Legal & compliance documents

The Legal tab gives you two downloadable draft documents, pre-filled with your store and merchant details - a Data Processing Addendum (DPA) and a privacy policy - plus the store’s conversation retention control. Review the content against your actual processing and agreements before using it. Find the tab under Settings → Brand → Legal, or go to /app/<storeId>/settings/legal. The page header reads Legal documents with the kicker “Compliance.”

Pre-filled with your details

Both templates are populated server-side with your current store and merchant metadata, so the names and identifiers in the document match your account - you don’t start from a blank form.

Data Processing Addendum

A draft describing processing of shopper data. A downloaded template is not proof of GDPR or UK GDPR compliance and does not by itself create an executed agreement. Your legal adviser should confirm the controller and processor roles, the legal entities, and whether the draft fits the relationship between your business and Zubby.

Click Download DPA to fetch a draft. Check its parties, processing purpose, data categories, retention, subprocessors and transfer terms with your legal adviser. Ask Zubby for the applicable agreement and execution process before signing; do not assume your shopper is the other party.

Privacy policy

A plain-text privacy policy describing how Zubby handles shopper data on your behalf. Adapt it to your actual store practices and have it reviewed before adding it to your store footer. Click Download privacy policy to get it.

How downloads work

Each button links to a dedicated export endpoint that generates the document for your store on the fly - the DPA and privacy policy are served from /api/v1/exports/legal/<storeId>/dpa and /api/v1/exports/legal/<storeId>/privacy respectively. Because they’re generated from live data, re-downloading after you update store details gives you a refreshed copy.

Conversation retention

Below the documents sits a Conversation retention card. Pick how long shopper conversations (and linked free-form channel and learning content) are kept - the dropdown offers 30 days, 90 days, 180 days, 1 year (the default), 2 years, 5 years, or 10 years - then click Save retention. Retention is evaluated daily and permanently deletes anything older than the window.

Deletion cannot be undone

Retention is enforced by a daily job and deletions are permanent. If you shorten the window, older conversations are removed on the next run - export anything you need first.

Preparing for a compliance request

Make sure your store details are current in Settings - the templates are generated from live data, so stale details produce a stale document.
Click Download DPA and Download privacy policy to pull fresh copies.
Set conversation retention to match what your privacy policy promises, so practice and paperwork agree.
Have counsel confirm the parties and applicable terms, then follow the agreed execution process. Keep the approved version and date.

A starting point, not legal advice

The page is explicit: these templates are a starting point and not a substitute for legal review. Have your own counsel sign off before you publish or sign anything. Zubby provides the scaffolding; the legal responsibility for what you publish is yours.

When you’ll need these

Closing B2B deals - enterprise buyers routinely require a signed DPA before they’ll let a vendor process data.
Selling into the EU/UK - ask your legal adviser which processor agreement, notices and rights workflows apply to your store.
Responding to a data-protection questionnaire - having a pre-filled DPA on hand shortens vendor review cycles.

For the account-protection controls that sit alongside compliance, see Security. Data-subject requests and shopper privacy controls connect to the broader privacy tooling - review your Settings overview for where those live, and the pricing page for plan availability.

Check retention before shortening it

Use the Settings permission to review the chosen conversation window. Export the records you need through supported report paths before saving a shorter period. The daily retention task must run before old records disappear; a saved value alone is not evidence that deletion completed. This setting is not a promise that every billing record, operational log or backup uses the same window. Ask Zubby for the applicable data map and contractual retention terms when those details are required.