Data Processing Addendum

Effective August 1, 2026

This Data Processing Addendum ("DPA") is incorporated into, and forms part of, SuperBoom's Terms of Service. It governs SuperBoom's processing of shopper data on behalf of merchants using the service.

Parties and roles

As between the merchant and SuperBoom, the merchant is the controller/business with respect to shopper data collected through its Shopify store, and SuperBoom is the processor/service provider, processing that data only on the merchant's behalf and instructions.

Scope and purpose of processing

SuperBoom processes the following categories of shopper data, for the purpose of providing the marketing automation service the merchant configures: shopper contact and identity information (email, first/last name, Shopify customer ID); marketing consent state and resolved timezone; commerce data (cart, checkout, and order events and history); storefront behavioral events collected through a Shopify Web Pixel (pages, products and collections viewed, searches, cart and checkout activity), keyed by Shopify's pseudonymous browser identifier and linked to a shopper's profile only at deterministic identification moments (checkout, login, or consented capture — never by probabilistic or cross-device matching); and engagement data derived from that history and from message activity (order count, total spent, last open/click). Anonymous behavioral events are automatically deleted on a rolling 90-day schedule; behavioral events linked to an identified shopper profile are automatically deleted within approximately 13 months of collection. Processing is carried out strictly per the merchant's instructions as reflected in their SuperBoom configuration, and as described in the Privacy Policy.

Merchant responsibilities

The merchant is responsible for having a lawful basis for the marketing it configures, including any consents required for email marketing and for storefront tracking in its jurisdictions, and for correctly configuring Shopify's customer-privacy/consent settings for its storefront. SuperBoom's pixel executes only under Shopify's customer-privacy framework and does not run for non-consented visitors in consent-required regions; SuperBoom additionally enforces shopper choices mechanically — marketing sends require a positive marketing-consent state synced from Shopify (a checkout email address alone is never treated as marketing consent), and unsubscribes are honored instantly.

Processor obligations

• Instructions. SuperBoom processes shopper data only on the merchant's documented instructions (as configured in the service), unless required otherwise by law.
• Confidentiality. Personnel authorized to process shopper data are bound by confidentiality obligations.
• Security measures. SuperBoom maintains technical and organizational measures appropriate to the risk, including:
  • AES-256-GCM encryption of platform access tokens, with encryption keys held in AWS KMS, separate from the encrypted data;
  • row-level tenant isolation enforced at the database layer and again at the application layer;
  • encrypted backups and encryption of data in transit;
  • separate development and production environments, with development never holding production credentials or tokens.
• Assistance. SuperBoom will assist the merchant in responding to data-subject requests concerning shopper data, consistent with the mechanisms described in the Privacy Policy (including Shopify's redaction webhooks).
• Breach notification. SuperBoom will notify the merchant without undue delay, and in any event within 72 hours, after becoming aware of a breach affecting that merchant's shopper data, with information reasonably required for the merchant's own notification obligations.

Subprocessors

SuperBoom uses the following subprocessors to process shopper data, all operating in the United States:

SuperBoom may update this list from time to time; the current list is always maintained on this page and referenced from our Privacy Policy. We will give merchants at least 15 days' notice (via the service or email) before adding or replacing a subprocessor that processes shopper data, during which a merchant may object on reasonable data-protection grounds; if we can't resolve the objection, the merchant may terminate and receive a pro-rata refund of prepaid fees. SuperBoom remains responsible for each subprocessor's performance of its obligations.

International transfers

All processing under this DPA takes place in the United States. SuperBoom does not transfer shopper data outside the United States.

Aggregated and De-identified Data

SuperBoom may create and use aggregated and/or de-identified data derived from processing shopper data — including sending outcomes, engagement statistics, and commerce metadata — for benchmarking, and for improving and developing our services, subject to the following commitments:

• The data is de-identified such that it does not identify the merchant, their store, or any individual, and SuperBoom will not attempt to re-identify it.
• Aggregates are produced only across a minimum cohort of multiple merchants, so no single merchant's specifics are discernible to another merchant.
• Raw tenant data is never shared between merchants.
• This right survives termination of the merchant's account for data already aggregated or de-identified before termination.

Retention

Shopper data is retained while the merchant's account is active and the data is needed to provide the service, subject to these automatic schedules: anonymous behavioral events are deleted on a rolling 90-day schedule; behavioral events linked to an identified shopper profile are deleted within approximately 13 months of collection; and all shopper data is subject to the deletion flows below at uninstall, termination, or on redaction requests.

Deletion and return

On termination of a merchant's account, the merchant may export their data (self-serve, in-app, JSON format) and may request deletion, which is handled per the documented flow: billing is canceled first, then data is erased. The following carve-outs apply explicitly and survive termination:

• a salted cryptographic hash of the deleted shopper email, retained solely on the suppression list so that address is never emailed again;
• billing and financial records, retained as required for tax and accounting purposes;
• an append-only compliance-receipt ledger (request type, dates, outcome), scrubbed of contact details.

Audit

Upon reasonable request, SuperBoom will make available documentation and summaries reasonably sufficient to demonstrate compliance with this DPA.

CCPA service-provider terms

To the extent shopper data constitutes personal information under the CCPA/CPRA, SuperBoom acts as a "service provider" and agrees not to sell or share that personal information, not to retain, use, or disclose it for any purpose other than providing the service to the merchant, and not to combine it with personal information received from other sources, except as permitted by the CCPA/CPRA.

Term and precedence

This DPA remains in effect for as long as SuperBoom processes shopper data on the merchant's behalf. In the event of a conflict between this DPA and the Terms of Service with respect to the processing of shopper data, this DPA controls.

Contact

support@superboom.ai