Data Processing Agreement

Introduction

This Data Processing Agreement ("DPA") forms part of the agreement between Cervello and any merchant using Cervello to connect a Shopify store or import store data (the "Agreement"). It describes how Cervello processes data on the merchant's behalf and the obligations that come with that role. It should be read alongside our Terms & Conditions and Privacy Policy.

Parties & Roles

Cervello, operated by OneWeb Agency ("Cervello", "we"), acts as the data processor.

The merchant using Cervello ("you", the "Merchant") acts as the data controller — you decide which store to connect, which data to import, and for what business purpose. Cervello processes data only to provide the service you've asked for.

Scope & Purpose of Processing

Cervello processes the categories of data described in our Privacy Policy: store-level order, product, and traffic data (via the Shopify Admin API or CSV import), and one aggregate customer metric — a returning-customer rate derived from customers' lifetime order counts, never from an identifiable customer record.

This data is processed solely for the purpose of generating analytics dashboards, AI-driven business recommendations, and market intelligence for the Merchant's own store — never for advertising, resale, or personalizing an individual shopper's experience. Processing takes place on Cervello's application infrastructure (hosted on Vercel), with data stored in Supabase and AI-generated insights produced via the Anthropic API.

Processor Obligations

Cervello agrees to:

• Process data only on the Merchant's documented instructions, as reflected in the Merchant's use of the app and this Agreement
• Keep processed data confidential, limiting access to personnel and systems that need it to operate the service
• Implement reasonable technical and organizational security measures appropriate to the data involved (see Security Measures below)
• Assist the Merchant in responding to data subject requests (access, correction, deletion) to the extent Cervello holds relevant data
• Notify the Merchant of a personal data breach without undue delay, and in any case within 72 hours of becoming aware of it
• Not engage a new sub-processor that processes personal data without providing notice to the Merchant

Sub-Processors

Cervello uses the following sub-processors, each engaged under its own data protection terms:

• Supabase — database storage and account authentication
• Anthropic — processes store data to generate AI-driven analytics and recommendations
• Vercel — application hosting
• Stripe — payment processing for the Merchant's own Cervello subscription (does not process shopper data)

We'll update this list and notify Merchants of material changes before a new sub-processor is engaged.

Security Measures

Cervello encrypts data in transit (HTTPS) across all connections, stores Shopify access tokens server-side only (never exposed to the browser), and restricts Shopify Admin API requests to the minimum fields required for the app's functionality. Access to production data is limited to personnel who need it to operate or support the service.

Breach Notification

If Cervello becomes aware of a breach affecting a Merchant's data, we will notify the affected Merchant without undue delay and no later than 72 hours after becoming aware, describing the nature of the breach, the data likely affected, and steps taken or planned in response.

Data Subject Requests

Because Cervello does not hold identifiable shopper records, a shopper-initiated request (to access or delete their data) is directed to the Merchant, as the controller of that relationship. Where Shopify routes a mandatory compliance request to Cervello directly (customer data request, customer redaction, or shop redaction — typically triggered via Shopify on the Merchant's or shopper's behalf), Cervello acknowledges and, where applicable, deletes any corresponding data automatically.

Data Deletion & Return

If the Merchant uninstalls Cervello from their Shopify store, Shopify notifies us via a mandatory compliance webhook and we delete the associated store and analytics records. A Merchant may also request deletion of their account and all associated data at any time by contacting us directly — see Contact below.

Term

This DPA remains in effect for as long as Cervello processes data on the Merchant's behalf under the Agreement, and terminates automatically when that processing ends (e.g. on account deletion or app uninstall) and any applicable data deletion described above has been completed.

Contact

Questions about this Agreement? Reach us at jesse@cervelloadvisors.com.