Data Processing Addendum
Last updated: October 2026
This Data Processing Addendum ("DPA") forms part of the agreement between the merchant using MadAI ("Merchant", controller) and MadHawks ("MadHawks", processor) for the MadAI service, including MadAI for Shopify, as set out in the Terms of Service.
1. Subject and duration
MadHawks processes personal data only to provide MadAI to the Merchant, for as long as the Merchant uses MadAI and until the data is deleted under section 7.
2. Nature and purpose
Answering the Merchant's customers in website chat and connected messaging channels; looking up product, policy and order information; capturing contact details customers choose to give; showing the Merchant conversations, leads and analytics; sending the Merchant notifications.
3. Data subjects and data
The Merchant's customers and website visitors: name, email, phone, messages, order numbers and statuses looked up on request, anonymous website-chat events, traffic source. Merchant staff: name, email, sign-in data.
4. Instructions
MadHawks processes personal data only on the Merchant's documented instructions (the service as configured), unless the law requires otherwise, and tells the Merchant if an instruction appears unlawful.
5. Confidentiality and security
Staff with access are bound by confidentiality. Measures: encryption in transit (TLS) and at rest (database storage AES-256 at the hosting provider; platform tokens additionally AES-256-GCM in the application); role-based access; access to conversations logged; separate test and production environments; encrypted backups; an incident response policy.
6. Sub-processors
Railway (hosting, database), Anthropic (AI responses), Voyage AI (knowledge-base search), Upstash (rate limiting), Resend (email), Sentry (error reports), Clerk (staff sign-in). MadHawks informs the Merchant of changes in advance; the Merchant may object.
7. Deletion and return
On termination, or on a Shopify shop redaction request, MadHawks deletes the Merchant's personal data within 30 days (Shopify store data: on the shop/redact request), except where the law requires keeping it. The Merchant can export leads and conversations before that.
8. Data subject requests
MadHawks helps the Merchant answer access, correction and deletion requests, including Shopify customer redaction requests, which MadAI carries out automatically.
9. Personal data breaches
MadHawks notifies the Merchant without undue delay, and within 72 hours of becoming aware, of a breach affecting the Merchant's personal data, with the information the Merchant needs to meet its own obligations.
10. International transfers
Where personal data is transferred outside the Merchant's jurisdiction, MadHawks relies on the safeguards the law requires (for EU data, the Standard Contractual Clauses).
11. Audits
MadHawks provides the information needed to show compliance with this DPA, and the reports of its hosting provider's audits (e.g. SOC 2) where available.
12. Governing law and contact