loving
Legal

Data Processing Addendum

Last updated: 2026-10-13

This Data Processing Addendum ("DPA") is part of the Terms of Use between the merchant and lovingapp, Inc. ("loving"). It applies whenever loving processes personal data on a merchant's behalf through the platform, and it is how the two parties meet Article 28 of the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection and other data-protection laws with similar requirements. If this DPA conflicts with the Terms, this DPA wins for the processing it covers.

Definitions

"Personal data", "controller", "processor", "processing", "data subject", "personal-data breach" and "supervisory authority" have the meanings given by applicable data-protection law (including the GDPR, where it applies). "Store data" means the personal data loving processes for a merchant under this DPA, described in Annex A. "Sub-processor" means a provider loving engages to process store data.

Roles

For store data, the merchant is the controller and loving is the processor. Store data covers what a store collects from its customers, visitors and contacts — customer accounts and records, carts, orders, reviews, conversations, marketing lists and consents, storefront analytics, loyalty, gift cards, subscriptions, event registrations — and the records the merchant keeps about its own team.

loving acts as an independent controller for: merchant and staff login accounts; platform billing records; the loving account shoppers sign in with across stores (their identity, address book, saved cards and sessions — a store receives a shopper's contact details from it when the shopper signs in there and accepts its policies, and from then on holds them as controller of its own copy); records of acceptance of loving's legal documents; and the security, abuse-prevention and AI-usage logs loving keeps to run the platform. This DPA does not cover that processing; the Privacy Policy does.

loving's establishment and representatives

loving is established in the United States and has no establishment in the European Union or the United Kingdom. Its registered details are in the Legal Notice. The GDPR and the UK GDPR apply to loving under their Article 3(2) for the processing it carries out as controller; for store data, loving is bound by this DPA and by the Standard Contractual Clauses described under "International transfers".

  • Representative in the EU (Article 27 GDPR): [to be completed]
  • Representative in the UK (Article 27 UK GDPR): [to be completed]

Processing on documented instructions

loving processes store data only on the merchant's documented instructions: the features the merchant uses and configures in the dashboard, the AI builder and the storefront, this DPA, and any other written instruction the parties agree. That includes transfers of store data to third countries. If the law requires loving to process store data otherwise, loving will tell the merchant first unless the law forbids it.

loving will tell the merchant without delay if, in its opinion, an instruction infringes data-protection law, and may decline to carry it out until it is confirmed or changed.

loving does not sell store data, does not use it for its own advertising or for any other merchant, and does not use it to train AI models. Purchase conversions are sent to an advertising platform only when the merchant has connected that platform, and only for orders whose visitor granted marketing consent — on the merchant's instruction, as its processor.

Confidentiality

Everyone loving authorizes to process store data is bound by confidentiality. Access to production data is restricted to what operating the service requires and to personnel approved by loving's Security & Privacy Lead.

Security

loving implements the technical and organizational measures in Annex B, which take into account the state of the art, the cost of implementation and the nature, scope, context and purposes of the processing. loving may update them provided the overall level of protection is not reduced.

Sub-processors

Authorization. The merchant gives loving general authorization to engage the sub-processors listed at Sub-processors.

Changes. loving will give at least 30 days' notice before adding or replacing a sub-processor of store data, by updating that page and announcing the change in the dashboard. Where an urgent replacement is needed to keep the service running or secure, loving may give shorter notice and will explain why.

Objection. The merchant may object on reasonable data-protection grounds within the notice period. The parties will then discuss it in good faith; if loving cannot offer a reasonable alternative, the merchant may stop using the feature that relies on that sub-processor, or terminate the Terms, without penalty.

Flow-down and liability. loving imposes on each sub-processor, by contract, data-protection obligations that give at least the same protection as this DPA. loving remains fully liable to the merchant for each sub-processor's performance of those obligations.

Assistance with data-subject requests

Data subjects can exercise most rights directly: shoppers can download their data, delete their loving account, ask a store to forget them and switch off profiling; merchants can export a customer's data, erase a customer and switch off profiling for a customer from the dashboard. Taking into account the nature of the processing, loving will assist the merchant with appropriate measures to answer any request it cannot fulfil through those tools. If loving receives a request about store data directly, it will pass it to the merchant (or ask the data subject to contact the merchant) and will not answer it itself unless the merchant instructs it to.

Assistance with security, assessments and authorities

Taking into account the nature of the processing and the information available to it, loving will assist the merchant in meeting its obligations under Articles 32 to 36 GDPR: security of processing, notifying and communicating personal-data breaches, data-protection impact assessments, and prior consultation with a supervisory authority — including by providing the information in this DPA, the sub-processor list and Annex B, and by answering reasonable additional questions.

Personal-data breaches

loving will notify the merchant without undue delay, and in any event within 72 hours of becoming aware of a personal-data breach affecting store data, by email to the store owner and by a notice in the dashboard. The notice describes, as far as known: the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact for more information. Information not yet available will follow as soon as it is. loving will take reasonable steps to contain the breach and will cooperate with the merchant's own notifications. A notice is not an admission of fault.

International transfers

Store data is hosted primarily in the European Union (Convex, on Amazon Web Services in Ireland). loving is established in the United States, its personnel reach store data from there, and some sub-processors process it there or elsewhere, as listed at Sub-processors.

Store data that is subject to the GDPR is therefore transferred to a country without an adequacy decision, and the parties rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), which are incorporated into this DPA by reference:

  • Module 2 (controller to processor) applies between the merchant as data exporter and loving, in the United States, as data importer;
  • Module 3 (processor to processor) applies between loving and each sub-processor that processes store data outside the EEA, unless an adequacy decision covers the country where it does so.

For the SCCs: Clause 7 (docking) applies; under Clause 9 option 2 (general authorization) applies, with the notice period in "Sub-processors"; the optional wording in Clause 11 does not apply; under Clause 13 the competent supervisory authority is the one determined by the merchant's establishment or representative; Clauses 17 and 18 are governed by the law, and subject to the courts, of Ireland. Annex A of this DPA is Annex I of the SCCs, Annex B is Annex II, and the sub-processor list is Annex III.

For data subject to the UK GDPR, the SCCs apply as amended by the UK International Data Transfer Addendum issued by the Information Commissioner. For data subject to the Swiss Federal Act on Data Protection, the SCCs apply with the amendments the Swiss Federal Data Protection and Information Commissioner requires (references to the GDPR read as references to the FADP, and the Commissioner as the competent authority). If the SCCs conflict with this DPA, the SCCs win.

Deletion and return

Store data is available to the merchant through the dashboard, including exports, for the life of the store. When the merchant deletes the store, a 30-day recovery window starts; after it, loving permanently deletes the store data, including from active systems, unless the law requires loving to keep some of it (for example invoices and payment ledger entries). Retained records stay protected under this DPA until they are deleted. Backups are overwritten on the backup provider's schedule.

Audits and inspections

loving will make available to the merchant all information necessary to demonstrate compliance with Article 28 GDPR and this DPA: this page, the sub-processor list, Annex B, loving's security and privacy policies on request, and answers to reasonable written questionnaires.

If that information is not enough — or a supervisory authority requires it — loving will allow and contribute to audits, including inspections, by the merchant or an independent auditor it appoints and who is bound by confidentiality. The merchant will give at least 30 days' written notice (unless a breach or an authority requires less), conduct the audit during business hours without disrupting the service or seeing other merchants' data, bear its own costs, and not audit more than once a year unless a breach or an authority requires it. Where loving's providers hold certifications or audit reports (for example SOC 2 or ISO 27001), loving may use them to answer the parts of an audit that concern those providers.

Term

This DPA applies for as long as loving processes store data for the merchant, and survives the end of the Terms until the store data is deleted or returned.

Annex A — processing details

  • Subject matter and duration: operating the merchant's storefront and commerce back office, for the life of the store plus the deletion window.
  • Nature and purposes: hosting and storage; customer accounts and records; carts, checkout, orders, payments metadata, returns and refunds; shipping and fulfilment (sharing delivery addresses with carriers); reviews and favorites; loyalty, gift cards, subscriptions and events (registration and check-in); customer service across the storefront chat and the inbox channels the merchant connects (WhatsApp, Instagram, Messenger, TikTok, Telegram, email), with AI reply drafts a person reviews; the storefront AI shopping assistant and AI features such as virtual try-on; storefront analytics and attribution under the visitor's consent choice; customer profiles, segments, lifecycle stages, rule-based predictions and automated journeys (CRM profiling); marketing email and WhatsApp messages to people who consented; sending purchase conversions to advertising platforms the merchant connects, for orders whose visitor granted marketing consent; transactional email; the merchant's team records (people, schedules, time and attendance, leave and payroll); the loving AI agent acting on the merchant's requests; fraud and abuse prevention.
  • Categories of data subjects: the store's customers and shoppers (signed in and guests); storefront visitors; event guests; people who contact the store through a connected channel; gift-card recipients; marketing subscribers; and the merchant's own staff and team members.
  • Categories of personal data: identity and contact details (name, email, phone); shipping and billing addresses; order, subscription and payment metadata (never full card numbers); account identifiers; reviews and their photos; conversation content and attachments; consent records (choice, source, wording version, time); storefront activity (pages and products viewed, cart and checkout events, campaign tags, ad-click identifiers when consented, a pseudonymous visitor identifier); customer segments, lifecycle stages and predictions; loyalty balances and gift-card balances; event registrations and check-ins; photos a shopper submits to a try-on feature; language preference; IP-derived country and browser details; and, for the merchant's team, contact and emergency-contact details, role, documents, schedules, time and attendance, leave, pay terms and payslips.
  • Special categories: none intended. Sensitive product types (such as maternity, nursing, period and adaptive wear) are excluded from profiling. Merchants must not direct special-category data to the platform except where the law allows and they have a lawful basis (for example a team member's sick-leave record).
  • Frequency: continuous, for as long as the store uses the platform.
  • Retention: as configured by the merchant and as described in the Privacy Policy (for example storefront analytics 180 days by default, consent records 13 months, shopping-assistant chats 12 months after last activity, try-on images 30 days, team records 36 months after employment ends by default).

Annex B — security measures

  • Hosting and segregation. Managed cloud infrastructure only. The database is reachable only through loving's authenticated functions, never directly. Development and production are separate deployments with separate data and secrets.
  • Tenant isolation. Every store's data carries its store identifier and every query is scoped to it; automated tests fail the build when key access checks are missing. Storefront customer sessions are isolated per store.
  • Access control. Least privilege and need to know; merchant-chosen granular staff permissions, checked on every dashboard function; the AI agent acts with the permissions of the person using it and asks for approval before high-impact actions; production access limited to approved personnel with multi-factor authentication; access reviewed quarterly and revoked within 24 hours of departure.
  • Encryption. TLS 1.2 or higher in transit; encryption at rest by the infrastructure providers; connected-platform tokens and API keys additionally encrypted with AES-256-GCM; gift-card codes, webhook secrets and guest chat tokens stored as one-way hashes; buyer email and phone sent to ad platforms only as SHA-256 hashes; card data held only by Stripe.
  • Authentication. One-time email codes or Google sign-in; no platform passwords; sign-in codes rate-limited and single-use.
  • Integrity and logging. Inbound webhooks accepted only with a valid signature; changes in each store recorded in its activity log; owner-console actions in an audit log.
  • Availability and resilience. Provider backups with a restore tested yearly; a 30-day recovery window for store deletion.
  • Vulnerability management. Dependency alerts and audits, secret scanning, review and automated tests before release, fixed timelines by severity.
  • Incident response. A documented process with severity levels, evidence preservation and the notification timelines in this DPA.
  • Personnel. Confidentiality obligations, security onboarding, encrypted and locked devices, and a security baseline for every device used for loving work.

Annex C — sub-processors

The current list, with what each sub-processor does, where it processes data and the transfer safeguard that applies, is at Sub-processors.