Data Processing Agreement

Last updated: 27 September 2026 (version 1.1)

This data processing agreement (the "DPA") governs the processing of personal data carried out by Reponse on behalf of its customers in connection with the service. It is published so that any customer can review it before subscribing. It supplements the terms of sale of the service and prevails over them on all matters relating to the protection of personal data.

This agreement does not cover the trackers set on Reponse's public website, which are dealt with in a separate document, the cookie policy, published separately and carrying its own date of last update.

This agreement is published in French and in English. In the event of a discrepancy in interpretation, the French version prevails, in accordance with section 19.2. Earlier versions are available on request from hello@reponse.ai.

1. Parties

**The processor**: Shmore, a simplified joint stock company (société par actions simplifiée) with share capital of 1,000 euros, registered office at 26 Thubert, 44118 La Chevrolière, France, registered with the Nantes trade and companies register under number 990 895 971, publisher of the Reponse service available at reponse.ai. Referred to below as "Reponse" or "the processor".

Contact for matters relating to this agreement: hello@reponse.ai. Technical support: support@reponse.ai.

EU VAT number: FR26990895971 Publication director: Vincent Redor Data protection officer: no data protection officer has been appointed. Data protection questions should be sent to hello@reponse.ai with the subject line "Data protection".

**The controller**: the customer, a legal entity or an adult natural person acting for professional purposes, who subscribes to the Reponse service and creates one or more workspaces. Referred to below as "the customer" or "the controller".

The service is reserved for professionals.

Hereinafter jointly referred to as "the parties".

2. Definitions

The terms "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given to them by Article 4 of the General Data Protection Regulation.

"GDPR" means Regulation (EU) 2016/679 of 27 April 2016.

"French Data Protection Act" means Law no. 78-17 of 6 January 1978 as amended.

"Standard contractual clauses" or "SCCs" means the standard contractual clauses adopted by the European Commission by implementing decision (EU) 2021/914 of 4 June 2021.

"Service" means the Customer Experience suite published by Reponse, its web interfaces, its chat widget, its API and its MCP server.

"Customer Data" means the personal data that the customer, its users, its own customers or its connected systems transmit to the service, or that is generated within it on the customer's behalf.

"Sub-processor" means any third party to which Reponse entrusts part of the processing of Customer Data. That term never designates Reponse itself.

3. Roles of the parties

The customer acts as controller for Customer Data. It determines the purposes and essential means of the processing, chooses which features to enable and decides what data it places into the service.

Reponse acts as processor for that same data. Reponse processes Customer Data only on the documented instructions of the customer.

Reponse acts as an independent controller, not as a processor, for its own processing activities: management of its customer accounts and billing, security and fraud prevention, support, audience measurement on its own website, and compliance with its legal and accounting obligations. Those activities are described in the service privacy policy and, as regards trackers, in the cookie policy, and not in this agreement.

Where an agency operates the service on behalf of a merchant, it acts on behalf of that merchant, who remains the customer and the controller. The agency warrants that it holds the mandate needed to act in the merchant's name. Throughout this agreement, the defined term "Sub-processor" remains reserved for third parties to which Reponse entrusts part of the processing.

4. Subject matter, duration, nature and purpose of the processing

**4.1 Subject matter.** This agreement sets out the conditions under which Reponse processes, on behalf of the customer, the personal data required to provide the service.

**4.2 Duration.** This agreement takes effect on the date the service terms are accepted or on first use of the service, whichever is earlier. It remains in force for as long as Reponse processes Customer Data, and thereafter until that data has been fully deleted or returned in accordance with section 16.

**4.3 Nature of the processing.** Collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission to the sub-processors listed in Annex 2, alignment, restriction, erasure and destruction.

**4.4 Purposes.** The processing is carried out for the sole purpose of providing and maintaining the service subscribed to by the customer, namely:

1. live chat with a human agent and with an AI agent, on the customer's site and in connected channels,
2. management of tickets and of the shared inbox,
3. loyalty and referral programmes,
4. contact management and CRM,
5. sending of transactional emails triggered by the customer or by its rules,
6. access to the customer's catalogue and orders,
7. access to the service through the API and the MCP server,
8. technical assistance provided to the customer at its request,
9. security of the service, prevention of abuse and technical logging.

**4.5 Detailed description.** The full description of the processing is set out in Annex 1.

5. Documented instructions of the controller

**5.1** Reponse processes Customer Data only on the documented instructions of the customer, including with regard to transfers outside the European Union.

**5.2** Taken together, the customer's documented instructions consist of:

1. this agreement and its annexes,
2. the general terms of the service and the technical documentation,
3. the configuration settings chosen by the customer in its workspace, in particular the integrations it enables, the automation rules it writes and the retention periods it selects where the service allows,
4. the calls made by the customer to the service's programming interfaces,
5. any additional written instruction sent to hello@reponse.ai and accepted in writing by Reponse.

**5.3** If Reponse considers that an instruction from the customer infringes the GDPR or another provision of Union or Member State law on data protection, it shall inform the customer without delay and may suspend performance of the instruction concerned until it is confirmed or amended.

**5.4** If Reponse is required to process Customer Data under Union law or French law outside the customer's instructions, it shall inform the customer before processing, unless that law prohibits such information on important grounds of public interest.

**5.5** Reponse does not sell Customer Data, does not rent it, does not use it for advertising purposes and does not exploit it for its own account outside the cases set out in section 3.

**5.6 Aggregated data.** Reponse may produce aggregated statistics on the use of the service for operational, billing, security and service improvement purposes. Those statistics are based on usage counters, such as the number of conversations, messages and sends, and the consumption of AI models. They contain no conversation content and no direct identifier of data subjects. For as long as they remain linked to a workspace, they remain subject to this agreement.

6. Customer obligations

The customer warrants that:

1. it has a valid legal basis for each processing operation it entrusts to Reponse and, where consent is required, that it has obtained it in accordance with the GDPR,
2. it has informed data subjects of the processing, of the use of Reponse as a processor and, where relevant, of the use of AI agents to handle their requests,
3. the data it transmits is accurate, relevant and limited to what is necessary,
4. it does not place into the service, in particular in conversations, contact records or imported files, any data falling within Article 9 GDPR (so-called sensitive data, in particular health data, political opinions, religious beliefs, sexual orientation, biometric data), any data relating to criminal convictions, or any payment card numbers or authentication credentials, unless Reponse has given its prior written agreement and appropriate safeguards have been put in place,
5. it configures its own users' access correctly and promptly revokes access that is no longer needed,
6. it checks that the integrations it enables towards third party services are compatible with its own commitments,
7. it determines the minimum age applicable to its own services and, where minors are likely to use the chat widget or the other connected channels, it provides appropriate information and, where required, obtains the consent of the holder of parental responsibility under Article 8 GDPR and Article 45 of the French Data Protection Act.

Access to the service itself, that is to workspaces, is reserved for adult professionals. The chat widget is used by visitors to the customer's store, whose age Reponse does not verify.

The customer remains solely responsible for the content of the messages it sends and for the decisions it takes on the basis of the information returned by the service.

7. Confidentiality and personnel

**7.1** Reponse treats Customer Data as confidential information. That obligation survives for five years after the end of the agreement.

**7.2** As at the date of last update of this agreement, Reponse has no employee, contractor or subsidiary with access to Customer Data. Only Shmore's director, Vincent Redor, has access to it, and he is bound by confidentiality. Should Reponse authorise other persons, it would first bind them to a written confidentiality obligation that survives the end of their assignment, and would update this section.

**7.3** Access to Customer Data is limited to what is necessary to provide, operate and secure the service or to respond to a support request. Reponse accesses the content of a workspace only at the customer's request.

**7.4 Location of access.** Reponse accesses Customer Data only from France. No access takes place from a country outside the European Union.

8. Security measures

**8.1** Reponse implements the appropriate technical and organisational measures required by Article 32 GDPR, taking into account the state of the art, the cost of implementation, the nature, scope, context and purposes of the processing, and the risks to the rights and freedoms of individuals.

**8.2** Those measures are described in Annex 3. They are described factually, as actually implemented at the date of last update of this agreement.

**8.3** Reponse makes no claim in this agreement to any security certification, any label, any external audit or any quantified availability commitment. Any certification obtained in the future will be recorded in Annex 3.

**8.4** The measures may evolve, in particular to reflect changes in risks and technology. Reponse will not make any change that materially lowers the security level of the service.

9. Sub-processors

**9.1 General authorisation.** The customer gives Reponse a general written authorisation to engage sub-processors for the performance of the service, subject to this section.

**9.2 List.** The list of sub-processors is set out in Annex 2. It is published and kept up to date at https://reponse.ai/legal/sub-processors. The published, dated list is authoritative.

**9.3 Contract.** In accordance with Article 28(4) GDPR, each sub-processor is bound by contract to data protection obligations, as a rule through the data processing agreement that provider offers to its business customers. Reponse remains fully liable to the customer for the performance by the sub-processor of its obligations.

**9.4 Publication of changes.** Reponse adds, replaces or removes a sub-processor by publication on the page referred to in section 9.2, with the date shown at the top of that page updated accordingly. Reponse does not individually notify the customer of these changes. By using the service, the customer gives the general authorisation provided for in Article 28(2) GDPR for the sub-processors so listed and for those added later under the same publication procedure.

**9.5 Integrations enabled by the customer.** When the customer enables an integration towards a third party service, in particular Shopify, Klaviyo, Notion or TikTok Shop, it instructs Reponse to transmit to that third party the data required for the integration to work. That third party then acts either as a sub-processor of Reponse or as an independent controller, depending on the contractual relationship between the customer and that third party. Customers are invited to review the terms applicable to each of those services.

10. Assistance with data subject rights

**10.1** Reponse makes available to the customer, within the service, the features needed to view, rectify and delete a contact's data. The customer may also ask Reponse to export a contact's data, in writing to hello@reponse.ai.

**10.2** If a data subject sends Reponse directly a request to exercise their rights concerning Customer Data, Reponse does not respond to the substance of the request. It informs the customer without undue delay and forwards the request, unless applicable law requires Reponse to respond itself.

**10.3** Reponse assists the customer, insofar as possible and taking into account the nature of the processing, in responding to requests to exercise the rights of access, rectification, erasure, restriction, portability and objection, as well as the right not to be subject to a decision based solely on automated processing.

**10.4** This assistance is free of charge in ordinary cases. Where a request requires specific and significant technical work, Reponse informs the customer in advance and sends a quote; no cost is incurred without the customer's written acceptance of that quote.

11. Assistance with security, impact assessments and prior consultation

Reponse assists the customer, taking into account the nature of the processing and the information available to it, in:

1. ensuring compliance with the security obligations set out in Article 32 GDPR,
2. notifying personal data breaches to the supervisory authority (Article 33) and communicating them to data subjects where required (Article 34),
3. carrying out a data protection impact assessment (Article 35), by providing the necessary technical information about the service, in particular on how the AI agents operate,
4. conducting, where applicable, prior consultation with the supervisory authority (Article 36).

This assistance takes the form of available documentation and written answers to the customer's questions. It is for the customer, as controller, to assess whether an impact assessment is required and to carry it out; Reponse does not carry out impact assessments on the customer's behalf. This assistance does not transfer to Reponse any of the obligations that fall to the controller.

12. Personal data breach notification

**12.1** Reponse notifies the customer of any personal data breach affecting Customer Data, without undue delay and no later than seventy-two hours after becoming aware of it. Becoming aware means the moment at which Reponse has a reasonable degree of certainty that a security incident has compromised Customer Data.

**12.2** The notification is sent by email to the contact address recorded in the customer's workspace, from the address hello@reponse.ai. The customer keeps its contact address up to date. No other channel constitutes notification for the purposes of this section.

**12.3** The notification describes, to the extent the information is available at the time of sending:

1. the nature of the breach, including, where possible, the categories and approximate number of data subjects and records concerned,
2. the likely consequences of the breach,
3. the measures taken or proposed to address it and to mitigate its effects,
4. the point of contact from which further information may be obtained.

**12.4** Where all the information cannot be provided at once, it is provided in phases without undue delay.

**12.5** It is for the customer, as controller, to decide on and carry out notification to the supervisory authority and communication to data subjects. Reponse does not notify a breach to a supervisory authority on the customer's behalf without written instructions from the customer.

**12.6 Reciprocal obligation of the customer.** The customer notifies Reponse, without undue delay and in writing to hello@reponse.ai, of any security incident on its side that is liable to affect Customer Data hosted in the service, of any compromise or suspected compromise of one of its users' access, and of any complaint or request from a data subject whose handling requires Reponse's involvement. The customer promptly revokes any compromised access.

13. Processing by AI models

**13.1** The service includes features that rely on AI models. To generate a reply, the necessary content, in particular the data subject's message, the conversation history and the context items selected by the customer, is transmitted to the model providers listed in Annex 2, which act as sub-processors of Reponse.

**13.2** Reponse does not develop or train any model on Customer Data. Reponse uses the paid API offerings of OpenAI, Google (Gemini) and Mistral, whose terms exclude, according to each of those providers, the use of transmitted data to train their models. Under those same terms, transmitted data may be retained by the provider for up to thirty days at most, in particular for abuse detection, and is then deleted.

**13.3** The service may route a request to one or another of the providers listed in Annex 2 on technical and economic grounds. As at the date of last update of this agreement, replies are generated by OpenAI models; Google and Mistral models are integrated into the service and may be called under that routing. The customer may ask Reponse which providers are used for its workspace.

**13.4 Semantic search.** To let the AI agent find relevant information, the service computes vector representations of the content placed into it by the customer, in particular its knowledge base and catalogue, using an OpenAI model. Those representations are stored in the service database, at Supabase.

**13.5 Contact memory.** Where a visitor is identified as a verified contact of the customer, the service periodically extracts from their conversations with the AI agent durable preferences and facts, such as preferred product category, size, products of interest, an unresolved objection, a budget signal or preferred contact channel. That information is attached to the contact record, used to personalise later replies and deleted together with that record.

**13.6** Automatically generated replies are proposals intended to be used by the customer. Where the customer lets the AI agent reply without human involvement, it is for the customer to assess whether the processing falls within Article 22 GDPR and to draw the consequences, in particular by informing data subjects and providing for human intervention. The chat widget offers visitors the option to talk to a human; it does not by itself state that replies are generated by AI, and informing visitors on that point is the customer's responsibility under section 6.

14. International transfers

**14.1 Location.** The country and, where known, the hosting region of each sub-processor are set out in Annex 2. The service database, which holds all Customer Data, is hosted at Supabase in the eu-west-1 region (Ireland), where its backups are also kept. The service's server functions are run by Netlify in the eu-west-1 region (Dublin, Ireland), next to the database; requests reach them through Netlify's global network, which also delivers static content. The cache of published public pages is kept by Netlify in the us-east-2 region (Ohio, United States); it holds pages that are already public and no other Customer Data.

**14.2** Some sub-processors are established outside the European Union, in particular in the United States, or may carry out all or part of the processing there. In that case, the transfer is governed by one of the mechanisms provided for in Chapter V GDPR:

1. an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the recipient is certified under it,
2. failing that, the standard contractual clauses, supplemented where appropriate by additional measures.

**14.3** The customer instructs Reponse to carry out those transfers for the purposes of the service and authorises Reponse to enter into the standard contractual clauses with the sub-processors concerned, on the customer's behalf.

**14.4** Annex 2 specifies, for each sub-processor, the country of processing and the applicable transfer mechanism. The entry "DPF or SCCs" means that the transfer relies on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the standard contractual clauses.

**14.5 Standard contractual clauses.** Where the standard contractual clauses are used, they are incorporated into this agreement by reference, in the applicable module:

1. module 2, controller to processor, for a transfer between the customer and Reponse,
2. module 3, processor to processor, for a transfer between Reponse and a sub-processor.

Annexes I, II and III to the standard contractual clauses are completed by the provisions of this agreement: Annex I by section 1 (parties) and Annex 1 (categories of data subjects and data, purposes, nature and duration of the processing), Annex II by Annex 3 (security measures), and Annex III by Annex 2 (sub-processors). The competent supervisory authority under clause 13 is the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. The clauses are governed by French law (clause 17) and disputes arising from them fall within the jurisdiction of the courts of Nantes, France (clause 18).

**14.6 Transfer assessment.** For transfers based on the standard contractual clauses, the parties take into account, in accordance with clause 14 of those clauses, the law of the destination country, the circumstances of the transfer and the safeguards in place. Reponse provides the customer, on written request, with the information it holds on that assessment.

**14.7 Invalidation, suspension or amendment of the transfer mechanism.** If the transfer mechanism used is invalidated, suspended or materially amended by a decision of a competent authority or court, the parties will confer without undue delay in order to put in place a replacement mechanism within a reasonable time. In the meantime, Reponse will apply the supplementary measures available and, if no replacement mechanism is practicable, will suspend the transfer concerned. If the suspension makes it impossible to provide the service, the customer may terminate the affected part of the service without charge or penalty, with a pro rata refund of amounts paid in advance and not used.

**14.8 Binding requests from public authorities.** If Reponse, or one of its sub-processors, receives from a public, judicial or administrative authority, including outside the European Union, a binding request for disclosure of Customer Data, Reponse will:

1. inform the customer without undue delay, unless applicable law prohibits it from doing so, in which case it will seek to have that prohibition lifted or its scope reduced, and will inform the customer as soon as it becomes possible to do so,
2. review the lawfulness of the request and challenge, through the available remedies, including by seeking interim measures, any request that appears to it unlawful under Union law or the law of the Member State concerned, or manifestly disproportionate,
3. disclose only the minimum data strictly required by the request, after a reasonable assessment of its scope,
4. document the requests received, the items disclosed and the action taken, and make that information available to the customer on request, to the extent that disclosure is lawful.

15. Audit and documentation

**15.1** Reponse makes available to the customer the information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, in particular this agreement, its annexes and the technical documentation of the service.

**15.2** The customer exercises its audit right first by way of a written questionnaire on the security and data protection measures implemented, no more than once in any twelve month period. Reponse responds within thirty days of receipt, where appropriate by referring to its existing documentation where that documentation answers the question asked.

**15.3** The customer may carry out an inspection, itself or through a third party auditor bound by confidentiality, only where the answers given to the questionnaire under section 15.2 are insufficient to demonstrate compliance with the obligations under this agreement. The investigative powers of supervisory authorities are not affected by this section.

**15.4** The inspection is notified in writing at least thirty days in advance, takes place during business hours, does not disproportionately disrupt Reponse's operations, does not cover confidential information relating to other customers, and does not include penetration testing without the prior written agreement of Reponse and, where relevant, of its hosting providers. The cost of the inspection is borne by the customer, including the time spent by Reponse, which is invoiced on the basis of a quote in accordance with section 10.4.

**15.5** Each party maintains a record of categories of processing activities in accordance with Article 30 GDPR.

16. Fate of the data at the end of the agreement

**16.1 Return and reversibility.** Throughout the term of the agreement and for thirty days after it ends, the customer may request an export of its data in writing to hello@reponse.ai. The export is provided in CSV or JSON format within thirty days of the request.

**16.2 Deletion.** At the customer's written election, made before the end of that period, Reponse deletes Customer Data or returns it. Absent an express election, Reponse deletes Customer Data at the end of that period.

**16.3 Deletion timeline.** Customer Data is deleted from production systems thirty days after the end of the agreement. Data held in backups is erased as those backups rotate, no later than thirty days after its deletion from production systems.

**16.4 Legal retention.** Reponse may retain certain data beyond those periods where Union law or French law requires it, in particular for accounting and tax purposes, and only to the extent and for the duration required. Such data is then archived with restricted access and is no longer processed for any other purpose.

**16.5** Reponse certifies deletion in writing at the customer's request.

**16.6 Identification data and connection logs.** Reponse retains the identification data provided on subscription and the connection logs whose retention is required by the French Act for confidence in the digital economy and by decree no. 2021-1362 of 20 October 2021, for the period laid down by those texts and for the sole purpose of responding to requests from authorised authorities. That retention applies regardless of the retention periods chosen by the customer.

17. Liability

**17.1** Each party's liability under this agreement is governed by the liability provisions of the terms of sale of the service, within the limits permitted by applicable law and without those limits restricting the rights of data subjects or the enforcement powers of supervisory authorities.

**17.2** Each party bears the consequences of its own breaches of the GDPR.

18. Governing law and jurisdiction

**18.1** This agreement is governed by French law and by the GDPR.

**18.2** The parties will seek an amicable resolution of any dispute. Failing agreement, the dispute will be brought before the competent courts of Nantes, France, in accordance with Article 48 of the French Code of Civil Procedure.

19. Amendments, language and contact

**19.1** Reponse may amend this agreement to reflect legal, regulatory, case law or technical developments. Any amendment is announced by email and by updating the date shown at the top of this agreement. Any material change is communicated to the customer at least thirty days before it takes effect.

**19.2** This agreement is published in French and in English. In the event of a discrepancy in interpretation, the French version prevails.

**19.3** Any question relating to this agreement may be sent to hello@reponse.ai. Technical support requests should be sent to support@reponse.ai.

20. Assignment, change of control and cessation of business

**20.1** Reponse may assign this agreement, in particular in the event of a merger, partial contribution of assets, sale of its business or change of control of Shmore, provided that the assignee assumes all of the obligations under this agreement. Reponse will inform the customer in writing within thirty days of the transaction.

**20.2** If the assignee or the new controlling shareholder is established outside the European Union, or if the transaction materially changes the conditions of processing, security or location of Customer Data, the customer may terminate the agreement without charge or penalty within thirty days of being informed, with a pro rata refund of amounts paid in advance and not used.

**20.3** If Reponse ceases business, including following safeguard, receivership or judicial liquidation proceedings, Reponse or the appointed officer informs the customer by email at least thirty days before the service is discontinued, to the extent permitted by law and by the applicable court decisions, and allows it to export its data under section 16.1 before that date.

21. General provisions

**21.1 Order of precedence.** In the event of a conflict between the contractual documents, the order of precedence is as follows:

1. the standard contractual clauses, solely as regards the international transfers they govern,
2. this agreement and its annexes,
3. the terms of sale of the service,
4. the technical documentation of the service and any other document.

**21.2 Severability.** If any provision of this agreement is held void, unlawful or unenforceable by a competent court or authority, that provision is deemed not to have been written and the remaining provisions remain in force. The parties will negotiate in good faith a replacement provision with as close an economic and legal effect as possible.

**21.3 No waiver.** The failure of a party to rely on a breach by the other party of any of its obligations may not be construed as a waiver of the right to rely on it subsequently.

**21.4 Entire agreement.** This agreement, its annexes and the documents it refers to constitute the entire agreement of the parties with regard to the protection of personal data and supersede any prior agreement on the same subject matter.

**21.5 Survival.** Sections 7, 12.6, 16, 17, 18 and 21 survive the end of this agreement for as long as necessary for their performance.

Annex 1: description of the processing

**Subject matter of the processing.** Provision of a Customer Experience suite to Shopify merchants.

**Duration of the processing.** Term of the subscription or of use of the free plan, followed by the retrieval period and deletion timelines set out in section 16.

**Nature of the operations.** Collection, recording, structuring, storage, consultation, use, transmission to sub-processors, generation of replies by AI models, computation of vector representations of content for semantic search, sending of emails, erasure.

**Purposes.** Those listed in section 4.4.

**Categories of data subjects**

1. the customer's customers and prospects, that is the visitors to and buyers from its online store,
2. users of the customer's workspace, that is its employees, contractors and agents,
3. business contacts recorded in the customer's CRM,
4. recipients of the transactional emails sent by the customer.

**Categories of data processed**

1. identification data: surname, first name, email address, telephone number where provided, internal identifiers, the contact's identifier at the customer,
2. communication content: chat messages, tickets, attachments sent by the data subject, internal notes,
3. order and transaction data: order number, products, amounts, status, shipping and billing address, purchase history,
4. loyalty and referral data: points balance, referees, rewards,
5. connection and technical data: IP address, timestamp, browser type, pages viewed in the context of the conversation, session identifier; the chat widget stores in the visitor's browser a session identifier, the conversation history, a visit counter and the date of the last visit (the latter two only with the visitor's consent to analytics),
6. data relating to emails sent: delivery status and, where reported by the sending provider, open and click events,
7. account data of workspace users: identifiers, roles and permissions, activity logs,
8. durable preferences and facts inferred from the conversations of verified contacts, under the conditions of section 13.5,
9. any other data the customer chooses to place into the service.

**Excluded categories of data.** Sensitive data within the meaning of Article 9 GDPR, data relating to criminal convictions, payment card numbers and authentication credentials must not be placed into the service, in accordance with section 6. The service is not designed to process them.

**Retention periods within the service.** Data is retained for the term of the agreement and deleted under the conditions of section 16. During the agreement, the following periods apply, unless the customer sets a shorter period where the service allows:

1. conversations, tickets and CRM contact data, including inferred preferences: three years from the last contact,
2. technical logs: twelve months,
3. database backups: seven days.

Annex 2: list of sub-processors

List current as at the date of last update of this agreement. The version in force is published at https://reponse.ai/legal/sub-processors. The entry "DPF or SCCs" is defined in section 14.4.

Infrastructure and core functions

AI models

Emails

Product analytics

Tools loaded on Reponse's public website

These tools relate to Reponse's public website, for which Reponse acts as an independent controller within the meaning of section 3. They are mentioned here for transparency and are described in the cookie policy.

Integrations enabled at the customer's request

These services are only used if the customer enables the corresponding integration. The place of processing and the transfer mechanism are those set out in the terms between the customer and each of those services.

Annex 3: security measures

The measures below are described as implemented at the date of last update. They constitute neither a certification nor a guarantee of result.

1. Encryption in transit

Exchanges between the customer's browser or system and the service are encrypted in transit using TLS. The service is served exclusively over HTTPS and enforces HTTPS in browsers through the Strict-Transport-Security header (one year, subdomains included).

2. Encryption at rest

Data is stored at Supabase, which encrypts it at rest.

3. Data segregation

Each customer has one or more workspaces. Access to data is restricted at database level by row level security rules tied to the workspace and to the user's role. Service credentials with elevated privileges are reserved for server-side processing and are not exposed to the browser.

4. Access control

User authentication relies on Supabase's authentication service. Reponse's administration accounts at Supabase, Netlify, GitHub and Shopify Partner are protected by two-factor authentication. Only Shmore's director has access to them.

5. Secrets management

API keys and secrets are stored in environment variables managed by the hosting platform.

6. Logging

The service records technical access and error logs that make it possible to detect and analyse an incident. Those logs are retained for twelve months.

7. Data minimisation in analytics tools

The product analytics tool collects nothing before the data subject's consent. After consent, it records usage events, heatmaps and sessions; input fields are masked in session recordings and automatic capture of interactions excludes the chat widget.

8. Backups and continuity

The database is backed up daily by Supabase, with backups kept for seven days in the same region (eu-west-1, Ireland).

9. Development and change management

Changes to the service go through a version control repository, are accompanied by an automated test suite and are deployed automatically. An earlier deployment can be restored.

10. Incident management

Security incidents are assessed and handled by Shmore's director, who carries out the notification provided for in section 12.

11. Security testing

No external security audit or penetration test is claimed to date.

12. Certifications

No security certification is claimed to date.