Data Processing (DPA)

Last updated: 9 October 2026

Our commitments as a processor.

This data processing agreement (“DPA”) supplements the Terms of Use where personal data of your shop’s visitors is involved.

1. Roles

You act as the controller, Zefyr as the processor.

2. Subject matter

Zefyr processes data only to provide the chat assistant, in line with your instructions and the Terms.

3. Sub-processors

• Supabase — hosting of the database and functions.
• Groq — generating answers with AI models.
• Lemon Squeezy — payments (in the future).

We give notice in advance of any change of sub-processor.

4. Security measures

Encryption in transit, keys per shop, anonymisation or pseudonymisation where possible, access control and record keeping.

5. Data subject requests

We help you answer visitors’ requests for access, rectification or erasure. Requests made directly to us are passed on to you without undue delay.

6. Data breaches

We notify you without undue delay as soon as we become aware of an incident that concerns you.

If you have any questions, contact us.