Data Processing Addendum
Last updated: July 11, 2026 · Forms part of the agreement between Charlie OÜ and each merchant using the Charlie app
1. Parties and scope
This Data Processing Addendum ("DPA") applies whenever Charlie OÜ, Lahepea 9, 10617 Tallinn, Estonia, reg. 17461722 ("Charlie", the "Processor") processes personal data on behalf of a merchant using the Charlie app or services (the "Merchant", the "Controller"). It supplements our Terms and applies automatically from the moment the Merchant installs the app — no signature is required, though a countersigned copy is available on request at hello@charlieai.co.
2. Nature and purpose of processing
Charlie processes the Merchant's store data solely to provide an AI email marketing service: syncing customer and product data from the Merchant's Shopify store, generating email campaigns, sending emails to the Merchant's opted-in contacts, and running the Merchant's configured email flows (welcome, abandoned-cart, post-purchase, and similar).
| Item | Description |
|---|---|
| Subject matter | Email marketing operations for the Merchant's store |
| Duration | While the app is installed, plus the deletion window in section 8 |
| Categories of data subjects | The Merchant's customers and newsletter subscribers; the Merchant's staff users |
| Categories of personal data | Name, email address, country, language, marketing consent status and provenance, order history aggregates (order count, revenue), checkout and refund events |
| Special categories | None. The service is not designed to process special-category data and the Merchant agrees not to submit any. |
3. Article 28(3) commitments
Charlie, as Processor, commits to the following (summary of the Article 28(3) GDPR clauses):
- Documented instructions. We process personal data only on the Merchant's documented instructions — given through the app, the Shopify platform (including Shopify's compliance webhooks), or in writing — unless EU or member-state law requires otherwise, in which case we inform the Merchant before processing unless that law prohibits it.
- Confidentiality. Persons authorized to process the data are bound by confidentiality obligations.
- Security (Art. 32). We implement appropriate technical and organizational measures: TLS encryption in transit, encryption of access credentials at rest, per-merchant workspace isolation enforced at the database-access layer, short-lived session-token authentication, audit logging, and least-privilege access to production systems.
- Subprocessors. We engage only the subprocessors listed in section 5 under a general written authorization, flow the obligations of this DPA down to them, and remain fully liable for their performance. We give the Merchant at least 14 days' notice of intended additions or replacements (by updating this page and emailing the Merchant); the Merchant may object on reasonable data-protection grounds, in which case the Merchant may terminate and uninstall.
- Data subject rights. Taking into account the nature of the processing, we assist the Merchant with appropriate technical and organizational measures to fulfil data subject requests. Requests routed through Shopify's compliance webhooks (data access, customer redaction) are fulfilled automatically as described in section 8.
- Assistance (Arts. 32–36). We assist the Merchant with security, breach notification, and data protection impact assessments, taking into account the information available to us.
- Breach notification. We notify the Merchant without undue delay after becoming aware of a personal data breach affecting the Merchant's data, with the information reasonably needed for the Merchant's own notification obligations.
- Deletion or return. At the end of the service, we delete the personal data as described in section 8 (or return it on prior request), unless EU or member-state law requires storage.
- Audit. We make available the information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by the Merchant or an auditor mandated by the Merchant, on reasonable notice and no more than once per year unless a breach or supervisory authority requires otherwise.
4. What Charlie does not do with Merchant data
- No open-tracking pixels and no per-recipient click tracking in sent emails.
- No use of Merchant data to train AI models.
- No cross-merchant sharing, no enrichment, no sale of data.
5. Authorized subprocessors
| Subprocessor | Purpose | Location / transfer mechanism |
|---|---|---|
| DigitalOcean, LLC | Cloud hosting of application and databases | EU data center (Amsterdam, Netherlands); US parent entity — EU Standard Contractual Clauses in place |
| Mailgun Technologies, Inc. / Twilio SendGrid | Email transmission — delivery of the Merchant's campaigns and service notifications | EU sending regions where available; US entities — EU Standard Contractual Clauses |
| Anthropic, PBC | AI content generation. Receives campaign briefs, brand kit, and product content only — never customer lists or individual customer records. No training on this data per commercial agreement. | USA — EU Standard Contractual Clauses / EU-US Data Privacy Framework |
6. International transfers
Charlie stores and processes Merchant store data in the European Union. Where a subprocessor established outside the EU/EEA is used (see section 5), the transfer is governed by the European Commission's Standard Contractual Clauses (Module 2, controller-to-processor, or Module 3, processor-to-processor, as applicable) or an adequacy decision such as the EU-US Data Privacy Framework. Copies of the applicable transfer mechanisms are available on request.
7. Merchant (Controller) responsibilities
- Ensure a valid legal basis (typically consent) exists for email marketing to each contact. Charlie's consent-provenance model records the source and time of opt-in for every synced contact and treats customers without explicit marketing opt-in as non-mailable "pending" contacts.
- Do not import purchased lists or contacts without documented consent.
- Maintain your own privacy policy covering your use of email marketing tools.
8. Deletion timelines
| Event | What happens |
|---|---|
| App uninstalled | Workspace enters offboarding immediately; Shopify revokes our API access |
| shop/redact webhook (48h after uninstall) | Workspace and all store data in it are hard-deleted |
| customers/redact webhook | The customer's data is deleted immediately; only a one-way hash of the email address is retained to prevent re-import |
| customers/data_request webhook | A dump of the data we hold about that customer is compiled and sent to the Merchant the same day (Shopify SLA: 30 days) |
| Records required by law | Billing/accounting records retained 7 years under Estonian law |
9. Liability and order of precedence
Liability under this DPA is subject to the limitations in the main Terms. If this DPA conflicts with the Terms on data protection matters, this DPA prevails. If mandatory Standard Contractual Clauses apply, the SCCs prevail over both to the extent of any conflict.
10. Contact
Data protection matters: hello@charlieai.co
Charlie OÜ, Lahepea 9, 10617 Tallinn, Estonia · Reg. 17461722 | VAT: EE102966275