Data processing addendum

How we process your shoppers’ data on your behalf.

This addendum sets out the terms on which Pirahas Türkiye processes personal data for a merchant that installs Refik by Pirahas. Every description of what the system does is a description of the code that ships today; every commitment is one we can keep with the system as it is.

Effective 31 October 2026 Not reviewed by counsel What this addendum is not

1 · Parties

Who this addendum is between, and how it is accepted.

It applies to every store that installs Refik, from the moment of installation, and to no other relationship.

Processor: Pirahas Türkiye, Uludağ University ULUTEK Technopark, Bursa, Türkiye — the company that provides Refik by Pirahas (“Pirahas”, “we”).
Controller: The merchant whose Shopify store installs Refik (“you”).
Contact: [email protected] for anything under this addendum, including notices to us.
Acceptance: By installing or using Refik you agree to this addendum. A copy countersigned by Pirahas is available on request at [email protected].
Customer Personal Data: Personal data about your shoppers and your staff that Refik processes on your behalf, described in section 3.

2 · Roles, subject matter and duration

You decide why the data is processed. We process it for those purposes only.

2.1 Roles: You are the controller of Customer Personal Data and Pirahas is your processor. Our own staff access log (section 6) records which of our people looked at what; it is a record about us, and we hold it as its controller.
2.2 Shopify: Shopify is the platform your store runs on and the party you contract with for it. It is not our sub-processor: we read from and write to your store through the permissions you approve at install.
2.3 Subject matter: Providing Refik: an AI shopping assistant on your storefront and the console in which you read its conversations, configure it and invite your team.
2.4 Duration: For as long as Refik is installed on your store, and afterwards only until the deletion described in section 10 has run.
2.5 Purposes: Answering product, routine and policy questions from your own catalogue and text; order status and tracking for the shopper the order belongs to; opening a return request the shopper asked for, which a person in your store approves; handing a conversation to your team; sending a back-in-stock event to your own Klaviyo account, if you configured one; remembering a preference a shopper stated; your console; and security, rate limiting and error handling for the service.

3 · Categories

Exactly what is processed, and about whom.

Data subjects are your shoppers who use the storefront assistant, and the members of your team you invite to the console.

E-mail address

Three uses, and no marketing

To verify a guest’s order lookup, where the order number and the e-mail on the order must match before any status is shown. As the contact address when a conversation is handed to your team. And for a back-in-stock request the shopper made: by default Refik asks the shopper to confirm before signing them up, and it never guesses an address.

The conversation

What was said, and a little context

The shopper’s messages and the assistant’s replies, the trace of which tools ran, a saved routine they built, a thumbs up or down, and when that shopper was first and last seen. A guest is identified only by a random identifier held in their own browser.

Their own order

Read when they ask about it

Order number and date, fulfillment status, expected and actual delivery, carrier, tracking number and link, the carrier’s event messages and the product titles — for a shopper Shopify has signed in, or a guest who supplied the order number and the matching e-mail.

In your store

A preference metafield

Preferences a shopper stated about themselves, written with a timestamp to a refik/profil metafield on their own Shopify customer record. No other customer field is written.

Your team

Console users

The e-mail address and role of each teammate you invite, used to sign them in individually and to send them invitations and service alerts.

Not processed

Names, addresses, phone numbers, cards

No query in the server asks Shopify for a shopper’s first name, last name, phone number or address, and card and payment data stay with Shopify. A shopper can type anything into a chat box; if they write such a detail, it is in the conversation because they wrote it there.

4 · Instructions and confidentiality

Your instructions, and nobody else’s.

4.1 Documented instructions: We process Customer Personal Data only on your documented instructions. Those are this addendum, the way you configure Refik (its settings, and which of its actions are on, off, or need the shopper’s confirmation), and what you do in the console. If we are required by law to process it otherwise, we will tell you first unless that law forbids it.
4.2 Unlawful instructions: We will tell you if, in our view, an instruction would infringe applicable data protection law.
4.3 No other use: We do not sell Customer Personal Data, do not share it for cross-context behavioural advertising, do not send marketing e-mail to your shoppers, and do not use it to train models. Neither AI provider’s terms we use permit training on what we send.
4.4 Confidentiality: Any person we authorise to access Customer Personal Data is bound to keep it confidential, and has access only as far as their work on Refik requires.

5 · Security

The measures in place today.

This list is deliberately limited to what the system does now. The longer, technical account is on the security page.

In transit: Every call the service makes to Shopify, the AI providers and its other services is HTTPS — the code contains no plain-HTTP address — and the app sets strict transport security on its HTTPS responses.
At rest: Data is stored in Cloudflare D1 and Workers KV, which Cloudflare documents as encrypted at rest.
Store tokens: The Shopify access token for your store is additionally encrypted by our application with AES-GCM and a 256-bit key held only in the server’s secret store, with a fresh nonce for every encryption and support for rotating the key.
Separation of stores: Every store is a separate tenant and every query is scoped to that store in the data layer. Which store a privacy webhook applies to is read from the part of the request Shopify signed.
Verified requests: Storefront requests arrive through Shopify’s App Proxy and their signature is checked; webhook signatures are checked over the raw body before it is parsed; the console inside Shopify admin uses Shopify’s own session token.
Staff access: Our internal admin panel sits behind Cloudflare Access. Our server verifies the Access token itself and admits only addresses on an explicit allow-list; if that configuration is missing, the panel refuses every request.
Access logging: Every read our staff make through the admin panel writes an entry in an access log before the data is read; refused attempts are logged too. Section 6 has the retention.
Data minimisation: E-mail addresses and phone numbers are masked in the stored record of which tools ran. A signed-in shopper’s account e-mail and customer ID are not placed in the AI model’s context; at a handoff the model is told only that an e-mail is on file.

6 · Sub-processors

Who else processes the data, and how you hear about a change.

You authorise the sub-processors below. We remain responsible to you for the part of the processing each one performs.

Cloudflare: Hosting, database, key-value storage and logs. Everything we store sits here.
Anthropic: The AI model that writes assistant replies and product summaries — today’s provider for every store. It receives the conversation, the page the shopper is on, their saved preferences and the order or tracking details a tool returned.
OpenAI: An alternative model provider for the same job. It processes a store’s conversations only if that store is switched to it. No store has been, and we will not switch yours without telling you first.
Resend: Transactional e-mail for the console: sign-in links, team invitations and service alerts, sent to you and the teammates you invite.

Outside this list

Shopify, which is your platform rather than our sub-processor (section 2.2)
Klaviyo: a back-in-stock event goes to your own Klaviyo account under your own agreement with them, and only if you configured one

A change to the list

Before a new sub-processor starts processing Customer Personal Data, we add it to the list on the security page with what it does and what reaches it
We give at least 30 days’ notice by that update and, where we hold an e-mail address for your account, by e-mail
You can object by writing to [email protected]; if we cannot resolve the objection, you may uninstall and section 10 applies

7 · Data subject requests

How we help you answer a shopper.

A shopper’s request goes to your store. Shopify forwards it to installed apps through three mandatory webhooks; Refik is subscribed to all three and acts on each within 30 days.

customers/data_request: We assemble what we hold for that shopper so you can answer them: saved routines and their dates, when they were first and last seen, how many conversation records exist, back-in-stock requests still waiting and the variants they were already told about, and any support handoff on file. The conversation text itself is in your console.
customers/redact: That shopper’s saved routines, first and last seen record, conversation records, back-in-stock requests and notification markers, support handoff, and the preference metafield on their Shopify customer record are deleted. Where one chat session was used by two people, those few shared rows are left alone.
shop/redact: Covered in section 10.
The limit: A guest shopper is only a random identifier in their own browser. We hold no contact details for one, so an e-mail request cannot be matched to their records; they go when you uninstall.
Anything else: For a request the webhooks do not cover — a correction, an objection, a question from an authority — write to [email protected] and we will help with the information we hold.

The route, step by step, is on the data requests page.

8 · Personal data breach

Suspicion starts the clock.

8.1 Shopify: We notify Shopify of any actual or suspected breach of merchant data no later than 24 hours from becoming aware of it, as Shopify’s API terms require. We do not wait for certainty, and we do not wait for a sub-processor’s own notice period to run.
8.2 You: We notify you without undue delay after becoming aware of a breach affecting your store’s Customer Personal Data: what happened, whether your store’s data was affected and which data, what we have done, and anything we need from you. Where we do not yet have all of it, we send what we know and follow up.
8.3 Your obligations: As controller you decide whether to notify a supervisory authority or your shoppers. We give you the information we hold to help you do that.
8.4 Containment: We contain first, preserve the logs and evidence before any destructive remediation, and review every incident afterwards for its root cause and the control that would have caught it earlier.

9 · Retention

How long it stays while you use Refik.

Conversation records, saved routines and first and last seen records are kept for as long as Refik is installed, or until that shopper asks for deletion. Everything else is on a clock set in the code with a cleanup job behind it.

Each period, taken from the code, is listed on the privacy page. Our staff access log is kept for 13 months, and a refused access attempt for 30 days.

10 · End of processing

Deletion when you uninstall, and what you can take with you first.

Before you leave

Return

From the console you can export your conversation records as a CSV file, up to 92 days per export. The preference metafield is already in your own Shopify customer records.

At uninstall

Access stops

Shopify invalidates the access token, so it stops working at once. The copy we cached is deleted along with that store’s settings and the answers you wrote, and billing stops.

Forty-eight hours after uninstall

Everything is deleted

Shopify sends shop/redact, and every database row for your store goes, together with the key-value records and the knowledge base built from your catalogue. If the work cannot finish in one request it is queued and retried until it completes.

What is kept, and why

Our staff access log, for its security retention (section 9); it holds no shopper content, no IP address and no browser details
Billing event records sent to Shopify, which carry no shopper data

Outside our database

Cloudflare keeps a recovery window, so deleted rows may stay restorable there for up to 30 days
A deletion at our end does not reach into the AI providers’ own logs; how long those last is set by their terms, described on the privacy page

11 · International transfers

Where the data is processed.

Hosting: Refik runs on Cloudflare’s global network, so a request is received at a Cloudflare location near the person making it. We did not set a location preference for the database; Cloudflare placed it in eastern North America, and our server is configured to run in the US East region, next to it.
Providers: Anthropic, OpenAI and Resend are companies based in the United States, and processing by them may take place there.
Mechanism: Customer Personal Data may therefore be processed outside the country you or your shopper are in. Where applicable we rely on the Standard Contractual Clauses incorporated in our providers’ data processing terms. Whether that is the right mechanism for your store is a legal question we have not had reviewed.

12 · Audits and precedence

What you can ask us for, and which text wins.

12.1 Information: On reasonable request we provide the information necessary to demonstrate that we meet this addendum: how the system handles a given kind of data, the tests that check it, and answers to your security questions. Any inspection beyond that is agreed with you in advance, in scope and timing.
12.2 Certifications: We hold no SOC 2 report, no ISO 27001 certificate and no PCI or HIPAA attestation, and this addendum does not imply one.
12.3 Precedence: On the processing of Customer Personal Data, this addendum prevails over the terms page and over any other description on this site. Your agreement with Shopify is not affected.
12.4 Changes: We publish any change on this page with a new effective date. A change that reduces the protection of Customer Personal Data is notified to you in the same way as a sub-processor change (section 6).

Status

What this addendum is not.

Written down here so that nothing above is read as more than it is.

Not reviewed by counsel

The descriptions are measured from the code. Whether this text satisfies a particular law in a particular country has not been put to a lawyer.
No governing law clause

Refik has no service agreement yet, so there is no governing law and venue for this addendum to follow, and none is invented here.
No backup copies of ours

The only recovery mechanism is Cloudflare’s own point-in-time recovery of the database; the service makes no separate backup copies of your data.
No outside audit

Nobody outside Pirahas has audited the measures in section 5. What Shopify checks is the permission list and its own App Store requirements.

Questions about this addendum go to Pirahas Türkiye at [email protected] or through the contact page. The other legal pages are listed on the legal hub.