Scelto data processing agreement

This agreement forms part of the Scelto terms of service between Vesuvio Labs LLC ("we", the processor) and the merchant that installs Scelto ("you", the controller). It applies to personal data about your store's visitors and customers that Scelto processes for you, and is meant to meet Article 28 of the GDPR and UK GDPR and the service provider requirements of the California Consumer Privacy Act (CCPA).

1. What we process, and why

Subject	Showing you how AI agents read and use your store, and answering agents' questions about it.
Data subjects	Visitors to your storefront, and customers whose orders your store receives.
Personal data	With the visitor's analytics consent: page address and type, product handle, a random visitor id kept in the browser, browser signals that tell automated browsers from people, and the AI assistant that referred the visit (only when it matches a known assistant). Funnel events from Shopify's web pixel (product viewed, added to cart, checkout started and completed) with the product handle. For orders: totals, currency, the sales channel that created them, and the referring site and utm_source of the visits Shopify attributes to them. IP addresses are used only in memory. Names, email addresses, phone numbers, postal addresses and payment details are not collected.
Purpose	The Scelto dashboard for your store and the store agent. Not for advertising, profiling across stores, or sale.
Duration	While Scelto is installed; visit events are deleted after 90 days, order data is not stored, and everything is deleted within 48 hours of Shopify's request after uninstall.

2. Our obligations

1. We process personal data only on your documented instructions, which are these terms, this agreement and your settings in the app, unless the law requires otherwise, in which case we'll tell you first where the law allows.
2. Anyone we authorise to process the data is bound by confidentiality.
3. We keep the security measures in section 4.
4. We use the subprocessors in section 5 and will tell you at least 30 days before adding or replacing one, so you can object; if we can't address an objection, you can stop using Scelto.
5. We help you respond to requests from data subjects and to meet your security, breach notification and impact assessment duties, as far as the nature of the processing and the information we hold allow. Scelto holds no data that identifies a visitor by name or contact details; Shopify's customer data requests are answered through its mandatory privacy webhooks.
6. We tell you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your data, with what we know and what we're doing about it.
7. When Scelto is uninstalled, we delete your store's data within 48 hours of Shopify's request, unless the law requires us to keep it.
8. We give you the information needed to show compliance with this agreement and allow reasonable audits, at most once a year, with 30 days' notice, at your cost, and in a way that protects other merchants' data.

3. California (CCPA)

We act as your service provider. We won't sell or share the personal data, retain, use or disclose it outside the direct business relationship with you or for any purpose other than providing Scelto, or combine it with personal data from other sources except as the CCPA allows. We'll tell you if we can no longer meet these obligations.

4. Security

• Data is encrypted in transit (HTTPS/TLS) and at rest (the database provider's storage encryption).
• Access to production systems is limited to Vesuvio Labs LLC's authorised personnel, with strong, unique passwords and two-factor authentication.
• Credentials are kept in the hosting provider's secret store, never in code or logs.
• Test and production data are kept apart.
• We follow a written security incident response policy.

5. Subprocessors

Fly.io, Inc.	Application hosting	United States
Supabase, Inc.	Database	United States

6. International transfers

Data is processed in the United States. Where the law of your store's location requires safeguards for that transfer, the EU Standard Contractual Clauses (module two, controller to processor, or module three where you're a processor) and the UK International Data Transfer Addendum apply between us and are incorporated by reference.

7. Order of precedence

If this agreement and the terms of service conflict on personal data, this agreement applies.

Contact

Vesuvio Labs LLC, 2108 N St, Ste N, Sacramento, CA 95816, United States · hello@getscelto.com