Data Processing Agreement

Last updated: November 1, 2026

This Data Processing Agreement ("DPA") forms part of the agreement between The AI Co-Founder ("we", the processor) and each business that uses our AI website assistant, AI Inbox Assistant or Shopify app ("Merchant", the controller). By installing or using the service, the Merchant agrees to this DPA.

1. Roles

The Merchant is the controller of personal data about its website visitors and customers. We process that data only on the Merchant's behalf and on its documented instructions, which are the use of the service as described in our Privacy Policy.

2. Data we process

  • Categories of people: the Merchant's website visitors, shoppers and customers who chat with the assistant or email the Merchant.
  • Types of data: chat messages, contact details a visitor chooses to share (such as name and email), approximate city and country, the page that referred them, support emails forwarded by the Merchant, and, only when a shopper asks about their own order, that order's status and the email used to verify it, which is not stored.
  • Purpose: answering visitors' questions, sending the Merchant its leads and conversations, drafting replies to support emails, and looking up order status on request.

3. Our obligations

  • We process personal data only to provide the service and never sell it or use it for advertising.
  • Anyone with access to the data is bound by confidentiality.
  • We apply the measures described on our Security page, including encryption, encrypted backups, access logging and access control.
  • We help the Merchant respond to requests from individuals to access, correct or delete their data, and we process Shopify customer data and redaction requests automatically.
  • We notify the Merchant within 72 hours of confirming a personal data breach affecting its data.

4. Sub-processors

We use these sub-processors: Vercel (hosting and storage), Google (the Gemini AI model), Resend (email delivery) and Shopify or Whop (billing). We will update this list before adding a new sub-processor, and the Merchant may stop using the service if it objects.

5. International transfers

Data may be processed in the United States by the sub-processors above. Where required, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

6. Deletion

When the Merchant closes its account or uninstalls the Shopify app, we delete its personal data within 90 days, or sooner when Shopify sends a redaction request. Encrypted backups containing it expire within a further 30 days.

7. Information and audits

On request, we provide the information reasonably needed to show compliance with this DPA.

Contact

The AI Co-Founder, 515 Ocean Ave, Santa Monica, CA 90402. Email: mohsin@aicofounderhq.com