Data Processing Addendum

Effective September 27, 2026. This addendum forms part of the Terms of Service between the merchant (“Controller”) and Dvwmd LLC, a Wyoming limited liability company doing business as Mobilefy (“Processor”). It applies when Mobilefy processes personal data of the merchant’s shoppers.

1. Scope

Subject matter: hosting and operating the merchant’s native storefront apps. Duration: the term of the subscription plus the deletion period below. Nature: storage, synchronisation, display and push delivery. Data subjects: the merchant’s shoppers and app users. Categories: contact details, shopper account data, order references, device push tokens and app usage data needed to run the features the merchant enables.

2. Processor obligations

The Processor will process personal data only on the Controller’s documented instructions (including these terms and the merchant’s configuration of the service); ensure people authorised to process it are bound by confidentiality; implement appropriate technical and organisational security measures; and assist the Controller, taking into account the nature of processing, with data-subject requests, security, breach notification and data protection impact assessments.

3. Sub-processors

The Controller authorises the following sub-processors: Shopify, Stripe, Google Firebase, Resend, GitHub, our cloud hosting provider and, only if the Controller enables the AI shopping assistant, Anthropic (which processes shopper chat messages to generate replies and does not use them to train its models). The Processor will give notice of new sub-processors by updating this page or by email at least 15 days in advance; the Controller may object on reasonable data-protection grounds and, if unresolved, terminate the affected service. The Processor imposes equivalent data-protection obligations on each sub-processor and remains responsible for them.

4. International transfers

Personal data may be processed in the United States and other countries. Where required, transfers are made under the EU Standard Contractual Clauses (Module 2 or 3 as applicable), which are incorporated by reference, or another lawful transfer mechanism.

5. Personal data breaches

The Processor will notify the Controller without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting the Controller’s data, with the information reasonably available to help the Controller meet its obligations.

6. Deletion and return

At the end of the service, or on a verified Shopify data-erasure request, the Processor will delete the Controller’s personal data within 30 days, unless retention is required by law. The Controller may export its data before closure.

7. Audits

The Processor will make available information reasonably necessary to demonstrate compliance with this addendum and will allow for audits, no more than once a year, on reasonable notice, at the Controller’s cost, and subject to confidentiality.

8. Contact

30 North Gould Street, Sheridan, WY 82801, United States — contact@mobilefy.app