Data Processing Addendum

Effective September 11, 2026

This Data Processing Addendum ("DPA") is incorporated into, and forms part of, SuperBoom's Terms of Service. It governs SuperBoom's processing of shopper data on behalf of merchants using the service.

Parties and roles

As between the merchant and SuperBoom, the merchant is the controller/business with respect to shopper data collected through its Shopify store, and SuperBoom is the processor/service provider, processing that data only on the merchant's behalf and instructions.

Scope and purpose of processing

SuperBoom processes the following categories of shopper data, for the purpose of providing the marketing automation service the merchant configures: shopper contact and identity information (email, first/last name, Shopify customer ID); marketing consent state and resolved timezone; commerce data (cart, checkout, and order events and history); storefront behavioral events collected through a Shopify Web Pixel (pages, products and collections viewed, searches, cart and checkout activity), keyed by Shopify's pseudonymous browser identifier and linked to a shopper's profile only at deterministic identification moments (such as checkout — never by probabilistic or cross-device matching); and engagement data derived from that history and from message activity (order count, total spent, last open/click). Anonymous behavioral events are automatically deleted within approximately 90 days; behavioral events linked to an identified shopper profile are automatically deleted within approximately 13 months of collection. Processing is carried out strictly per the merchant's instructions as reflected in their SuperBoom configuration, and as described in the Privacy Policy.

Duration of processing: processing continues for the term of the merchant's subscription and until deletion under "Deletion and return" below, subject to the automatic retention schedules stated in this DPA.

The storefront behavioral events described above are used only to time and target the merchant's own first-party marketing messages. SuperBoom does not use them for cross-context behavioral advertising or for targeted advertising as defined by applicable state privacy laws (which exclude advertising based on a consumer's activity on the controller's own sites), and does not disclose them to any advertising network.

Merchant responsibilities

The merchant is responsible for having a lawful basis for the marketing it configures, including any consents required for email marketing and for storefront tracking in its jurisdictions, and for correctly configuring Shopify's customer-privacy/consent settings for its storefront. SuperBoom's pixel executes only under Shopify's customer-privacy framework: where the merchant's storefront privacy settings require consent for a visitor's region, Shopify does not load the pixel until that visitor consents; where those settings do not require consent, the pixel runs by default — configuring those settings correctly for the jurisdictions the merchant sells into is the merchant's responsibility. SuperBoom additionally enforces shopper choices mechanically — marketing sends require a positive marketing-consent state synced from Shopify (a checkout email address alone is never treated as marketing consent), and unsubscribes are honored instantly.

The merchant must maintain a publicly accessible privacy policy for its storefront that accurately discloses its data practices, including the storefront behavioral tracking performed by SuperBoom's Web Pixel, and must keep that policy current.

SMS / phone number processing

Where a merchant enables SuperBoom's SMS (text message) channel, the shopper data processed under this DPA additionally includes the shopper's phone number, stored in E.164 format, and their SMS-specific marketing consent state, consent source, and consent timestamp — a data category and a consent record kept separate from email marketing consent. This category is processed for the purpose of, and subject to the same processor obligations, retention schedule, and deletion flow described elsewhere in this DPA as, other shopper data, with one addition consistent with the email-suppression hash described under "Deletion and return": a keyed (HMAC) cryptographic hash of a phone number, computed under a secret key held outside the database, is retained on the suppression list after an opt-out or deletion request, solely so that number is never texted again — the least data that achieves that purpose.

Sensitive data

The service is not designed or intended for the processing of sensitive or special-category personal data — such as health or medical information, biometric or genetic data, government identifiers, precise geolocation, financial account credentials, or data revealing racial or ethnic origin, religious beliefs, sexual orientation, or immigration status. The merchant must not instruct SuperBoom to process such data. Commerce events from a storefront whose products may permit health-related or other sensitive inferences are addressed in "Consumer health data" below.

Processor obligations

• Instructions. SuperBoom processes shopper data only on the merchant's documented instructions, as configured in the service and as set out in this DPA — including with regard to any transfer of shopper data to a third country or international organization — unless required to process otherwise by law to which SuperBoom is subject. In that case, SuperBoom will inform the merchant of that legal requirement before processing, unless that law prohibits such notice on important grounds of public interest.
• Unlawful instructions. SuperBoom will promptly inform the merchant if, in SuperBoom's opinion, an instruction infringes applicable data protection law, and may suspend the affected processing until the instruction is amended or withdrawn.
• Confidentiality. Personnel authorized to process shopper data are bound by confidentiality obligations.
• Security measures. SuperBoom maintains technical and organizational measures appropriate to the risk, including:
  • AES-256-GCM encryption of platform access tokens, with encryption keys held in AWS KMS, separate from the encrypted data;
  • row-level tenant isolation enforced at the database layer and again at the application layer;
  • encrypted backups and encryption of data in transit;
  • separate development and production environments, with development never holding production credentials or tokens.
• Assistance. Taking into account the nature of the processing and insofar as is possible, SuperBoom will assist the merchant with: (a) responding to shopper rights requests concerning shopper data, consistent with the mechanisms described in the Privacy Policy (including Shopify's redaction webhooks); and (b) the security of processing and the merchant's own breach-notification obligations.
• Assessments. Taking into account the nature of processing and the information available to SuperBoom, SuperBoom will provide reasonable assistance to the merchant with data protection impact assessments, data protection assessments and profiling impact assessments required by applicable state law, privacy or transfer impact assessments required for transfers outside a merchant's jurisdiction, and any resulting prior consultation with a supervisory authority — including by making available current information about SuperBoom's processing operations, security measures, subprocessors, data locations, retention schedules, and any government requests for shopper data.
• Breach notification. SuperBoom will notify the merchant without undue delay after becoming aware of a breach affecting that merchant's shopper data — and where feasible within 72 hours — with information reasonably required for the merchant's own notification obligations.

Subprocessors

SuperBoom uses the following subprocessors to process shopper data, all operating in the United States:

Stripe processes merchant billing only and never receives shopper data; it is listed in the Privacy Policy's subprocessor table, which covers merchant account data as well.

SuperBoom engages each subprocessor under a written contract that requires the subprocessor to meet data protection obligations no less protective than those SuperBoom owes the merchant under this DPA with respect to shopper data, and SuperBoom remains fully liable to the merchant for each subprocessor's performance of those obligations. SuperBoom may update this list from time to time; the current list is always maintained on this page and referenced from our Privacy Policy. We will give merchants at least 15 days' notice (via the service or email) before adding or replacing a subprocessor that processes shopper data, during which a merchant may object on reasonable data-protection grounds; if we can't resolve the objection, the merchant may terminate, and will receive any refund available through the applicable billing provider.

International transfers

SuperBoom's infrastructure and all of its subprocessors are located in the United States. Shopper data is stored and processed in the United States and is not moved to any other country.

SuperBoom's service is offered to merchants established in the United States. Where a merchant is established in the European Economic Area or the United Kingdom, or where the merchant's own processing is subject to the GDPR or UK GDPR, providing shopper data to SuperBoom constitutes a transfer of personal data to a third country under Chapter V of the GDPR. SuperBoom does not currently offer a Chapter V transfer mechanism (such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or certification under the EU-U.S. Data Privacy Framework). Merchants whose processing is subject to the GDPR or UK GDPR should not use the service until SuperBoom notifies them that such a mechanism is available; merchants who believe this applies to them should contact us at support@superboom.ai.

Aggregated and De-identified Data

SuperBoom may create and use aggregated and/or de-identified data derived from processing shopper data — including sending outcomes, engagement statistics, and commerce metadata — to produce anonymized cohort statistics we may show merchants as context for their own performance, and for improving and developing our services, subject to the following commitments:

• De-identification is performed before any cross-merchant aggregation. SuperBoom does not combine identifiable shopper personal data received from one merchant with personal data received from any other merchant or source, and creates aggregates only from data that has already been de-identified to the standard of applicable law.
• The data is de-identified such that it does not identify the merchant, their store, or any individual, and SuperBoom will not attempt to re-identify it.
• Aggregates are produced only across a minimum cohort of multiple merchants, so no single merchant's specifics are discernible to another merchant.
• Raw tenant data is never shared between merchants.
• SuperBoom does not use merchant or shopper data — in identified, de-identified, aggregated, or derived form — to create, develop, train, fine-tune, or improve any machine-learning or artificial-intelligence model.
• This right survives termination of the merchant's account for data already aggregated or de-identified before termination.

Email engagement tracking

Marketing emails sent through SuperBoom on a merchant's behalf include an open-tracking pixel and tracked links. On an open or click event, SuperBoom records only the event timestamp and the message's internal message ID for the recipient — never the IP address, user agent, the specific link clicked, or any link tags, even though the underlying delivery event momentarily carries them. A click is also recorded as an open. This data is processed solely to pace send frequency and to attribute engagement to the merchant's messages and automations; it is not used for advertising and is not combined with data from any other source. It is retained under the same schedule as other storefront-linked event data (see "Retention" below) and is deleted on the same terms as other shopper data under "Deletion and return."

Retention

Shopper data is retained while the merchant's account is active and the data is needed to provide the service, subject to these automatic schedules: anonymous behavioral events are deleted within approximately 90 days; behavioral events linked to an identified shopper profile are deleted within approximately 13 months of collection; and all shopper data is subject to the deletion flows below on termination or on redaction requests. If a merchant uninstalls SuperBoom from their Shopify store, SuperBoom deletes the shopper data it holds for that store within 30 days of uninstall (uninstalling stops all automations immediately; erasure follows through Shopify's shop-redaction process), retaining only the carve-outs described below.

Deletion and return

At the end of the provision of services — termination, account deletion, or uninstall — SuperBoom will, at the merchant's election, delete or return all shopper data, and will delete remaining copies within 30 days, unless retention is required by law. Merchants may export their data at any time (self-serve, in-app, JSON format); self-serve account deletion is handled per the documented flow: billing is canceled first, then data is erased. The following carve-outs apply explicitly and survive termination:

• a keyed (HMAC) cryptographic hash of the deleted shopper email, computed under a secret key held outside the database, retained solely on the suppression list so that address is never emailed again — retaining this minimal record is what makes an opt-out or deletion request effective, and it is the least data that achieves that;
• billing and financial records, retained as required for tax and accounting purposes;
• an append-only compliance-receipt ledger (request type, dates, outcome), scrubbed of contact details.

Audit and assessment

SuperBoom will make available to the merchant all information reasonably necessary to demonstrate compliance with its obligations under this DPA and under applicable data protection law, and will allow for and contribute to audits, including inspections, conducted by the merchant or by an independent auditor mandated by the merchant and reasonably acceptable to SuperBoom. At SuperBoom's election, an audit request may instead be satisfied by SuperBoom arranging a qualified and independent assessor to assess its policies and technical and organizational measures using an appropriate and accepted control standard and assessment procedure, and providing a report of that assessment to the merchant on request — provided the merchant retains the right to an audit where the report does not reasonably address the scope of its request.

Audits may be conducted no more than once per twelve-month period, except where required by a supervisory authority or following a personal data breach affecting the merchant's shopper data, and are subject to at least thirty days' written notice, a mutually agreed scope and schedule, reasonable confidentiality undertakings, and conduct that does not unreasonably disrupt SuperBoom's operations or compromise the data of other merchants. Each party bears its own costs; SuperBoom may charge reasonable, documented costs for audits beyond the annual audit, at rates that will not be set so as to discourage a merchant from exercising this right. SuperBoom may satisfy a request in whole or in part with current third-party audit reports, certifications, or security documentation where these reasonably address the request's scope.

CCPA service-provider terms

To the extent shopper data constitutes personal information under the CCPA/CPRA, the merchant is the "business" and SuperBoom is a "service provider." SuperBoom:

1. will not sell or share (as defined in Cal. Civ. Code §1798.140(ad) and (ah)) personal information it collects pursuant to this DPA;
2. is disclosed personal information by the merchant only for, and processes it only for, the following limited and specified business purposes: (i) enrolling shoppers in and executing the merchant's configured email flows and campaigns; (ii) maintaining the merchant's shopper profiles, marketing-consent state, resolved timezone, and engagement history; (iii) collecting and storing storefront behavioral events via the Shopify Web Pixel in order to trigger the merchant's flows; (iv) generating marketing copy and creative for the merchant's campaigns; (v) suppression-list maintenance and deliverability, bounce, and complaint handling; (vi) service metrics and reporting shown to the merchant; and (vii) security, fraud prevention, debugging, and internal service-quality improvement as permitted by 11 CCR §7050(a);
3. will not retain, use, or disclose that personal information for any purpose other than those business purposes, or as otherwise permitted by the CCPA/CPRA;
4. will not retain, use, or disclose it for any commercial purpose other than those business purposes, including in providing services to another person;
5. will not retain, use, or disclose it outside the direct business relationship between SuperBoom and the merchant, and will not combine it with personal information received from or on behalf of any other person, or collected from SuperBoom's own interactions with the consumer, except as permitted by 11 CCR §7050(a);
6. will comply with all applicable obligations under the CCPA/CPRA and will provide the same level of privacy protection as the CCPA/CPRA requires of businesses, including by cooperating with the merchant in responding to consumer requests and by implementing reasonable security procedures and practices appropriate to the nature of the personal information, as required by Cal. Civ. Code §1798.81.5;
7. grants the merchant the right to take reasonable and appropriate steps to ensure that SuperBoom uses that personal information consistently with the merchant's obligations under the CCPA/CPRA — which the parties agree may be satisfied through the "Audit and assessment" section above, no more than once every twelve months absent a reasonable belief of unauthorized use;
8. will notify the merchant in writing, without undue delay, if SuperBoom determines that it can no longer meet its obligations under the CCPA/CPRA;
9. grants the merchant the right, upon notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of that personal information by SuperBoom; and
10. will enable the merchant to comply with consumer requests under the CCPA/CPRA, and will either act on such a request as directed by the merchant or, where a consumer submits a request directly to SuperBoom, inform the consumer that the request should be directed to the merchant, consistent with 11 CCR §7050(c).

Where SuperBoom engages a subprocessor to assist in providing the service, SuperBoom's written contract with that subprocessor complies with the CCPA/CPRA and its regulations, including this section.

Consumer health data

To the extent shopper data constitutes "consumer health data" under the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Act, or a comparable law, SuperBoom acts solely as a processor. SuperBoom processes such data only pursuant to the merchant's documented instructions as set out in this DPA; will not process it for any purpose other than providing the service; will not sell or share it; will not use it to serve advertising; will delete it upon the merchant's notification of a consumer deletion request; and will not combine it with data received from any other source. SuperBoom operates no geofence around any health care facility. The merchant is responsible for obtaining any consent or authorization its jurisdiction requires before instructing SuperBoom to process consumer health data, and for maintaining any separate consumer health data privacy policy applicable to its storefront.

Term and precedence

This DPA remains in effect for as long as SuperBoom processes shopper data on the merchant's behalf. In the event of a conflict between this DPA and the Terms of Service with respect to the processing of shopper data, this DPA controls — provided that the limitations of liability in the Terms of Service apply equally to claims arising under this DPA.

Contact

support@superboom.ai

By mail: SuperBoom, Inc., 2829 N San Fernando Rd, Ste 427, Los Angeles, CA 90065, USA.