This Data Processing Agreement (“DPA”) forms part of the Master Subscription Agreement between Hesient Inc., doing business as Sell&Tell (“Company”), and the merchant subscribing to the Services (“Customer”). It governs personal information processed by the Company on Customer’s behalf. The Services are currently offered to United States merchants.
1. Definitions and Roles
“Customer Personal Data” means personal information supplied by Customer or collected for Customer through the Services, including shopper identifiers and responses and personal information in Shopify orders. “Data Protection Laws” means privacy and data-protection laws applicable to that processing, including applicable United States federal and state laws and the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”). “Subprocessor” means a provider that processes Customer Personal Data on the Company’s behalf. “Personal Data Breach” means a security breach resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
Customer determines the purposes of processing and acts as the controller or business where those terms apply. The Company acts as a processor or service provider for Customer Personal Data. The Company’s own merchant-account, billing, and business-marketing activities are described in the Privacy Notice and are distinct from the processing governed by this DPA.
2. Scope and Instructions
Customer instructs the Company to process Customer Personal Data to operate the Widget, analyze shopper interactions, attribute revenue using order identifiers, provide the dashboard and briefs, support Customer, and perform the Agreement. The specific data and purposes are set out in the Description of Processing below. The Company will process that information only for these documented purposes or as required by applicable law and will inform Customer if it determines that an instruction violates applicable Data Protection Laws.
3. Company Obligations
3.1 Confidentiality and Safeguards
Personnel authorized to process Customer Personal Data must be subject to appropriate confidentiality obligations. The Company will use reasonable safeguards appropriate to the data and risks and comply with applicable security duties. This DPA does not make a separate contractual promise about backup frequency, restoration deadlines, data durability, or a particular infrastructure configuration.
3.2 Subprocessors
Customer authorizes the Company to use providers needed to deliver the Services. The Company will impose written obligations appropriate to the processing and at least as protective as the applicable obligations in this DPA, and remains responsible for their performance of those obligations. Information about providers relevant to Customer’s processing may be requested at team@sellandtell.ai. The Company will provide thirty days’ prior notice of a new or replacement Subprocessor. Customer may raise a reasonable data-protection objection within fifteen days of notice. The parties will discuss it in good faith; if they cannot resolve it within thirty days, Customer may terminate the affected Services and receive a refund of prepaid fees for Services not provided after that termination.
3.3 Individual Requests and Assistance
The Company will reasonably assist Customer with applicable requests for access, correction, deletion, portability, and other privacy rights. A request received directly about Customer Personal Data will be forwarded to Customer unless law requires otherwise. The Company will also provide reasonable assistance with assessments and regulatory inquiries to the extent required by applicable Data Protection Laws.
3.4 Breach Notification
The Company will notify Customer without undue delay, and in any event within seventy-two hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. Available information will include the nature of the incident, affected data and individuals where known, likely consequences, and measures taken or proposed. Information may be supplied in phases as the investigation proceeds. The contact for the incident is team@sellandtell.ai. This does not extend any shorter deadline required by law.
4. Customer Obligations and Consent
Customer is responsible for lawful instructions, adequate privacy disclosures, required permissions and consents, and responding to its shoppers. Customer must not instruct the Widget to collect payment-card details, passwords, government identifiers, health records, or other sensitive personal information. Free-text responses can contain personal information even where it was not requested.
By default, the shopper-side script starts without waiting for a cookie banner. It can wait for consent when the merchant’s banner sends the required signal. Installation alone does not establish consent integration. Customer is responsible for providing accurate notices and configuring and verifying any consent or opt-out controls required for its store before collection begins.
5. Retention, Export, and Deletion
Raw shopper behavior is deleted after ninety days during active service. The shorter post-service deadline below overrides that period when access ends.
After the trial ends without a paid subscription, or after paid access expires or otherwise ends, Customer has seven (7) calendar days to export or recover its store data. Customer may request export or recovery at team@sellandtell.ai. The Company deletes that store data on the eighth day after access ends. Cancelling a renewal does not start this window while paid access continues. A recovery request does not extend the deletion deadline; Customer should complete its export within the seven-day window. This does not require deletion of records that applicable law requires the Company to retain, which will be restricted to that legal purpose, or of lawfully de-identified or aggregated information that no longer identifies a person or Customer.
The Company will return requested data in a commonly used, machine-readable format during the recovery window. Earlier verified deletion requests will be handled as required by applicable law and Customer’s instructions. The Company will require its Subprocessors to apply the relevant deletion instructions to Customer Personal Data. The separate one-year lifetime of an identifier stored in a shopper’s browser does not extend server-side retention.
6. California and Other Applicable State Laws
To the extent the CCPA applies, the Company certifies that it understands and will comply with its obligations as a service provider. It will not sell or share Customer Personal Data; retain, use, or disclose it outside the purposes specified in this DPA and the Agreement or the direct business relationship with Customer, except as legally permitted; or combine it with personal information from other sources except as the CCPA permits. It will provide the level of protection required by applicable law and notify Customer if it determines that it can no longer meet those obligations. Customer may take reasonable and appropriate steps to verify compliance, stop unauthorized use, and remediate it. Similar processor obligations apply where another state’s law governs the processing.
The Company’s use of marketing providers for its own website or business contacts does not permit disclosure of Customer Personal Data to advertising partners or data brokers.
7. AI Processing
The Company may improve its own AI models using de-identified or aggregated data that does not identify any individual. Personally identifiable information, including personal information within free-text responses, must be excluded before data is used for training. The Company will not attempt to re-identify training data. Third-party AI providers may process data to deliver the Services, but may not use Customer Data or Shopper Interaction Data to train their own models, and the Company requires that restriction in its provider agreements.
Customer instructs the Company to create and use de-identified or aggregated information for internal improvement only as permitted by applicable law. De-identification must be applied before training; merely removing a name while leaving an identifiable response is insufficient. The Company will maintain and use de-identified data in that form. The Services generate insights for human review and do not make decisions producing legal or similarly significant effects on individual shoppers.
8. Compliance Review
The Company will provide information reasonably necessary to demonstrate compliance and allow appropriate audits of processing under this DPA. Audits are limited to once in twelve months unless required by law or following a Personal Data Breach, require at least thirty days’ notice, occur during normal business hours, and are subject to reasonable confidentiality and security measures. Customer pays the audit costs unless it identifies a material breach by the Company. These conditions do not restrict a regulator’s lawful powers.
9. Liability and Duration
The liability and indemnity provisions of the Master Subscription Agreement apply, including its specific treatment of unauthorized use or disclosure of Customer Data. Nothing limits liability where law prohibits that limitation. This DPA remains effective while the Company processes Customer Personal Data, including the recovery and deletion period after access ends. Its confidentiality, deletion, and other obligations that should survive will continue as applicable.
10. Description of Processing
- People: visitors and buyers at Customer’s store, and Customer personnel whose information is included in store settings or support requests.
- Shopper data: dwell and scroll events, page zones and addresses, variant changes, cart actions, a random visitor identifier, per-tab session identifiers, interaction responses, and text entered in the panel up to 2,000 characters. The shopper-side event script does not collect a name, email, IP address, or Shopify customer-login identity.
- Order data: order identifiers and numbers, totals, status, payment method, and line items from new-order webhooks or past-order synchronization. Stored order records do not contain buyer names or email addresses. Revenue is attributed using the order identifier, not buyer identity. The Shopify customer list is never read.
- Catalog and store data: titles, descriptions, vendor, type, handle, tags, images, variants, prices, read-only theme information, branding, and configuration.
- Operations and purposes: collection, transmission, storage, organization, analysis, generation of insights, order-to-session revenue attribution, customer support, export, and deletion needed to supply Sell&Tell.
- Frequency and duration: ongoing while the store integration is active, including Shopify webhooks and authorized synchronization. Raw behavior is deleted after ninety days; after access ends the seven-day recovery window and day-eight deletion apply, subject only to the limited exceptions stated above.
- Browser storage: a first-party random visitor identifier for one year and a session identifier per browser tab. Browser storage and server retention are separate.
- Processing locations: the locations where the Company and its providers operate; the United States commercial launch is not a promise of exclusive United States data residency. Customer can request details at the contact below.
11. Contact and Disputes
Send questions, requests, and legal notices to Hesient Inc. at team@sellandtell.ai. The Master Subscription Agreement governs disputes, including the San Francisco, California court and arbitration venue. This DPA does not incorporate a separate international-transfer addendum. Any mandatory obligations imposed by applicable law remain applicable.