Merchant Terms of Service and Data Processing Addendum

Part A. Terms of Service (summary)

1. The service. Stravax Engage is a WhatsApp engagement platform operated by Stravax Group LLC, a limited liability company licensed by Sharjah Media City Free Zone Authority (Shams), Sharjah, United Arab Emirates (Licence No. 2537844.01), registered at Sharjah Media City (Shams), Al Messaned, Al Bataeh, Sharjah, UAE. The Shopify app sends WhatsApp abandoned-cart and order-recovery messages to your customers, on your instruction, and reports whether they led to a completed order.

2. Your account. You are responsible for the accuracy of your account details, for keeping your login credentials secure, and for the actions of the users you invite.

3. Your responsibilities as the merchant. You are the controller of your customers' data. You are responsible for having a lawful basis and the consent required to message your customers on WhatsApp, and for complying with WhatsApp's and Meta's messaging policies. The app respects the marketing-consent flag on each Shopify checkout, but obtaining valid consent remains yours.

4. Fees. Cart recovery is billed through Shopify's managed pricing at the plan price shown in the app. WhatsApp message costs are metered and drawn from your prepaid wallet balance.

5. Acceptable use. You will not use the service to send unlawful, deceptive, or unsolicited messages, or to message customers who have not consented.

6. Availability and liability. The service is provided on a commercially reasonable-efforts basis. Nothing here excludes liability that cannot be excluded under UAE law.

7. Termination. You may uninstall the app at any time. On uninstall we stop all recovery messaging, delete the stored access token, and delete the customer data we hold for your store as described in Part B, section 7.

Part B. Data Processing Addendum (DPA)

1. Roles

For the customer personal data processed through the Shopify integration:

• You (the merchant) are the data controller.
• Stravax Group LLC is the data processor, acting only on your documented instructions.

Installing the app and enabling cart recovery is your instruction to process this data for the purpose in section 3.

2. Categories of data and data subjects

• Data subjects: your customers who abandon a checkout or place an order in your store.
• Personal data processed: the customer's name and phone number, plus non-personal cart metadata (checkout token, cart recovery URL, currency, cart total, item count, timestamps).
• Not processed: we do not store customer email addresses, billing or shipping addresses, payment details, or order line items.

3. Purpose and scope of processing

We process the data solely to:

• send your customer a WhatsApp cart-recovery or order-recovery message, and
• record whether a recovery led to a completed order, so you can see recovery performance.

We do not use the data for our own purposes, do not sell it, and do not share it except with the sub-processors in section 5. We do not combine your customers' data with any other merchant's.

4. Confidentiality and security

We apply the following technical and organisational measures:

• Encryption in transit: TLS/HTTPS for all data. Every inbound Shopify webhook is verified by HMAC-SHA256 signature before processing; unsigned or mis-signed requests are rejected.
• Encryption at rest: Cloudflare D1 and R2 encrypt stored data at rest at the platform level. Your Shopify Admin API access token is additionally encrypted with AES-256-GCM at the application layer before storage.
• Tenant isolation: every record carries your organisation id and every query is scoped to a single organisation. Your store's binding to your account is established only through a verified Shopify OAuth install, never from a client-supplied value, which prevents another party from claiming your store.
• Access control and logging: administrative and compliance actions are recorded in an append-only audit log.

5. Sub-processors

You authorise the following sub-processors:

The Anthropic AI qualifier is a separate opt-in feature. It processes WhatsApp conversation message content for merchants who turn it on; it does not receive the Shopify-sourced customer name or phone number. If you do not enable it, no data reaches Anthropic.

We will give you notice of any new sub-processor that would process the customer name or phone before it takes effect.

6. Personal data breach notification

If we become aware of a personal data breach affecting your customers' data, we will notify you without undue delay, and no later than 72 hours after becoming aware, with the information you reasonably need to meet your own notification obligations: the nature of the breach, the data and approximate number of records affected, the likely consequences, and the measures we have taken or propose to take. Our incident-handling process is described in the Incident Response Policy.

7. Deletion and return of data

• On uninstall: when you uninstall the app, we immediately stop recovery messaging, delete your stored Shopify access token, and disable the integration. Shopify then sends us a shop/redact request (typically 48 hours after uninstall), on receipt of which we delete all abandoned-checkout records we hold for your store.
• Per-customer deletion: on a Shopify customers/redact request we delete that customer's abandoned-checkout records for your store, matched by phone number.
• Data-access request: on a Shopify customers/data_request we log the request and fulfil it manually, since the only data we hold for a customer is their abandoned-checkout contact data.
• Retention: abandoned-checkout records are in any case retained for no more than 90 days and then deleted, per the Data Retention Policy.

8. Audits and assistance

We will provide reasonable information to help you demonstrate compliance and to respond to data subject requests, taking into account the nature of the processing and the information available to us.

9. Governing terms

This DPA supplements and is governed by the Terms of Service in Part A. In case of conflict on data-protection matters, this DPA prevails.

Acceptance: By clicking to connect your store, or by enabling cart recovery, you accept these Terms of Service and this Data Processing Addendum on behalf of your business.

Stravax Group LLC, Sharjah, UAE · Data protection contact: privacy@stravax.ai