This Data Processing Addendum (the “DPA”) forms part of the Zhara AI Search & Discovery Terms of Service available at https://www.zhara.io/terms (the “Agreement”) between Zhara Labs, a partnership firm based in India, with its communication address at C01, The First, B/H ITC Narmada, Nr. Shivalik High Street, Vastrapur, Ahmedabad, Gujarat 380015, India (“Zhara”), and the Shopify merchant that installs and uses Zhara AI Search & Discovery (the “Merchant”).
The Merchant accepts this DPA by installing the App and accepting the Agreement. No separate signature is needed. If the Merchant needs a countersigned copy, it can request one at support@zhara.io. This DPA applies whenever Zhara processes Merchant Personal Data that is subject to Data Protection Law.
1. Definitions
Terms not defined here have the meaning given in the Agreement. In this DPA:
1.1 “App” means Zhara AI Search & Discovery, including its storefront components (the app embed, app blocks and Shopify web pixel), its Shopify admin interface and the services that support them.
1.2 “Data Protection Law” means all privacy and data protection laws that apply to the processing of Merchant Personal Data under the Agreement, including, where applicable, the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), and India's Digital Personal Data Protection Act, 2023 and its rules (“DPDP Act”).
1.3 “Merchant Personal Data” means personal data that Zhara processes on behalf of the Merchant through the App, as described in Annex 1. It does not include Account Data.
1.4 “Account Data” means personal data about the Merchant's owners and staff that Zhara collects to manage the Merchant's account, such as names, email addresses, billing status and support messages. Zhara handles Account Data as a controller under its privacy policy.
1.5 “Shopper” means a visitor to the Merchant's online store, including a customer who is signed in to the store.
1.6 “Security Incident” means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Merchant Personal Data. It does not include unsuccessful attempts that do not compromise the security of Merchant Personal Data, such as pings, port scans or blocked login attempts.
1.7 “Subprocessor” means a third party engaged by Zhara that processes Merchant Personal Data.
1.8 “SCCs” means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914. “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
1.9 “Controller”, “Processor”, “Data Subject”, “Personal Data” and “Processing” have the meanings given in the GDPR. They include the equivalent terms in other Data Protection Law, such as “business” and “service provider” under the CCPA and “Data Fiduciary”, “Data Processor” and “Data Principal” under the DPDP Act.
2. Roles and scope
2.1 For Merchant Personal Data, the Merchant is the Controller and Zhara is the Processor. Under the CCPA the Merchant is the business and Zhara is its service provider. Under the DPDP Act the Merchant is the Data Fiduciary and Zhara is its Data Processor, and this DPA is the valid contract required by section 8(2) of that Act.
2.2 If the Merchant is itself acting as a processor for another controller, Zhara acts as the Merchant's subprocessor, and the Merchant confirms that its instructions to Zhara are authorised by that controller.
2.3 Zhara is a Controller only for Account Data. This DPA does not apply to Account Data.
2.4 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of Data Subjects are set out in Annex 1.
3. Processing on the Merchant's instructions
3.1 Zhara will process Merchant Personal Data only on the Merchant's documented instructions. The Merchant's complete instructions are the Agreement, this DPA, the settings the Merchant chooses in the App (for example, turning personalization on or off, configuring recommendation placements, or setting search rules), and requests sent through Shopify's privacy webhooks.
3.2 Zhara may process Merchant Personal Data otherwise only where the law requires it. In that case Zhara will tell the Merchant before processing, unless the law prohibits this.
3.3 Zhara will tell the Merchant promptly if, in its opinion, an instruction breaks Data Protection Law. Zhara may pause the relevant processing until the instruction is confirmed or changed.
4. The Merchant's responsibilities
The Merchant confirms that:
4.1 it has a lawful basis for the processing described in Annex 1 and has given Shoppers the notices Data Protection Law requires, including a store privacy policy that describes its use of the App;
4.2 where the law requires consent for analytics, personalization or cookies, it collects that consent through Shopify's consent tools, such as the Shopify cookie banner, so that the App can read it through Shopify's Customer Privacy API;
4.3 it will not use the App to process special categories of personal data, data about children that requires parental consent, or payment card data, and it will not ask Shoppers to enter such data into the App; and
4.4 its instructions to Zhara comply with Data Protection Law.
5. Zhara's obligations
5.1 Purpose limitation
Zhara will use Merchant Personal Data only to provide the App to that Merchant. In particular, Zhara will not:
- sell Merchant Personal Data, or share it for cross-context behavioural advertising;
- combine Merchant Personal Data with data from other merchants' stores, or build cross-store profiles of Shoppers;
- use Merchant Personal Data to contact or advertise to Shoppers; or
- retain, use or disclose Merchant Personal Data for any purpose other than the business purposes in the Agreement and Annex 1.
5.2 AI services and model training
5.2.1 Zhara will not use Merchant Personal Data, or any other data from the Merchant's store, to train, fine-tune or improve AI or machine learning models that serve other merchants or any third party. Zhara may tune a model for the Merchant's store alone only with the Merchant's prior written consent, and only with that store's data.
5.2.2 Zhara uses Azure OpenAI Service, provided by Microsoft as part of Microsoft Azure, to turn search terms and product content into embeddings so search terms can be matched to products. Zhara sends Microsoft only search terms and product titles, types and descriptions. It does not send Shopper identifiers, customer IDs, order details or Account Data. Under Microsoft's terms for Azure OpenAI Service, Microsoft does not use this data to train or improve models.
5.3 Consent signals
Zhara will respect the consent choices Shoppers make through the Merchant's store, as reported by Shopify's Customer Privacy API. The App's web pixel loads only when the Shopper has granted the consent purposes it declares. Where the Shopper has not given the required consent, the App provides search and non-personalized recommendations without storing identifiers on the Shopper's device, recording behavioural events or personalizing results.
5.4 Confidentiality
Zhara will ensure that everyone it authorises to process Merchant Personal Data is bound by a duty of confidentiality, whether by contract or by law, and has access only to the extent needed for their role.
5.5 Security
Zhara will implement and maintain the technical and organisational measures in Annex 2 to protect Merchant Personal Data, taking into account the state of the art, the cost of implementation, the nature of the processing and the risks to Data Subjects. Zhara may update these measures over time, provided the overall level of protection is not reduced.
6. Subprocessors
6.1 The Merchant gives Zhara general authorisation to engage Subprocessors. The Subprocessors in use on the effective date are listed in Annex 3 and at https://www.zhara.io/legal/subprocessors.
6.2 Zhara will impose on each Subprocessor, by written contract, data protection obligations that are no less protective than those in this DPA. Zhara remains responsible to the Merchant for each Subprocessor's performance of those obligations.
6.3 Zhara will notify the Merchant at least 30 days before a new Subprocessor begins processing Merchant Personal Data, by email to the store owner's email address or by a notice in the App.
6.4 The Merchant may object to a new Subprocessor on reasonable data protection grounds by emailing support@zhara.io during the notice period. The parties will discuss the objection in good faith. If Zhara cannot reasonably address it, the Merchant may stop using the affected part of the App or uninstall the App, and Zhara will refund any prepaid fees for the unused part of the current billing period. If the Merchant does not object during the notice period, the new Subprocessor is treated as approved.
7. Data Subject requests and Shopify privacy webhooks
7.1 The App subscribes to Shopify's mandatory privacy webhooks. Zhara will act on them as follows:
- Customer data request: within 30 days of receiving it, Zhara will provide the Merchant with the Merchant Personal Data it holds about that Shopper.
- Customer deletion request: within 30 days of receiving it, Zhara will delete the Merchant Personal Data it holds about that Shopper.
- Store deletion request: Shopify sends this 48 hours after the Merchant uninstalls the App. Zhara will delete all Merchant Personal Data for that store within the period in section 10.2.
7.2 If a Shopper contacts Zhara directly to exercise their rights, Zhara will pass the request to the Merchant without undue delay and will not respond to the Shopper itself, except to tell them that the request has been passed on, unless the Merchant asks Zhara to do so.
7.3 Zhara will give the Merchant other reasonable assistance, taking into account the nature of the processing, so the Merchant can respond to Data Subject requests under Data Protection Law. Where the requested help goes beyond the App's standard features, Zhara may charge a reasonable fee agreed with the Merchant in advance.
8. Impact assessments and regulators
Taking into account the nature of the processing and the information available to it, Zhara will give the Merchant reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities that relate to the Merchant's use of the App. Zhara will usually meet this by providing this DPA, its security documentation and written answers to reasonable questions.
9. Security incidents
9.1 Zhara will notify the Merchant without undue delay, and where feasible within 48 hours, after becoming aware of a Security Incident. Zhara will also report the Security Incident to Shopify as Shopify's API Terms require.
9.2 The notice will describe, as far as the information is available: the nature of the Security Incident; the categories and approximate number of Data Subjects and records affected; the likely consequences; the measures taken or proposed to address it; and a contact for more information. Where not all information is available at once, Zhara will provide it in stages.
9.3 Zhara will take reasonable steps to contain and investigate the Security Incident and reduce its effects, and will give the Merchant reasonable help to meet its own obligations, such as notifying regulators or affected individuals, including the Data Protection Board of India where the DPDP Act applies.
9.4 Notice of a Security Incident is not an admission of fault or liability by Zhara.
10. Return and deletion
10.1 While the App is installed, the Merchant can request a copy of its Merchant Personal Data in a machine-readable format by emailing support@zhara.io. The Merchant should request any copy it needs before uninstalling the App.
10.2 When the Merchant uninstalls the App, Zhara will delete all Merchant Personal Data within 30 days after uninstallation. During the term, Zhara deletes Merchant Personal Data at the end of the retention periods in Annex 1.
10.3 Encrypted backups are overwritten on a rolling cycle set out in Annex 1. Merchant Personal Data in backups remains protected by this DPA, is not used for any other purpose, and is deleted when the backup is overwritten.
10.4 Zhara may keep Merchant Personal Data after uninstallation only where the law requires it, in which case this DPA continues to apply to that data until it is deleted.
10.5 On request, Zhara will confirm to the Merchant in writing that deletion has been completed.
11. Information and audits
11.1 Zhara will make available the information reasonably needed to demonstrate its compliance with this DPA. This includes answering the Merchant's reasonable written security questionnaire once in any 12 month period, and sharing summaries of any independent security assessments or certifications Zhara holds.
11.2 If that information is not enough to show compliance, or a supervisory authority requires it, or after a Security Incident, the Merchant may carry out an audit, including an inspection, subject to the following conditions:
- the Merchant gives at least 30 days' written notice and agrees the scope in advance;
- the audit takes place during business hours, no more than once in any 12 month period (unless required by a supervisory authority or after a Security Incident), and without unreasonably disrupting Zhara's operations;
- the auditor is bound by confidentiality and is not a competitor of Zhara; and
- the Merchant bears its own costs of the audit.
12. International transfers
12.1 Zhara is established in India. The App is hosted on Microsoft Azure in the Central India region, with AI processing in the South India region, and Subprocessors process data in the locations listed in Annex 3.
12.2 EEA transfers. Where Merchant Personal Data is transferred from the European Economic Area to Zhara in a country without an adequacy decision, the parties agree to the SCCs, which are incorporated into this DPA by reference, as follows:
- Module 2 (controller to processor) applies where the Merchant is a Controller, and Module 3 (processor to processor) applies where the Merchant is a processor;
- the optional docking clause in Clause 7 applies;
- under Clause 9, Option 2 (general written authorisation) applies, with the notice period set out in section 6.3 of this DPA;
- the optional wording in Clause 11 does not apply;
- under Clause 13, the competent supervisory authority is the one for the EU Member State where the Merchant is established or, if the Merchant is not established in the EU, the Irish Data Protection Commission;
- under Clauses 17 and 18, the SCCs are governed by the law of Ireland and disputes are resolved by the courts of Ireland; and
- Annexes I, II and III of the SCCs are completed by Annexes 1, 2 and 3 of this DPA.
12.3 UK transfers. Where Merchant Personal Data is transferred from the United Kingdom, the UK Addendum applies and is incorporated by reference. Its tables are completed with the information in this DPA and its annexes, and either party may end it as allowed by its Section 19.
12.4 Swiss transfers. Where Merchant Personal Data is transferred from Switzerland, the SCCs apply as set out in section 12.2, with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.
12.5 Onward transfers. Zhara will ensure that any transfer of Merchant Personal Data to a Subprocessor in another country is protected by appropriate safeguards required by Data Protection Law, such as the SCCs.
13. California terms
Where the CCPA applies, Zhara acts as the Merchant's service provider and:
- will not sell or share Merchant Personal Data;
- will not retain, use or disclose Merchant Personal Data outside the direct business relationship with the Merchant, or for any purpose other than the business purposes in the Agreement and this DPA;
- will not combine Merchant Personal Data with personal information it receives from or on behalf of anyone else, except as the CCPA permits;
- will comply with the CCPA and provide the same level of privacy protection the CCPA requires of the Merchant; and
- will notify the Merchant if it can no longer meet these obligations.
The Merchant may take reasonable and appropriate steps to stop and remedy any unauthorised use of Merchant Personal Data. Zhara certifies that it understands and will comply with these restrictions.
14. India terms
Where the DPDP Act applies, Zhara processes Merchant Personal Data only on the Merchant's behalf and under this DPA, maintains the reasonable security safeguards in Annex 2, erases Merchant Personal Data when the Merchant instructs or when the purpose is complete as set out in section 10, and helps the Merchant meet its obligations as Data Fiduciary, including breach notifications under section 9. Zhara's Grievance Officer is Prashant Ramani (support@zhara.io).
15. Liability
Each party's liability arising out of or relating to this DPA, including the SCCs, is subject to the limitations and exclusions of liability in the Agreement. Those limits apply in aggregate to all claims under the Agreement and this DPA, but they do not limit either party's liability to Data Subjects where Data Protection Law or the SCCs do not allow it.
16. Term, precedence and changes
16.1 This DPA applies for as long as Zhara processes Merchant Personal Data and ends automatically once all Merchant Personal Data has been deleted.
16.2 If there is a conflict, the SCCs (where they apply) prevail over this DPA, and this DPA prevails over the rest of the Agreement.
16.3 Zhara may update this DPA by posting a new version at https://www.zhara.io/legal/dpa and notifying the Merchant at least 30 days before a material change takes effect. Changes required by law may take effect sooner. If the Merchant does not agree to a material change, it may uninstall the App before the change takes effect. Zhara will not make a change that reduces the overall protection given to Merchant Personal Data.
16.4 Except for the SCCs, which are governed as set out in section 12, this DPA is governed by the laws of India, and the courts at Ahmedabad, Gujarat, India have exclusive jurisdiction, as set out in the Agreement.
17. Contacts
| Role | Contact |
|---|---|
| Data Protection Officer | Akshil Shah, techsupport@zhara.io |
| Privacy questions and Grievance Officer | Prashant Ramani, support@zhara.io |
| Security incident notices and objections to Subprocessors | support@zhara.io |
| Registered office | Zhara Labs, C01, The First, B/H ITC Narmada, Nr. Shivalik High Street, Vastrapur, Ahmedabad, Gujarat 380015, India |
Annex 1: Description of the processing
A. Parties
| Data exporter | Data importer | |
|---|---|---|
| Name | The Merchant, as identified by its Shopify store account | Zhara Labs |
| Address | The address in the Merchant's Shopify store account | C01, The First, B/H ITC Narmada, Nr. Shivalik High Street, Vastrapur, Ahmedabad, Gujarat 380015, India |
| Contact | The store owner email in the Merchant's Shopify store account | Akshil (Data Protection Officer), Akshil@zhara.io |
| Role | Controller (or processor, where section 2.2 applies) | Processor (or subprocessor, where section 2.2 applies) |
| Activities | Use of the App on the Merchant's online store | Providing the App to the Merchant |
| Signature and date | Given by installing the App and accepting the Agreement | Given by providing the App under the Agreement |
B. Description of the processing and transfer
| Item | Description |
|---|---|
| Categories of Data Subjects | Shoppers who visit the Merchant's online store, including customers who are signed in to it. |
| Frequency of transfer | Continuous, for as long as the App is installed. |
| Nature of the processing | Collection through the App's storefront components and Shopify web pixel; reading order data through Shopify's APIs; storage; indexing; ranking; analysis; aggregation into reports; creating embeddings of search terms and product content through Azure OpenAI Service, without identifiers; and deletion. |
| Purposes of the processing | Providing search, predictive suggestions, spelling correction, no results recovery and product recommendations; personalizing results for the Merchant's own store where the Merchant enables it and the Shopper's consent allows it; giving the Merchant analytics and revenue attribution; and operating, securing and fixing the App. |
| Duration | For the term of the Agreement, then until deletion under section 10. |
| Special categories of data | None intended. Search terms may occasionally contain personal information typed in by a Shopper. They are treated as Merchant Personal Data and protected in the same way. |
| Transfers to Subprocessors | As listed in Annex 3, for the purposes stated there. |
Categories of personal data
| Category | Data |
|---|---|
| Search activity | Search terms entered, the number of results returned, and whether the results came from AI (semantic) matching. |
| Interaction events | Products and recommendation carousels shown, clicks, positions on the page, products added to cart, checkouts started and purchases completed. |
| Identifiers | A random anonymous visitor ID stored on the Shopper's device, a search session ID and, only where the Shopper is signed in and has consented, the Shopify customer ID. |
| Device and technical data | Device type (mobile, tablet or desktop), derived from the browser's user agent. The IP address, browser version and location are not stored. |
| Consent status | The Shopper's privacy choices as reported by Shopify's Customer Privacy API. |
| Order data | Order ID, line items, product and variant IDs, order value, currency and time of purchase. No names, email addresses, phone numbers or postal addresses. |
| Data stored on the Shopper's device | The anonymous visitor ID (only with analytics consent) and the Shopper's last six searches (only with preferences consent). |
Retention periods
| Data | Retention |
|---|---|
| Shopper event data | 13 months from collection, then deleted or reduced to aggregated statistics that identify no one. |
| Order attribution records | 25 months. Deleted sooner on uninstall. |
| Aggregated analytics that identify no one | While the App is installed. |
| Server and security logs | 30 days. |
| Backups | Encrypted and kept for 7 days on a rolling basis, then permanently deleted. |
| All Merchant Personal Data after uninstall | Deleted within 30 days after uninstallation. |
C. Competent supervisory authority
As set out in section 12.2 of this DPA.
Annex 2: Technical and organisational security measures
| Area | Measures |
|---|---|
| Encryption | TLS for all data in transit. Encryption at rest for databases, storage and backups using Microsoft Azure's storage encryption. |
| Data minimisation | Only the data in Annex 1 is collected. IP addresses are not stored. No Shopper names, email addresses, phone numbers or postal addresses are collected. No Shopper identifiers are sent to the AI Subprocessor. Behavioural tracking and personalization run only with Shopper consent. |
| Store separation | Each Merchant's data is logically separated by Shopify store ID, and queries are scoped to a single store. Data from different stores is not combined. |
| Access control | Access limited to staff who need it for their role. Strong passwords and multi-factor authentication for staff access to production systems and cloud accounts. Server and database access restricted to approved network addresses. Access removed promptly when staff leave. |
| Logging and monitoring | Access to production systems is logged. Server and security logs are kept for 30 days. |
| Environments | Test and production environments are separate. Real Shopper data is not used for development or testing. |
| Availability and backups | Hosting in Microsoft Azure data centres with Azure's physical security controls. Encrypted backups kept for 7 days on a rolling basis. |
| Secure development | Code review before changes reach production. Security updates applied promptly and systems reviewed regularly. |
| Personnel | Confidentiality obligations for all staff and contractors with access to Merchant Personal Data. |
| Incident response | A documented incident response plan covering detection, containment, investigation, notification (to Merchants without undue delay and where feasible within 48 hours, and to Shopify as its API Terms require) and follow up. |
| Deletion | Automated handling of Shopify's privacy webhooks. Deletion of all store data within 30 days after uninstallation. Backups expire after 7 days. |
| Subprocessor management | Security and privacy review before engaging a Subprocessor, and written data protection terms with each one. |
Annex 3: Subprocessors
| Subprocessor | Purpose | Location | Data processed |
|---|---|---|---|
| Microsoft Corporation (Microsoft Azure) | Hosting, storage, databases and search infrastructure; AI embeddings through Azure OpenAI Service | India (Central India and South India regions) | All categories in Annex 1. For embeddings, only search terms and product titles, types and descriptions, with no identifiers |
Tools that process only Account Data, such as email and support tools, are not Subprocessors under this DPA and are described in Zhara's privacy policy.