Legal · for stores

Data Processing Agreement

Last updated: 27 October 2026

This agreement under Art. 28 of Regulation (EU) 2016/679 (“GDPR”) follows the structure of the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/915. It is part of the service agreement for stores and applies for its whole term.

1. The parties

  • Controller: the store that uses GroceryAI (“the store”), for its customers’ data.
  • Processor: Aequus Ventures SRL, Via Londra 14/B, 07026 Olbia (SS), Italy, VAT number IT03075070908 (“Aequus”). Data protection contact: hello@groceryai.ai.

2. What Aequus processes, and why

  • Purpose: answering the store's customers on WhatsApp and in the chat on the store's website, building the cart, passing the order to the store, handing support requests to the store, showing the conversations to the store in the portal and checking their quality.
  • Data subjects: the store's customers who write to it through GroceryAI.
  • Data: phone number and WhatsApp profile name (for the chat on the website, the chat session identifier); the messages, including photos and voice messages; the cart, the orders and the details the customer gives to complete them (for example delivery address and slot).
  • Special categories (Art. 9 GDPR): the assistant does not ask for them and the service is not designed to process them. If a customer writes them on their own initiative (for example an allergy or an intolerance), Aequus processes them only to answer that request, like the rest of the conversation, without using them for other purposes or storing them separately. The controller's choices on this data, including the notice to customers, belong to the store.
  • Nature: collection, storage, consultation, processing with an artificial intelligence model, transmission to the store, erasure.
  • Duration: for the whole term of the agreement, then until the erasure described in section 10.

3. The store's instructions

Aequus processes the data only on the store’s documented instructions, including for transfers to third countries (Art. 28(3)(a) GDPR): the agreement, this DPA and the choices the store makes in the portal (for example where to receive orders) are its instructions. Aequus does not use the data for its own purposes, does not sell it and does not use it to train artificial intelligence models. If, in Aequus’s opinion, an instruction infringes the GDPR or other data protection law, Aequus tells the store at once. Processing required of Aequus by law is not affected; in that case Aequus informs the store beforehand, unless the law prohibits it.

4. Confidentiality

Aequus lets only the people who need it to provide the service process the data, and they are bound by confidentiality by contract or by law.

5. Security

Aequus takes the technical and organizational measures of Art. 32 GDPR. Those in place today are these (Annex II); they are also described on the security page, which we update when they change. Aequus may change them only if the level of protection does not decrease.

  • Encryption in transit: Website, portal and service answer only over HTTPS, with HSTS (the browser never falls back to plain text).
  • Encryption at rest: The database is encrypted at rest by the provider (Supabase, AES-256).
  • Separation between stores: Every service table has row-level access rules (Row Level Security): one store's data cannot be read through another store's doors.
  • Portal access: Sign-in with an email link or code, or with a password; two-step verification available to everyone and mandatory when the store requires it; session in a cookie that page scripts cannot read; roles (owner, admin, developer, operator, read-only) with different permissions.
  • API keys: Shown only once; we keep only their fingerprint (hash). They can expire and be rotated without downtime.
  • Signed webhooks: Orders and support requests sent to the store's system are signed with HMAC-SHA256, with the secret of the receiving endpoint and the signing time.
  • Rate limits: The service endpoints have per-minute request limits: beyond the limit they reject the request (429).
  • Activity log: Every action in the portal (who, what, when, with which outcome) goes into a log that the service applications cannot change or delete; owner and admin read and download it.
  • Masked data: In the portal, customer conversations are shown with personal data hidden.
  • Backups: The database has a daily backup, kept by the provider for 7 days.
  • Protected portal pages: The portal loads only its own scripts (Content Security Policy) and cannot be framed by other pages.

6. Sub-processors

The store gives Aequus general authorization to engage sub-processors. Those in use today are listed in Annex III and on the sub-processors page. Aequus notifies the store by email at least 30 days before adding or replacing one; the store can object on data protection grounds and, if the parties find no solution, terminate the agreement without penalty. Aequus imposes on every sub-processor, by contract, the same data protection obligations as in this DPA (Art. 28(4) GDPR) and remains fully liable to the store for their performance.

7. Transfers outside the European Economic Area

Some sub-processors process data outside the European Economic Area (Annex III). With this DPA the store instructs Aequus to transfer the data to those sub-processors, only for each one’s part of the service. Every transfer relies on a Chapter V GDPR mechanism: the standard contractual clauses of Implementing Decision (EU) 2021/914 or an adequacy decision, such as the EU-U.S. Data Privacy Framework for the providers that have joined it. On request Aequus gives the store a copy of the applicable safeguards.

8. Assistance to the store

  • Data subject requests: if a customer writes to Aequus to exercise a right, Aequus forwards the request to the store within 5 business days and helps it answer; erasure requested by the customer is carried out as described on the data deletion page.
  • Data protection impact assessments and consultations with the supervisory authority: Aequus gives the store the information it has about the processing.
  • Aequus tells the store if the measures in section 5 are no longer enough to protect the data.

9. Personal data breaches

If it discovers a breach of the store’s data, Aequus notifies the store without undue delay and in any case within 48 hours of discovery, at the store owner’s email address. The notice states, as far as known: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact. Information not yet known is given as soon as it is. Aequus helps the store notify the supervisory authority and, where needed, the data subjects.

10. End of the agreement: return and deletion

At the end of the agreement, or when the store closes its account from the portal, the store chooses whether Aequus should return the data or delete it (Art. 28(3)(g) GDPR), and has 30 days to do so. During that time it can download the store’s data from the portal and ask by email for a copy of its customers’ conversations, which Aequus delivers within 15 days of the request in a machine-readable format. At the end of the 30 days, or earlier if the store asks, Aequus deletes the data of the store and of its customers and the existing copies; of the technical logs only anonymous data remains (times, durations, costs), with no texts or identifiers. The daily backups are overwritten within 7 days. Only the data Aequus is required by Union or Italian law to keep remains.

11. Audits

Aequus makes available to the store the information needed to demonstrate compliance with this agreement. The store, or an auditor it appoints who is bound by confidentiality, may carry out one audit per year, with at least 30 days’ notice, during business hours and without access to other stores’ data; further audits are possible where there are indications of non-compliance with this DPA, after a personal data breach or at the request of an authority. Each party bears its own costs.

12. Final provisions

Aequus tells the store at once if, for any reason, it cannot comply with this DPA. If Aequus breaches it, the store may instruct it to suspend the processing until it complies and, if the breach is serious or does not stop within 30 days, terminate the agreement without penalty. In case of conflict with the service agreement, this DPA prevails on data protection matters. The parties’ liability follows Art. 82 GDPR and the service agreement. This agreement is governed by Italian law.

Annex I · The parties

The store, as identified in the agreement or in the accepted offer; Aequus Ventures SRL, Via Londra 14/B, 07026 Olbia (SS), Italy, VAT number IT03075070908, contact hello@groceryai.ai.

Annex II · Technical and organizational measures

The measures in section 5 and the organizational ones on the security page.

Annex III · Sub-processors

  • Supabase

    What it does:
    Database, portal sign-in and service functions.
    Which data:
    All service data: catalog, conversations, carts and orders of the stores' customers, portal accounts, logs.
    Where:
    Database in the eu-north-1 region, in Stockholm (Sweden, EU). Functions run in the region closest to the caller; the portal asks for Frankfurt (eu-central-1).
    Safeguards:
    Data processing agreement with the Standard Contractual Clauses.

  • OpenAI

    What it does:
    The model that reads the conversation and writes the replies.
    Which data:
    The conversation messages (including photos and voice messages) and the catalog data needed for the reply. Not used to train models.
    Where:
    United States. The assistant's requests are sent without stored state (store: false); abuse-monitoring logs are kept for at most 30 days.
    Safeguards:
    Data processing addendum with the Standard Contractual Clauses.

  • Meta Platforms (WhatsApp Business Platform, Cloud API)

    What it does:
    Delivers WhatsApp messages between the store and its customers.
    Which data:
    Phone number, WhatsApp profile name, messages.
    Where:
    Meta data centers; keeps messages for at most 30 days.
    Safeguards:
    Meta acts as a data processor; for transfers, the WhatsApp data transfer addendum for the European Region.

  • Vercel

    What it does:
    Hosts the website and the store portal.
    Which data:
    The portal pages that the store's people open (masked conversations included) and session data.
    Where:
    Server functions in Frankfurt (Germany), pages from its worldwide network; primary processing facilities in the United States.
    Safeguards:
    Standard Contractual Clauses (Decision 2021/914).

  • Cloudflare

    What it does:
    Traffic to groceryai.ai (website and portal) passes through its network, which protects and routes it.
    Which data:
    IP addresses and traffic of the website and the portal.
    Where:
    Worldwide network, including outside the European Economic Area.
    Safeguards:
    Data processing addendum with the Standard Contractual Clauses; EU-U.S. Data Privacy Framework.

  • Resend

    What it does:
    Sends the service emails: the codes and links to sign in to the portal and, for stores that choose it, orders by email.
    Which data:
    Recipient email address; for orders, the order and delivery details.
    Where:
    United States (Amazon Web Services infrastructure).
    Safeguards:
    Standard Contractual Clauses (Decision 2021/914); EU-U.S. Data Privacy Framework.

  • n8n

    What it does:
    Service automations: the WhatsApp channel of the stores connected through n8n (today the first store) and the daily quality check of the conversations.
    Which data:
    Messages and conversations of those stores.
    Where:
    Frankfurt (Germany).
    Safeguards:
    Data processing agreement.

  • Google (Google Workspace)

    What it does:
    Aequus Ventures' email (Gmail) and video calls (Google Meet); the sheet of the daily quality check (Google Sheets).
    Which data:
    Emails exchanged with stores; in the quality-check sheet, short excerpts of the first store's conversations.
    Where:
    United States and Google's worldwide network.
    Safeguards:
    Standard Contractual Clauses.