Data processing agreement

Last updated: 2026-09-01

This Data Processing Agreement applies when Boresha Labs processes store data on your behalf as a processor, and you (the Shopify merchant) are the controller.

1. Subject matter

We process shop, catalog, brand, media, staff-session, billing-identifier, and support data so we can generate listing proposals and, after your decision, write them to Shopify.

2. Duration

For as long as the app is installed, plus the time needed to honour uninstall and shop/redact.

3. Nature and purpose

AI generation of listing copy and media, credit metering, run history, and email support. We do not process Shopify customers, orders, or cards.

4. Subprocessors

Shopify, OpenRouter, Cloudflare, Railway, and Resend, as named on the privacy policy. We will keep that list current.

5. Security

Access to merchant data is shop-scoped in the app. Staging objects are not public. Tokens are encrypted at rest. HQ, if it exists later, cannot use a merchant’s access token.

6. International transfers

Production application hosting is in Amsterdam. Inference and email providers may process data in other regions. You instruct us to use those subprocessors by installing the app.

7. Assistance and deletion

We assist with access and deletion requests sent to support@boresha.app. After shop/redact we delete or anonymize shop data we no longer need.

8. Counsel

This DPA is an accurate description of the live system. It is not a substitute for negotiated enterprise terms.