Data Processing Addendum

Last updated: 2026-10-14 · Operated by Tunabear Inc., d/b/a Rudy AI · 11711 Hillcrest Rd, Dallas, TX 75230, United States

This addendum forms part of the Terms of Service and is entered into automatically when you install the app. It is written to satisfy Article 28 of the UK/EU GDPR and to be usable under the CCPA/CPRA, where we act as a "service provider".

Everything factual in this document was read from the running system, not drafted from a template: the scopes from the app manifest, the sub-processors from the outbound calls the code makes, the encryption from the implementation. The bracketed fields are commitments only you can make. See Fields you must complete at the end.

1. Roles, and the one that matters most

You are the controller of the personal data in your Shopify store. We are your processor: we act on your instructions and for no purpose of our own.

Shopify is a separate controller/processor in its own right under its own agreement with you. This addendum covers only what Rudy AI does.

2. What we actually process — and what we do not

We hold no scope that can read customers, orders, or payments. The app's access, from its manifest, is:

read_content, read_products, write_products

That is the whole of it. There is no read_customers, no read_orders, no read_all_orders and no protected customer data scope, so shopper personal data is outside what the app can reach, not merely outside what it chooses to use.

3. Your instructions

We process only on your documented instructions. Installing the app, configuring it and using its features are those instructions. We will tell you if an instruction appears to breach data protection law, and we will not process for our own purposes — in particular we do not sell personal data, do not share it for advertising, and do not use it for cross-context behavioural advertising.

One reuse existed and is stated rather than buried. Earlier versions of the app generated themes and retained their section layouts as anonymous structure that may be offered to other merchants; the app no longer generates themes (since 14 October 2026), so nothing new is added. The markup is driven by theme settings, so words, prices and images always come from whichever store renders it; your content is never part of what is shared. The instruction you typed and the link back to your theme are erased with your data. See §6.2 of the Privacy Policy.

4. Confidentiality

Everyone we authorise to process your data is bound by confidentiality obligations and is granted access only as their role requires.

5. Security

Measures in place, described specifically enough to be checked:

• Encryption at rest for every stored credential — AES-256-GCM with a key derived by scrypt. This covers your Shopify access and refresh tokens, your search-data provider keys, and the platform's own AI provider keys.
• Encryption in transit — TLS for all traffic to the app, to Shopify and to every sub-processor.
• Session verification on every merchant request, via Shopify's session tokens.
• Administrative endpoints are separated from merchant endpoints and require a distinct secret.
• Credential rotation without downtime — provider keys are held as rotatable records with expiry, so a key can be replaced before the old one is retired rather than during an outage.
• Least privilege at the Shopify boundary — see the scope list in §2. The strongest security control here is that the data is not reachable.

These are commitments about design, not a guarantee of outcome. §7 covers what happens when something goes wrong.

6. Sub-processors

You authorise the sub-processors below. We remain liable to you for their performance.

6.1 Infrastructure and delivery

The infrastructure provider is Tencent, a company headquartered in China, operating the United States region named above. Both facts are stated because merchants care about each separately.

6.2 AI providers — new, and the reason this document exists

Until 2026-09-16 there were no AI sub-processors. You connected your own provider account, that provider was your supplier, and we transmitted to it on your instruction. You can no longer connect a key. We hold the credentials and pay for the usage, which makes these providers our sub-processors and our responsibility.

We do not permit our AI providers to train models on your content, and we do not train any model on it ourselves. What each provider retains, and for how long, is governed by its own published terms, linked above rather than paraphrased here — paraphrasing another company's policy is how a document like this goes out of date.

Content sent to an AI provider is the content the feature needs: product text, page content and your store name. No shopper personal data is sent, because the app cannot reach any (§2).

6.3 Only if you connect them

These process under their own terms and only while you have them connected.

6.4 Changes

We will give you 30 days notice before adding or replacing a sub-processor, by email to your store contact address. If you object on reasonable data-protection grounds you may terminate under §9 without penalty for the remainder of the paid period.

This list changes when the system changes. Adding an AI provider is a code-visible act — a credential record — so this table is the thing to update when one is added.

7. Personal data breaches

We will notify you without undue delay and within 72 hours of becoming aware of a personal data breach affecting your data, with what we know at the time: what happened, which categories and roughly how many records, the likely consequences, and what we are doing. We will keep you updated as we learn more rather than waiting until the picture is complete.

Report a suspected compromise to [email protected].

8. Your obligations to data subjects

Assistance with requests. If a data subject contacts us directly we will not respond on your behalf; we will refer them to you and tell you. We will help you meet access, correction, erasure, restriction, portability and objection requests, taking into account what the app can actually do.

Assistance with assessments. We will give you the information you reasonably need for a data protection impact assessment or a prior consultation with a supervisory authority.

9. Deletion, and what survives

Uninstalling is not erasure, deliberately. Shopify sends app/uninstalled immediately and shop/redact 48 hours later to say the erasure is now due. We delete on the second, so a merchant who reinstalls within that window does not lose their work.

Erasure is complete when it runs. 32 foreign keys to the merchant record cascade; the six tables with no direct key cascade through their own parent; the one key that does not cascade (section_corpus.merchant_id) has its identifiable columns cleared first.

What survives, stated exactly: anonymous section layouts contributed by earlier versions, as described in §3. Nothing identifying you remains with them.

You may also request erasure at any time at [email protected].

10. Audits

We will make available the information needed to demonstrate compliance with this addendum and will allow and contribute to audits, including inspections, by you or an auditor you appoint. Audits are at most once in any twelve months unless required by a supervisory authority or following a breach, on reasonable notice, during business hours, and without disproportionate disruption to other merchants.

11. International transfers

Your data is stored in the United States (§6.1), and AI processing happens in our providers' regions. Where a transfer is made from the UK, EU or EEA, it is made under the European Commission Standard Contractual Clauses (Module 2, controller to processor), or the UK International Data Transfer Addendum where UK law applies, which are incorporated into this addendum by reference and take precedence over it in the event of a conflict.

12. CCPA/CPRA

Where California law applies, we are a service provider. We do not sell or share your personal information, do not retain, use or disclose it for any purpose other than performing the services, and do not combine it with personal information from other sources except as permitted.

13. Precedence and changes

If this addendum conflicts with the Terms of Service, this addendum governs for personal data. If it conflicts with the Standard Contractual Clauses, the Clauses govern.

We will give notice of material changes as set out in the Terms. A change that adds a sub-processor follows §6.4 instead.