• English

      • HeiChat Data Processing Addendum Policy

      Last updated: 2026-08-17 Effective date: 2025-12-29

      This Data Processing Addendum ("DPA") applies where HeiChat processes personal data on behalf of a Shopify merchant in connection with the merchant's use of HeiChat.

      1. Parties

      Merchant / Controller: the Shopify merchant that installs, accesses, or uses HeiChat.

      Processor: GenCybers INC, registered at 1942 Broadway St. STE 314C, Boulder, Colorado, United States ("HeiChat", "we", "us").

      HeiChat may also appear to merchants under the name Heicarbook in customer-facing or historical product materials. Heicarbook is used as a customer-facing name associated with GenCybers INC and does not identify a separate processor for purposes of this DPA.

      Company registration number: available upon request, if required for contracting or vendor verification.

      2. Relationship to the service agreement

      HeiChat is provided through a self-service Shopify app subscription. This DPA forms part of the agreement governing the merchant's use of HeiChat where HeiChat processes personal data on behalf of the merchant.

      This DPA is incorporated into HeiChat's Terms of Service for merchants using HeiChat.

      HeiChat's Privacy Policy describes additional privacy practices that may apply to merchant account data and other personal data.

      3. Roles

      The merchant acts as controller for personal data of its store visitors, customers, and end users.

      HeiChat acts as processor when it processes such personal data solely to provide the HeiChat customer support assistant, AI response generation, chat history, merchant configuration, and related support services.

      HeiChat may act as an independent controller for limited business account data relating to the merchant's own staff or billing/contact records, as described in HeiChat's Privacy Policy.

      4. Subject matter and duration

      The subject matter is HeiChat's processing of personal data for the provision, maintenance, support, and security of the HeiChat Shopify app.

      The duration is the period during which the merchant uses HeiChat, plus any retention period described in HeiChat's Data Retention and Deletion Policy, unless deletion is requested earlier and deletion is legally and technically possible.

      5. Nature and purpose of processing

      HeiChat processes personal data to:

      • provide AI-assisted customer support chat functionality;
      • retrieve and use relevant Shopify store, product, order, and customer context where authorised by the merchant;
      • generate AI responses to customer questions;
      • maintain chat sessions and conversation history;
      • provide merchant configuration, knowledge base, and support features;
      • monitor service reliability, security, abuse prevention, and debugging;
      • comply with Shopify mandatory privacy webhooks and applicable legal obligations.

      HeiChat will not process merchant customer personal data for unrelated advertising, profiling, sale of data, or training of general-purpose AI models unless this is expressly described in the applicable documentation and lawful under applicable data protection law.

      6. Categories of personal data

      Depending on the merchant's configuration and customer interaction, HeiChat may process:

      • chat messages and conversation metadata;
      • customer name, email address, phone number, Shopify customer ID, or other identifiers if provided in the chat or returned by authorised Shopify APIs;
      • order identifiers, order status, fulfilment/shipping information, product information, and other order-related support context;
      • IP address, browser/device information, URL/page context, and approximate location derived from network metadata, if collected by the service or infrastructure;
      • merchant-provided knowledge base content, shop content, files, instructions, and configuration;
      • technical logs and security events.

      7. Categories of data subjects

      • Shopify store visitors and customers.
      • Merchant staff and authorised users.
      • Individuals whose personal data appears in merchant-provided content or customer support conversations.

      8. Merchant instructions

      HeiChat will process personal data only on documented instructions from the merchant, including this DPA, HeiChat's Terms of Service, merchant configuration in HeiChat, authorised Shopify API scopes, and written support instructions, unless required by applicable law.

      If HeiChat believes an instruction violates applicable data protection law, HeiChat will inform the merchant unless prohibited by law.

      9. Confidentiality

      HeiChat will ensure that persons authorised to process personal data are subject to appropriate confidentiality obligations.

      10. Security

      HeiChat will implement appropriate technical and organisational measures as described in the Technical and Organisational Measures section.

      11. Subprocessors

      The merchant provides general written authorisation for HeiChat to use subprocessors to provide the service. HeiChat will maintain a current list of subprocessors and will impose data protection obligations on subprocessors that are appropriate for the nature of the processing.

      HeiChat will provide notice of material changes to subprocessors by updating the relevant public documentation and/or through other reasonable notice mechanisms.

      12. International transfers

      Personal data may be processed in the United States and other countries where HeiChat or its subprocessors operate. For transfers from the EEA, UK, or Switzerland to countries without an applicable adequacy decision, HeiChat relies on appropriate safeguards as described in the International Data Transfers section, including the European Commission's Standard Contractual Clauses where applicable.

      13. Data subject requests

      Taking into account the nature of the processing, HeiChat will reasonably assist merchants in responding to data subject access, deletion, correction, and objection requests.

      For Shopify mandatory privacy webhooks, HeiChat will process customers/data_request, customers/redact, and shop/redact requests according to HeiChat's Data Retention and Deletion Policy.

      14. Deletion or return

      At the end of the provision of services, HeiChat will delete or return personal data in accordance with the merchant's instructions and HeiChat's Data Retention and Deletion Policy, unless retention is required by law.

      15. Assistance and audits

      HeiChat will make available information reasonably necessary to demonstrate compliance with this DPA. Any audit request must be reasonable, proportionate, limited to information relevant to HeiChat's processing, and subject to confidentiality and security requirements.

      16. Breach notification

      HeiChat will notify the merchant without undue delay after becoming aware of a personal data breach affecting personal data processed on behalf of the merchant. Notification may be provided through the merchant's account contact information, email, in-app notice, or another reasonable communication channel.

      17. Contact

      Privacy contact: heicarbook@gmail.com.