Data Processing Agreement Overview

For merchant-directed shopper and connected-store data, the merchant generally determines the purposes and Zubby AI processes that data to provide the enabled service. Zubby AI may act independently for account security, billing records, legal compliance, and its own business administration where applicable law assigns a separate role.

Processing instructions come from the service configuration, documented product use, support instructions, and the signed customer agreement.

Data may include merchant users, store configuration, catalog and order context, shopper conversations and contact details, storefront events, and integration credentials. It is processed to operate storefront assistance, recommendations, recovery and communication workflows, reporting, support, fraud prevention, and security.

Merchants must configure lawful notices, consent, channel permissions, and retention appropriate to their store and shoppers.

The public sub-processor page distinguishes live core providers from optional providers that receive data only when enabled. The current deployment does not offer a self-service EU/US residency selector.

Transfer terms, hosting-provider identity, region, and any standard contractual clauses must be confirmed in the signed DPA or order form for the tenant. This page does not claim that unexecuted SCCs, an IDTA, or a residency option already applies.

Shipped safeguards include server-side tenant authorization, encrypted integration secrets, verified webhooks, restricted database access, audit records, deletion workflows, and worker-enforced retention. Data handling is described in the Privacy Policy.

Verified access, correction, export, deletion, or regulatory-assistance requests can be sent to hello@zubbyai.com. Response timing follows applicable law and the signed agreement; no shorter blanket deadline is promised here.