Last updated: 11 October 2026
This addendum (“DPA”) is part of the HolaReply for Shopify Terms of Service and of the HolaReply terms of service for any website, between the merchant or website owner (“you”, the controller) and SEO Agency Inc (“HolaReply”, “we”, the processor). It applies to personal data of your store’s shoppers, or your website’s visitors, that we process to provide the app or the service. On a website, “store” below means your website and “shopper” its visitor; what is said of Shopify’s data requests and order look-ups is for Shopify only. It is meant to meet Article 28 of the GDPR and UK GDPR and similar privacy laws (where we act as your “service provider” or “processor”).
1. Details of the processing
| Subject matter and purpose | Providing the app: answering shoppers in the storefront chat from your store’s content, passing enquiries and locked topics to your team, order status look-ups, showing conversations and enquiries to you, and complying with Shopify’s data requests |
| Duration | While the app is installed or the website is in HolaReply, then deletion as in section 8 |
| Data subjects | Your store’s shoppers and visitors who use the chat |
| Personal data | Chat messages (questions and answers); contact details a shopper chooses to give (name, email, phone, company) and their enquiry message; for order tracking only, the order number and email typed by the shopper and the order’s email, status and tracking (shown, not stored); the shopper’s language |
| Special categories | None intended. Do not ask shoppers for them; a shopper may still type them into the chat |
| Not processed | Payment details, addresses, customer accounts, IP addresses with conversations (only a one-way hash in a short-lived rate-limit counter) |
2. Our obligations
We will:
- process the personal data only on your documented instructions, which are these terms, this DPA and your settings in the app, unless the law requires otherwise (we will tell you first unless the law forbids it);
- ensure everyone we authorise to process it is bound by confidentiality;
- apply the security measures in section 4;
- use sub-processors only as in section 5;
- help you, as far as we reasonably can, to answer shoppers who exercise their rights (access, deletion and others): Shopify’s
customers/data_requestandcustomers/redactrequests are handled by the app automatically, and enquiries can be viewed and downloaded in the app; - help you with security, breach notification, impact assessments and consultations with authorities, as far as they concern our processing;
- delete the data at the end of the service (section 8);
- make available the information needed to show compliance with this DPA and allow audits as in section 9;
- tell you at once if we believe an instruction breaks data protection law.
We do not sell personal data, share it for cross-context behavioural advertising, use it to train AI models, or combine it with data from other stores.
3. Your obligations
You confirm you have a lawful basis for the processing, give your shoppers the information the law requires (your privacy notice should mention the chat and HolaReply), and that your instructions comply with the law.
4. Security measures
- Encryption in transit: HTTPS (TLS) for the storefront chat, the admin and webhooks.
- Encryption at rest: chat messages, a conversation’s contact details and every enquiry field are encrypted in the database (XSalsa20-Poly1305, with keys kept outside the database); shoppers are looked up only by keyed hashes of their email or phone. Access tokens and AI keys are encrypted too. Daily backups are encrypted (AES-256-GCM) with a separate key.
- Isolation: every store’s data is kept apart; every request is checked against Shopify’s session token or webhook signature.
- Minimisation: emails and phone numbers are removed from anything sent to an AI provider; contact fields are never sent to it; order data is never stored or sent to an AI.
- Access control and logging: server access only by SSH keys, for two people at most; every view of shopper data (in the app or by us) is recorded in an access log kept for a year, which you can see in the app for the last 90 days.
- Retention: conversations kept until you delete them, or deleted 30, 90 or 365 days after the last message if you choose a period; everything deleted 48 hours after you uninstall; backups kept 14 days.
- Incident response: a written policy (section 6).
- Off-site copy: each daily backup, still encrypted, is also kept for 14 days in a private Cloudflare R2 bucket.
5. Sub-processors
You give general authorisation for the sub-processors below. We will tell you at least 30 days before adding or replacing one (in the app or by email and on this page); you may object on reasonable data protection grounds, and if we cannot address the objection you may stop using the app. We bind each sub-processor to data protection terms at least as protective as this DPA and remain responsible for them.
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Google LLC (Gemini API) | AI answers and the search index (HolaReply AI, or your Gemini key) | Store content; shopper questions with emails and phone numbers removed | Outside the EEA |
| OpenAI, L.L.C. | Only if you choose OpenAI with your own key | The same | Outside the EEA |
| Anthropic, PBC | Only if you choose Claude with your own key | The same | Outside the EEA |
| Resend (Plus Five Five, Inc.) | Emails to you, to your team and your team’s replies to shoppers | Email addresses and the emails’ content | Outside the EEA |
| Hostinger International Ltd | The server the app runs on (a virtual private server) | All data we store (encrypted fields as above) | Outside the EEA |
| Cloudflare, Inc. | Network and security in front of app.holareply.com; storage of the encrypted off-site backup copy (R2) | Requests in transit; encrypted backups (14 days) | Global network; backups outside the EEA |
| Shopify | The platform and billing | What Shopify already holds | — |
6. Personal data breaches
We notify you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your store’s data, at your store’s email address, with what we know: the nature of the breach, the data and people concerned, likely consequences, what we have done and what you should do, and a contact (support@holareply.com). We follow up as we learn more. Our incident response policy describes the process.
7. International transfers
We and some of our sub-processors process data outside the EEA, UK and Switzerland. Where such data is transferred, the transfer is covered by the European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914: module 2, controller to processor, and module 3 for onward transfers to our sub-processors), the UK International Data Transfer Addendum and, for Swiss data, the Swiss amendments to those clauses, which are incorporated into this addendum by reference, or by another lawful mechanism, such as a sub-processor’s certification under the Data Privacy Framework.
8. Deletion
When you uninstall the app, all your store’s data is deleted 48 hours later (so a reinstall within that time loses nothing), or at once when Shopify sends its shop/redact request. Deleted data may remain in encrypted backups for up to 14 days, after which it is gone. You can download your enquiries as CSV from the app before uninstalling.
For a website, ask us (support@holareply.com) to delete it: its conversations, enquiries, content and team are deleted within 7 days, and leave the encrypted backups 14 days after that. Until then they are kept until you delete them, or for the period you choose in the Desk.
9. Audits
On written request, at most once a year (or after a breach), we will answer a reasonable security questionnaire and provide the documents that show compliance with this DPA. Where the law requires an inspection, it is done on 30 days’ notice, during working hours, by an auditor bound by confidentiality, at your cost, without access to other customers’ data.
10. Order of precedence
If this DPA and the terms conflict about personal data, this DPA applies; the Standard Contractual Clauses, where they apply, prevail over both.
Contact
SEO Agency Inc (HolaReply) — support@holareply.com