Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Friendzy service terms (the "Terms") between:

• the merchant that installs or uses the Friendzy app on its Shopify store (the "Merchant"), as controller; and
• SWARMSOFT S.R.L., a Romanian company with registered office in Cluj-Napoca, Romania, trade register no. J12/3072/2015, fiscal code 35103599 ("SWARMSOFT", "we"), as processor,

each a "Party".

The Merchant accepts this DPA by installing Friendzy or by accepting the Terms, whichever comes first. SWARMSOFT will provide a copy signed with a qualified electronic signature on request; the signed copy and the published text are the same agreement.

1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in Regulation (EU) 2016/679 (the "GDPR"). In addition:

• "Merchant Personal Data": personal data that SWARMSOFT processes on the Merchant's behalf in providing Friendzy on the Merchant's store, as described in Annex I.
• "Sub-processor": a processor engaged by SWARMSOFT to process Merchant Personal Data.
• "Data Protection Law": the GDPR, Romanian Law no. 190/2018, and any other data protection law that applies to the processing.
• "Shopify": Shopify Inc. and its affiliates, whose platform the Merchant uses and through which Friendzy is installed.

2. Scope and roles

2.1 For Merchant Personal Data the Merchant is the controller and SWARMSOFT is the processor.

2.2 This DPA does not cover personal data for which SWARMSOFT is itself a controller, as described in its privacy notice at https://friendzy.online/privacy. That includes:

• the Merchant's own account, billing and support relationship with SWARMSOFT;
• SWARMSOFT's operations logs, crash reports and product metrics;
• its website, outreach and affiliate programme.

2.3 The shopper account. A shopper's Friendzy account is a single account the shopper uses on every store that runs Friendzy: name, email, avatar, bio, password hash or social sign-in link. It is held by SWARMSOFT as controller and is not Merchant Personal Data. What the shopper does on the Merchant's store (sessions, chat, voice messages, saved lists, attribution and the rest of Annex I) is Merchant Personal Data. When the Merchant asks for a shopper's data to be erased (clause 9), that store's data is deleted. The account itself is deleted once no other store holds data for the shopper.

2.4 Shopify's own data processing terms govern the relationship between the Merchant and Shopify only. They do not cover Friendzy, and this DPA does not cover Shopify.

3. Subject matter, duration, nature and purpose

3.1 Subject matter. Providing Friendzy on the Merchant's store:

• shared shopping sessions, chat, voice messages, calls, co-browsing;
• store advisers, creator rooms, saved product lists, rewards, purchase attribution;
• events sent to the Merchant's own tools;
• the AI assistant, where the Merchant's plan includes it.

The details are in Annex I.

3.2 Duration. From the Merchant's installation of Friendzy until deletion under clause 12. The obligations on deletion, confidentiality and audit continue until all Merchant Personal Data has been deleted.

3.3 Nature and purpose. Collection, storage, transmission to session participants, display, retrieval, aggregation and deletion, solely to provide Friendzy to the Merchant, its shoppers and its staff as the Merchant configures it (Annex I).

3.4 Data subjects and categories of data. As set out in Annex I. No special categories of personal data are intended to be processed. The Merchant will not configure Friendzy to collect them, and tells its shoppers not to share them in chat.

4. The Merchant's instructions

4.1 SWARMSOFT processes Merchant Personal Data only on the Merchant's documented instructions, including with regard to transfers to a third country, unless Union or Member State law to which SWARMSOFT is subject requires otherwise. In that case SWARMSOFT informs the Merchant of that legal requirement before processing, unless that law prohibits it on important grounds of public interest (GDPR art. 28(3)(a)).

4.2 The Merchant's documented instructions are:

• the Terms and this DPA;
• the Merchant's configuration of Friendzy in its admin: who sees it, private pages, which data advisers see, rewards, advisers and creators it invites, the AI assistant, and the destinations it chooses for session events;
• any further written instruction agreed by the Parties.

4.3 SWARMSOFT informs the Merchant immediately if, in its opinion, an instruction infringes Data Protection Law (GDPR art. 28(3), last subparagraph).

4.4 The Merchant's responsibilities. The Merchant is responsible for:

• the lawfulness of the processing it instructs, including its legal basis;
• informing its shoppers and staff, in its own privacy notice, that it uses Friendzy;
• obtaining any consent that Data Protection Law or the ePrivacy rules require on its store;
• configuring Friendzy's private-page and element exclusions for its theme;
• any destination it instructs SWARMSOFT to send data to (its Shopify Flow, or a web address it chooses), and any transfer that destination involves.

5. Confidentiality

SWARMSOFT ensures that persons authorised to process Merchant Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (GDPR art. 28(3)(b)). Access is limited to those who need it to provide, support or secure Friendzy.

6. Security

6.1 SWARMSOFT implements the technical and organisational measures in Annex II. They ensure a level of security appropriate to the risk (GDPR arts. 28(3)(c) and 32).

6.2 SWARMSOFT may update those measures as technology and risks change, provided the level of protection is not reduced.

7. Sub-processors

7.1 General authorisation. The Merchant gives SWARMSOFT general written authorisation to engage the Sub-processors listed in Annex III (GDPR art. 28(2)).

7.2 Notice of changes. SWARMSOFT gives the Merchant at least 30 days' notice of any intended addition or replacement of a Sub-processor. Notice goes by email to the Merchant's account address and on the list at https://friendzy.online/subprocessors.

7.3 Objection. The Merchant may object on reasonable data-protection grounds within that period. The Parties then discuss the objection in good faith. If it is not resolved, the Merchant may stop using the affected feature or uninstall Friendzy, and deletion follows under clause 12.

7.4 Flow-down. SWARMSOFT imposes on each Sub-processor, by contract, data protection obligations that provide the same level of protection as this DPA. SWARMSOFT remains fully liable to the Merchant for the performance of each Sub-processor's obligations (GDPR art. 28(4)).

7.5 Not Sub-processors. These do not process Merchant Personal Data as SWARMSOFT's processors:

• Shopify;
• the Merchant's own tools and the destinations the Merchant chooses;
• sign-in providers a shopper chooses for their own Friendzy account (Google, Facebook, Shop);
• public STUN servers that a shopper's browser contacts directly to connect a call.

The privacy notice names them.

8. International transfers

8.1 SWARMSOFT is established in Romania.

• Stores routed to the EU at install (by the store's country): sessions run on servers in Germany.
• Stores routed to the US: sessions run in the United States.
• For every store, including EU stores, chat messages and saved product lists are replicated to the United States, and purchase attribution, metrics and debug logs are held in the United States.

Annex III gives the location for each Sub-processor.

8.2 SWARMSOFT transfers Merchant Personal Data outside the EEA only where GDPR Chapter V is complied with:

• an adequacy decision, including the EU-US Data Privacy Framework for a certified recipient; or
• the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Three (processor to processor), together with any supplementary measures that an assessment of the destination shows to be needed.

8.3 Where the Merchant is established outside the EEA and SWARMSOFT returns or makes available Merchant Personal Data to it, the standard contractual clauses of Decision (EU) 2021/914, Module Four (processor to controller), are incorporated into this DPA by reference. SWARMSOFT is the data exporter, the Merchant is the data importer, and the details are in Annex I.

8.4 On request, SWARMSOFT tells the Merchant the transfer mechanism used for each Sub-processor.

9. Assistance with data subjects' rights

9.1 Taking into account the nature of the processing, SWARMSOFT assists the Merchant by appropriate technical and organisational measures, insofar as possible, to respond to requests to exercise the rights in GDPR Chapter III (GDPR art. 28(3)(e)).

9.2 Requests that Shopify forwards on the Merchant's behalf.

SWARMSOFT identifies the shopper by email address and by Shopify customer id.

customers/data_request. SWARMSOFT sends the Merchant, by email to the store owner, the data that a customers/redact request would erase:

• the shopper's Friendzy profile and sign-in links;
• the shopper's chat messages on that store;
• the shopper's saved lists and sessions on that store;
• the rewards held for the shopper or for their customer id, and the creator rooms they attended.

customers/redact. Within 30 days SWARMSOFT deletes that store's data about the shopper:

• the shopper's chat messages, voice messages and message notices;
• the shopper's quoted text and reactions in other participants' messages;
• the shopper's saved lists, session data and rewards;
• the shopper's sign-in link for that store and their place in creator-room audiences.

The shopper's Friendzy account is deleted if no other store holds data for them.

Data about a shopper who never signed in to Friendzy is anonymous and cannot be linked to a request; it expires under Annex I. Purchase attribution carries no name, email or customer id and cannot be linked to a request either; its identifiers are removed after 30 days (Annex I, row 8).

9.3 If a data subject contacts SWARMSOFT directly about Merchant Personal Data, SWARMSOFT tells the person to contact the Merchant. Where it can identify the Merchant, SWARMSOFT forwards the request to the Merchant without undue delay. It does not answer the request itself except on the Merchant's instruction or where Data Protection Law requires it.

10. Other assistance

Taking into account the nature of the processing and the information available to it, SWARMSOFT assists the Merchant in complying with its obligations under GDPR arts. 32 to 36 (GDPR art. 28(3)(f)): security, breach notification, data protection impact assessments and prior consultation. Assistance beyond the information in this DPA and its annexes may be charged at reasonable cost.

11. Personal data breaches

11.1 SWARMSOFT notifies the Merchant without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Merchant Personal Data. Notice goes by email to the Merchant's account address.

11.2 The notice includes, as far as then known:

• the nature of the breach, the categories and approximate number of data subjects and records concerned;
• a contact point;
• the likely consequences;
• the measures taken or proposed.

Information not yet available follows in phases, without undue delay.

11.3 SWARMSOFT takes reasonable steps to contain the breach and mitigate its effects. It cooperates with the Merchant's notifications to its supervisory authority and to data subjects. The Merchant remains responsible for those notifications.

11.4 SWARMSOFT's notice of a breach is not an admission of fault or liability.

12. Deletion and return at the end

12.1 When the Merchant uninstalls Friendzy, Shopify sends SWARMSOFT a shop/redact request, normally 48 hours after the uninstall. Within 30 days of receiving it, SWARMSOFT deletes that store's Merchant Personal Data, subject to clause 12.3 (GDPR art. 28(3)(g)):

• the Merchant's store record and settings, including its webhook settings;
• the store's chat messages, voice messages, saved lists, session data, metrics, purchase attribution and debug logs;
• the store's advisers, their session history and sign-in tokens;
• the store's creators and moderators and their sign-in tokens;
• the store's staff sign-in records.

12.2 Before uninstalling, the Merchant may ask SWARMSOFT in writing for a copy of the Merchant Personal Data in a commonly used machine-readable format. SWARMSOFT provides it if the request arrives before deletion.

12.3 Retention exceptions.

• Data that Union or Member State law requires SWARMSOFT to keep is kept only for that purpose and that period.
• Deleted data may remain in SWARMSOFT's backups until they expire:
  • the nightly encrypted dumps: 30 days;
  • the database provider's daily backups: 7 days.
  • Backups are not restored to live use except to recover from an incident, and data deleted before the restore is deleted again.
• Operations logs, which carry identifiers but no chat text, expire after 30 days.

12.4 Data already held by participants in a session is outside SWARMSOFT's control. That includes copies of messages kept in a shopper's browser, which stay until the shopper signs out, deletes their Friendzy account or clears the browser storage. SWARMSOFT cannot delete them otherwise.

12.5 During the term, Merchant Personal Data is deleted on the schedules set out in Annex I.

13. Information and audits

13.1 SWARMSOFT makes available to the Merchant the information necessary to demonstrate compliance with GDPR art. 28 (GDPR art. 28(3)(h)): this DPA, its annexes, the current Sub-processor list, and answers to reasonable written questions.

13.2 Where that information is not sufficient, SWARMSOFT allows for and contributes to audits, including inspections, by the Merchant or an independent auditor mandated by it.

• The Merchant gives at least 30 days' written notice.
• No more than once in any 12 months, except after a personal data breach or at a supervisory authority's request.
• During business hours, without disrupting the service.
• Subject to confidentiality.
• The Merchant bears its own costs.
• An audit does not extend to other merchants' data or to Sub-processors' facilities. For those, SWARMSOFT provides the Sub-processor's own certifications or reports where available.

14. Liability

14.1 Each Party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms.

14.2 Nothing in this DPA limits either Party's liability to data subjects under GDPR art. 82, or any liability that cannot lawfully be limited.

15. Order of precedence, changes and term

15.1 If this DPA conflicts with the Terms on the processing of Merchant Personal Data, this DPA prevails. If the standard contractual clauses incorporated by clause 8.3 conflict with this DPA, those clauses prevail.

15.2 SWARMSOFT may update this DPA to reflect changes in Data Protection Law, in Friendzy or in its Sub-processors.

• Material changes are notified at least 30 days before they apply.
• A change does not reduce the protection of Merchant Personal Data under this DPA.
• Each version is dated and kept available.

15.3 This DPA stays in force for as long as SWARMSOFT processes Merchant Personal Data.

16. Governing law and jurisdiction

16.1 This DPA is governed by Romanian law.

16.2 The courts of Cluj-Napoca, Romania, have jurisdiction over disputes arising from it, without prejudice to the rights of data subjects and the competence of supervisory authorities.

16.3 The English version prevails over any translation.

---

Annex I: Description of the processing

EU = Germany (Frankfurt); US = United States. A store is routed to the EU or the US once, at install, by its country.

Data subjects:

• the Merchant's shoppers and storefront visitors, anonymous or signed in;
• the Merchant's staff who open the app;
• advisers the Merchant invites;
• creators the Merchant invites, and the moderators of their rooms.

Frequency: continuous, while Friendzy is installed.

Sensitive data: none intended (clause 3.4).

#	Processing	Data subjects	Categories of personal data	Where	Retention
1	Chat	Shoppers, advisers, creators	Message text, time, page address (without query string), products shared, quoted replies, reactions, edits, read and typing receipts, author's display name and picture	AWS, EU and US (replicated)	90 days after sending
2	Voice messages	Shoppers, staff	Audio recordings	AWS, in the store's region	90 days
3	Calls between friends	Shoppers	Connection details passed between participants, including IP addresses. Audio and video go directly between browsers and are not stored	Realtime server, store's region	Not stored
4	Creator-room stage	Creators, shoppers on stage	Live audio and video, relayed through Cloudflare; not stored	Cloudflare network	Not stored
5	Co-browsing	Shoppers	Live page content, navigation, mouse and scroll events, forwarded to the session's members. Form fields are masked, and so are the shopper's own name and email and any address printed on the page; other text on the page is shown as it is	Realtime server, store's region	Not stored; a per-store count is kept
6	Session state	Shoppers, advisers	Members, display names, emails, device ids, invite names, each member's current page and last 40 page steps (none on account, cart, checkout and order pages), cart lines as the store's setting and the shopper allow, product picks and pins, AI assistant conversation	Realtime server, store's region	21 days after the session was last used (some keys 10 minutes to 7 days)
7	Saved product lists	Shoppers	Products chosen; emailed to the shopper on request	AWS, EU and US (replicated); copy on the device	90 days after last save (server); 180 days (device)
8	Purchase attribution	Shoppers	Order total, currency, checkout token, Friendzy visitor, device and session ids, role, creator, adviser id, date. No name, email, address, order number or items	MongoDB Atlas, US	30 days with identifiers; after that only anonymous totals are kept
9	Arrival data	Shoppers	Campaign, UTM fields, referrer host, hashed device ids	MongoDB Atlas, US	30 days
10	Rewards for logged-in shoppers	Shoppers	The store's customer number, kept as a one-way code	Realtime server, store's region	400 days; rewards awaiting the shopper, 24 hours
11	Store advisers	Advisers	Name, email, Shopify staff id, status, business hours, invitation, activation and last-seen times, sign-in tokens (hashed)	Google Cloud, EU	While Friendzy is installed; deleted under clause 12.1
12	Adviser session history	Advisers	Adviser id and name, session id, waiting time and duration, message counts (no text), outcome	Google Cloud, EU	As row 11
13	Adviser alerts	Advisers	Browser push subscription (alerts carry the store name and a link only)	Realtime server, store's region	90 days
14	Creators and moderators	Creators, moderators	Name, email, page name, status, sign-in tokens (hashed)	Google Cloud, EU; moderators also on the realtime server	While Friendzy is installed; deleted under clause 12.1; realtime copy 180 days
15	Moderation log	Shoppers, hosts	Who did what to whom, and when (no message text)	Realtime server, store's region	30 days
16	Customer and order look-up for advisers	Shoppers	The signed-in shopper's Shopify customer name, email, order count, tags, amount spent, last 5 orders (name, date, status, total, up to 5 item titles). Only if the Merchant grants the optional permissions	Read live from Shopify, shown to the adviser holding the session	Not stored
17	AI assistant	Shoppers	Store name, the shopper's display name, up to 8 messages of up to 2,000 characters. Only on plans that include it	Anthropic, US; conversation kept as row 6	Under Anthropic's API terms; Friendzy copy as row 6
18	Events to the Merchant's tools	Shoppers	To Shopify Flow: customer id when known, session id, one page, guests, channel, minutes, reward. To the Merchant's web address: the same without the page	Destination chosen by the Merchant	The Merchant's responsibility
19	Attribution on the order	Shoppers	Cart attributes naming the session, the role and the time	The Merchant's Shopify order	The Merchant's order retention
20	Debug mode	Shoppers (incidental)	The storefront page's console output, page path, a random session id; tokens, emails and query strings removed. Only while SWARMSOFT staff switch on debug mode for that store, to troubleshoot it	MongoDB Atlas, US	3 days
21	Rate limits and abuse protection	Everyone	IP addresses, as keys only	Realtime server, store's region	60 seconds to 1 hour; not written to any database or log line
22	Staff sign-in to the app	The Merchant's staff	Shopify staff id, name, email, locale, owner and collaborator flags	Google Cloud, EU	Deleted at uninstall
23	On the shopper's device	Shoppers	Sign-in token (up to 1 year), visitor id, visit count, rollout bucket, arrival data, session and message copies, preferences	The shopper's browser	Until the browser storage is cleared; message copies are cleared on sign-out and on account deletion

The shopper's Friendzy account (name, email, avatar, bio, password hash or social sign-in link, and the store name the shopper chooses to use) is SWARMSOFT's own (clause 2.3).

For clause 8.3 (non-EEA Merchants). What can be made available to the Merchant:

• the data-request export (clause 9.2);
• the events in row 18;
• the order attributes in row 19;
• what advisers and staff see in the Friendzy admin.

Annex II: Technical and organisational measures

Each measure below is in place.

Encryption in transit

• HTTPS for every connection.
• HSTS, no-sniff, no-referrer and a content security policy.
• Links to voice messages and storage are pre-signed and short-lived.

Encryption at rest

• The cloud providers' encryption at rest for the databases (Cloud SQL, DynamoDB) and storage (S3).
• Backups encrypted with AES-256.
• Stored only as one-way hashes:
  • passwords (bcrypt);
  • every sign-in and invitation token (SHA-256);
  • rewards are keyed by a one-way code of the customer number.
• Encrypted in the application: the Shopify refresh token, adviser invitation tokens and webhook secrets.

Access control

• Shopify session tokens for the admin.
• Signed tokens, with the algorithm pinned, for shoppers, advisers and creators, each pinned to the store it was issued for.
• Adviser and creator access can be revoked.
• An adviser sees a shopper's Shopify data only while holding that shopper's session.
• SWARMSOFT's staff administration is behind two-factor sign-in.
• Each service has its own cloud identity, limited to the resources it needs.
• The EU realtime server opens no public ports.

Separation between merchants

• Every session, message, recording and list is checked against the store that the request's token and origin belong to.
• Requests naming another store are refused.

Integrity

• Shopify webhook and app-proxy signatures are checked in constant time, and so is the server-to-server token.
• Events sent to the Merchant's web address are signed, and the address is checked again before every delivery.

Abuse protection

• Rate limits per address, per store and per session on sign-in, messages, invitations, uploads and the pixel, funnel and debug endpoints.
• Lock-out against brute-forcing invitation keys.

Data minimisation

• Shoppers' emails are removed from what other participants receive.
• No page path is kept on account, cart, checkout and order pages.
• Query strings are cut from stored addresses.
• Only listed fields are kept from the checkout pixel.
• Device ids are hashed in metrics.
• IP addresses are not stored.
• Logs and crash reports carry no chat text or request headers, and our servers write no IP addresses into them; a crash report sent from a shopper's browser does carry that browser's IP address (Annex III, Sentry).
• Debug logs are scrubbed of tokens and emails.
• Alerts carry no shopper data.
• Shopify customer data is read live and never copied.
• The widget does not load Google Fonts or other fonts from third parties.

Availability and resilience

• The database provider's daily backups, with point-in-time recovery.
• Nightly encrypted off-site dumps.

Deletion

• Automatic expiry on the schedules in Annex I.
• Shopify's privacy requests are acted on as clauses 9.2 and 12.1 state.

Organisation

• Every change is tried by the founder on a separate copy before release.
• A written security audit (1 October 2026), whose findings are tracked.
• Staff access limited to those who need it (clause 5).

Annex III: Sub-processors

Each Sub-processor is bound by a data processing agreement with SWARMSOFT.

Sub-processor	What it does for Friendzy	Merchant Personal Data (Annex I rows)	Location	Transfer mechanism
Google Cloud (Google Ireland / Google LLC)	Servers and database for the app and the EU realtime server; operations logs	6, 11-14, 22; EU sessions; logs	Germany (Frankfurt), logs included	Within the EEA
Amazon Web Services	Database for messages and saved lists, storage for voice messages and backups, job queue, email sending (SES)	1, 2, 7; backups of all stores	US (Ohio) and Germany (Frankfurt); email in Sweden (Stockholm)	Germany and Sweden: within the EEA; US: EU-US Data Privacy Framework or standard contractual clauses
Oracle Cloud Infrastructure	Realtime server for US-routed stores	3, 5, 6, 10, 13, 15, 21 for US stores	US (Virginia)	EU-US Data Privacy Framework or standard contractual clauses
MongoDB Atlas	Attribution, arrival data, debug logs, metrics	8, 9, 20	US (AWS, Northern Virginia)	EU-US Data Privacy Framework or standard contractual clauses
Cloudflare	DNS, the tunnel in front of the app and the EU realtime server (traffic decrypted at its edge), creator-stage media relay	All EU traffic in transit; 4	Global network	EU-US Data Privacy Framework or standard contractual clauses
Anthropic	AI assistant	17	US	EU-US Data Privacy Framework or standard contractual clauses
Sentry (Functional Software)	Crash reports	Incidental: identifiers in crash reports; the browser library sends the visitor's IP address with each report	EU (Germany)	Within the EEA

The standard contractual clauses are those adopted by Commission Implementing Decision (EU) 2021/914 (clause 8.2).