Shopper authorisation token | 30 minutes maximum, encrypted, deleted on expiry or sign-out |
| Everything belonging to your shop | Erased on Shopify's redaction request after uninstall |
On termination we delete your data rather than returning it, unless you ask in writing for a copy before erasure, in which case we will provide one in a structured, machine-readable format.
9. Assisting you
We will help you meet your obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to us. If a data subject contacts us directly, we will not respond substantively but will refer them to you and tell you promptly.
10. Personal data breaches
We will notify you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting your data, with the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken.
11. Audits
We will make available the information needed to demonstrate compliance with this Addendum, and will accept audits by you or an auditor you mandate, on reasonable notice, no more than once per year unless a breach or a supervisory authority requires otherwise, and subject to confidentiality.
12. Precedence
Where this Addendum conflicts with our Terms of Service, this Addendum prevails for matters of personal data processing.