Merchant Terms & Data Processing Addendum
Version 1.0, 4 September 2026. Part A sets out the terms of service. Part B is the Data Processing Addendum required by Article 28 GDPR and forms part of these terms.
Who you are contracting with
Dario Tino
Gapetschstrasse 29, 9494 Schaan, Principality of Liechtenstein
UID CHE-331.960.860 · kontakt@axyom.ch
“Axyom”, “we” and “us” mean the above. “You” and “Merchant” mean the business installing or using the Axyom app or widget. Installing the app means you accept these terms.
Part A — Terms of Service
1. The service
Axyom provides an AI assistant that answers questions from visitors to your store, using content you publish — products, variants, prices, availability, pages and policies — and, where you enable it and the shopper signs in, the status of that shopper's own orders.
The assistant generates language. It can be wrong. It is grounded in your published content and instructed not to invent information, but you should not rely on it for statements that carry legal or financial consequence without your own review. You remain responsible for what your store communicates to your customers.
2. Your responsibilities
- Keep the content Axyom reads accurate — the assistant repeats your catalogue and policies, and cannot be more correct than they are.
- Do not use the service to send unlawful, deceptive or infringing content.
- Have a privacy notice that tells your customers an AI assistant may process their messages, and keep your own legal basis for that processing.
- Do not attempt to extract our prompts, models or non-public interfaces, or use the service to build a competing product.
3. Fees
Plans and prices are shown in the app. Merchants who install through the Shopify App Store are billed by Shopify under its Billing API; we never see your payment details. Charges recur monthly until cancelled. Cancelling stops future charges; it does not refund the current period unless the law requires it.
4. Availability
We aim for continuous availability and do not promise it. The service depends on Shopify, on our hosting provider and on third-party model providers, and any of them can be unavailable. We may change or discontinue features; where a change materially reduces what you have paid for, we will tell you before it takes effect.
5. Intellectual property
We own the software. You own your content and your customers' data. You grant us only the rights needed to run the service for you — reading your published content, indexing it, and processing messages to produce answers. We do not use your content or your customers' messages to train third-party models.
6. Liability
Nothing here excludes liability that cannot lawfully be excluded, including for death or personal injury caused by negligence, or for fraud. Subject to that, neither party is liable for indirect or consequential loss, and our total liability in any twelve-month period is limited to the fees you paid us in that period.
7. Termination
You may uninstall at any time. We may suspend or terminate for material breach, or for non-payment, on notice. On termination we erase your data as described in Part B, section 8.
8. Governing law
These terms are governed by the law of the Principality of Liechtenstein, and the courts of Liechtenstein have jurisdiction. This does not deprive a merchant established in the EEA or Switzerland of the protection of mandatory provisions of their local law.
9. Changes
We may update these terms. Material changes will be notified in the app or by email at least 30 days before they take effect, and continuing to use the service after that means you accept them.
Part B — Data Processing Addendum
This Addendum applies where Axyom processes personal data on your behalf, and is concluded under Article 28(3) GDPR. Liechtenstein is part of the EEA, so the GDPR applies to us directly. Where the Swiss FADP applies, references to the GDPR are read as references to the equivalent Swiss provisions.
1. Roles
For personal data relating to your customers and store visitors, you are the controller and Axyom is the processor. We process that data only on your documented instructions, which consist of these terms, the app's settings, and any further instruction you give in writing. If we believe an instruction infringes data protection law, we will tell you.
2. Subject matter, duration, nature and purpose
| Subject matter | Answering questions from your store's visitors, and reporting the status of a shopper's own order where enabled. |
|---|---|
| Duration | For as long as the app is installed, plus the erasure periods in section 8. |
| Nature | Collection, storage for the limited periods in section 8, transmission to the sub-processors in section 5, generation of an answer, and erasure. |
| Purpose | Providing the service. No profiling, no advertising, no sale of data, and no training of third-party models. |
3. Categories of data subjects and personal data
| Data subjects | Personal data |
|---|---|
| Visitors to your store who use the assistant | The content of their messages, and a session identifier. Message content is whatever the visitor chooses to type, which may include an email address or order number. |
| Customers who sign in to check an order | Order number, date, total, payment and fulfilment status, tracking information and ordered items — read live and not stored (section 8). An encrypted authorisation token is held for at most 30 minutes. |
We do not request or process customer name, email address, telephone number or postal address. Our Shopify access is limited to protected customer data Level 1, and the order query is written to exclude those fields.
4. Confidentiality
Access to production systems is limited to the controller named above, who is bound by a duty of confidentiality. Any future personnel will be bound in writing before access is granted.
5. Sub-processors
You authorise the sub-processors below. We remain responsible for their performance.
| Sub-processor | Purpose | Location |
|---|---|---|
| OpenAI, L.L.C. | Generating answers; building the search index. API data is not used to train OpenAI's models; abuse-monitoring logs are deleted after at most 30 days. | United States |
| Infomaniak Network SA | Hosting, database, outbound email | Switzerland |
| GitHub, Inc. | Hosting our public website | United States |
| Shopify Inc. | The platform your store runs on | Canada |
We will give you at least 30 days' notice before adding or replacing a sub-processor, by email and in the app. If you object on reasonable data protection grounds within that period, you may terminate without penalty for the remainder of the paid term.
6. International transfers
Transfers to the United States rely on the European Commission's Standard Contractual Clauses, which are incorporated here by reference. Switzerland benefits from an adequacy decision; Canada benefits from an adequacy decision for commercial organisations.
7. Security
Taking account of the state of the art, cost, and the risks to data subjects, we implement:
- Encryption in transit — TLS on every connection.
- Encryption at rest — the data volume is encrypted, and authorisation tokens are additionally encrypted at the application layer. API keys and session identifiers are stored only as cryptographic hashes.
- Access control — production access limited to the controller; API keys scoped to a specific merchant domain and refused from any other origin.
- Data minimisation by design — the order query is written to exclude name, email, telephone and address.
- Resilience and restoration — backups held on the same encrypted volume, restorable on request.
- Testing — an automated test suite covering the security boundaries above runs before each deployment.
8. Retention and erasure
| Data | Retained |
|---|---|
| Chat messages | 90 days, then deleted automatically |
| Order data | Not stored — read live for a single answer |
| Shopper authorisation token | 30 minutes maximum, encrypted, deleted on expiry or sign-out |
| Everything belonging to your shop | Erased on Shopify's redaction request after uninstall |
On termination we delete your data rather than returning it, unless you ask in writing for a copy before erasure, in which case we will provide one in a structured, machine-readable format.
9. Assisting you
We will help you meet your obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to us. If a data subject contacts us directly, we will not respond substantively but will refer them to you and tell you promptly.
10. Personal data breaches
We will notify you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting your data, with the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken.
11. Audits
We will make available the information needed to demonstrate compliance with this Addendum, and will accept audits by you or an auditor you mandate, on reasonable notice, no more than once per year unless a breach or a supervisory authority requires otherwise, and subject to confidentiality.
12. Precedence
Where this Addendum conflicts with Part A, this Addendum prevails for matters of personal data processing.
This document was drafted from the technical facts of how the service is built. It is not legal advice, and you should have your own adviser review it before relying on it.