Data Processing Agreement

Last updated: 29 October 2026 · Version 1.0 · Art. 28 GDPR · Română

This agreement is part of the CyberVSM Terms. It applies when IRIS processes personal data on your store. You (the client) are the controller; InnerBloom Brand SRL, CUI RO47604160, Otopeni, Romania, is the processor. The Romanian version prevails over this translation.

1. What we process and why

• Purpose: to run IRIS on your store — answer shoppers’ questions, recommend products, add products to cart, pass conversations to your team, measure the sales IRIS assists and send you statistics and a weekly report, and, once available on Growth and Agency, personalise recommendations for logged-in shoppers.
• Data subjects: visitors and customers of your store who use the chat.
• Personal data: chat messages and anything shoppers write in them; technical data (IP address, browser, time); for logged-in shoppers on stores using the CyberVSM Shopify app, the Shopify customer ID and their recent orders (status, items, tracking), read live from Shopify to answer them and not stored; contact details a shopper chooses to give for a handover; if you install the CyberVSM pixel, data about paid orders linked to a chat (order ID, total, currency, products and the chat ID, with no name, email, address or phone number), to measure sales assisted by IRIS.
• We do not need special categories of data. Ask shoppers not to share them; IRIS is instructed to do the same.
• Duration: for the term of your subscription, plus the deletion period in section 7.

2. Our obligations

• We process personal data only on your documented instructions, which are these terms, the IRIS configuration you approve, and your written requests. We tell you if we think an instruction breaks the GDPR.
• Everyone at InnerBloom who can access the data is bound by confidentiality.
• We apply the security measures in the annex below and keep them up to date.
• We help you, as far as we reasonably can, to answer shoppers’ requests (access, deletion, objection and so on), with security, breach notification and, where needed, impact assessments.
• We do not use your shoppers’ data for our own purposes, and it is not used to train AI models.

3. Sub-processors

You authorise us to use these sub-processors:

• Anthropic, PBC (USA) — the Claude AI model that generates IRIS’s answers. Under its commercial terms it does not train on the data it receives.
• Vercel Inc. (USA) — hosting of the IRIS service and website.
• Upstash, Inc. (USA; database hosted in the EU, Frankfurt region) — IRIS configuration and conversation records.
• Resend (USA) — delivery of handover and notification emails.

Shopify is your own platform and not our sub-processor. We give you at least 30 days’ notice by email before adding or replacing a sub-processor; if you object on reasonable data-protection grounds and we cannot solve it, you may cancel the subscription without penalty. Each sub-processor is bound by data-protection obligations equivalent to these.

4. Transfers outside the EEA

Where data is processed outside the European Economic Area, transfers rely on the EU–U.S. Data Privacy Framework or on the European Commission's Standard Contractual Clauses, as applicable to each provider.

5. Personal data breaches

We notify you without undue delay, and at the latest within 48 hours of becoming aware of a breach affecting your shoppers' data, with the information available to us, so you can meet your own 72-hour obligation.

6. Your obligations

• You have a legal basis for the processing and you inform shoppers in your privacy policy that your store uses an AI assistant provided by CyberVSM.
• You give IRIS only information you are allowed to share, and you tell us promptly about shoppers’ requests that need our help.

7. End of the service

When the subscription ends, we deactivate IRIS and, within 30 days, delete your shoppers' personal data, unless the law requires us to keep it. On request made before the end, we first export the conversation records to you.

8. Audits

We give you the information needed to show compliance with this agreement. You may audit us, yourself or through an independent auditor bound by confidentiality, once a year with 30 days’ notice, at your cost, without access to other clients’ data.

Annex — security measures

• Encryption in transit (HTTPS/TLS) for all traffic between shoppers, your store, IRIS and our providers; encryption at rest by our hosting and database providers.
• Access to production systems only for authorised InnerBloom staff, with individual accounts and two-factor authentication; API keys with minimum permissions, kept in our hosting provider’s secret settings, never in code.
• Data separated per client store; each store’s IRIS can read only that store’s catalog and data.
• Shoppers are verified through Shopify for personalised answers; IRIS never trusts a typed email to reveal order data, and never shows exact stock quantities.
• Rate limits and message caps against abuse; monitoring and logs of errors and security events.
• Conversation records are kept for at most 90 days for support and quality, then deleted, unless you ask for a shorter period.
• Reliance on providers with recognised security programmes (for example SOC 2 or ISO 27001 reports).

Contact

Data protection questions: contact@cybervsm.com.