Data Processing Addendum

1. Roles of the Parties

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Controller") and Ultimate Closer / UltimateCloser.Ai ("Processor"). For personal data you submit or process through the platform, you are the controller and we process that data only on your documented instructions.

2. Scope and Purpose of Processing

• Subject matter: provision of UltimateCloser.Ai shopper engagement, catalog synchronization, store analytics and cart-recovery services for connected Shopify and WooCommerce stores.
• Duration: the term of your subscription plus any legally required retention period.
• Categories of data subjects: your personnel and your store visitors, shoppers and customers who interact with your storefront or its recovery messages.
• Categories of data: merchant account details; pseudonymous visitor and device identifiers; page, product, cart, checkout and exit-intent events; shopper-provided email addresses and consent status; agent conversations; order identifiers, values and attribution data; and support communications.

3. Prohibited Data — No PHI, No Special Categories

Ultimate Closer is not HIPAA-compliant and will not act as a Business Associate. You must not submit Protected Health Information, medical records, or health data. You must also not submit payment card data, government identifiers, biometric data, or other special-category data. Processing prohibited data is a material breach and you are solely liable for resulting claims and penalties.

4. Controller Obligations

You warrant that you have a valid lawful basis and all required consents for the personal data you process through the platform, including any notice or consent required for storefront tracking and communications under the TCPA, CAN-SPAM, GDPR/ePrivacy, CASL, and comparable laws, and that your instructions to us do not violate applicable law.

5. Processor Obligations

• process personal data only per your instructions and this DPA;
• impose confidentiality obligations on personnel with access;
• maintain appropriate technical and organizational measures, including encryption in transit, access control, and tenant-level database authorization;
• assist you, at your cost and to the extent reasonable, with data subject requests, impact assessments, and regulator inquiries;
• notify you without undue delay after becoming aware of a personal data breach affecting your data.

6. Subprocessors

You authorize our use of subprocessors for hosting, database and authentication, payment processing, email delivery, analytics, and AI model inference (including Google for Gemini model calls). We remain responsible for their performance of the obligations in this DPA and will provide notice of material changes to our subprocessor set, allowing you to object on reasonable data-protection grounds.

Stripe processes billing for direct website and WooCommerce purchases. If you purchase UltimateCloser.AI for Shopify through the Shopify App Store, Shopify processes that payment directly through its app-billing system under your separate agreement with Shopify. We receive only the subscription, invoice and payment-status information needed to provision the Service and maintain billing records.

7. Bring-Your-Own AI Keys

Where you connect your own AI provider credentials, the provider processes your prompts under your direct agreement with that provider. You are responsible for that relationship, its terms, and its fees; we are not a party to it.

8. International Transfers

Personal data may be processed in the United States and other jurisdictions where our subprocessors operate. Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses, which are incorporated by reference for restricted transfers.

9. Deletion and Return

On termination, we delete or return your personal data within a commercially reasonable period, except where retention is required by law. You may export or request deletion at any time via privacy@ultimatecloser.ai.

10. Governing Law

This DPA is governed by the laws of the State of Nevada, with exclusive venue in Nevada state and federal courts, consistent with the Terms of Service. In the event of conflict between this DPA and the Terms regarding personal data processing, this DPA controls.