LLM Pixels

Data Processing Agreement

Last updated 27 August 2026

This agreement applies between the merchant (the controller) and the app developer (the processor) whenever the app is installed.

Roles

The merchant determines the purposes and means of processing and is the controller. ARS PROGRAMMATICA processes personal data only on the merchant's documented instructions and is the processor. Installing the app and enabling its features constitute those instructions.

Subject matter and duration

The subject matter is the measurement of advertising conversions. Processing lasts for as long as the app is installed, and ends on uninstall.

Nature and purpose

Personal data is read from Shopify order webhooks, converted into a conversion event, and transmitted to OpenAI. Direct identifiers are hashed before transmission. No personal data is stored.

Categories of data subjects and personal data

Data subjects are the merchant's customers and storefront visitors. The categories are:

Name, email address and phone number, which are hashed with SHA-256 before transmission and never sent or stored in readable form.
Shopify customer ID, hashed with SHA-256 and used only as a pseudonymous match key.
City, region, postal code and country, sent as provided.
IP address and browser user agent, sent as provided.
Order value, currency, and the products purchased.

Processor obligations

Process personal data only on the controller's instructions.
Ensure that anyone authorised to process the data is bound by confidentiality.
Implement the technical and organisational measures described in the security statement.
Assist the controller with data subject requests and with security and breach obligations.
Delete all merchant data on uninstall and on shop redaction.
Make available the information needed to demonstrate compliance.

Sub-processors

The merchant authorises the following sub-processors. We will give notice before adding another, and the merchant may object by uninstalling the app.

OpenAI - receives conversion events. This is the purpose of the app.
Railway - hosts the application and its database.

Personal data breaches

We will notify the merchant without undue delay after becoming aware of a personal data breach affecting their data, with the information available at the time, at the contact address on their Shopify account. Report a suspected incident to info@arsprogrammatica.com.

Return and deletion

Because no customer personal data is stored, there is nothing to return. Merchant configuration is deleted on uninstall and again on Shopify's shop redaction webhook.