Data Processing Agreement
1. Subject Matter and Roles This Data Processing Agreement ("DPA") forms part of the Terms of Service between Surgee ("Data Processor") and the merchant installing the application ("Data Controller"). This agreement governs the processing of personal data on behalf of the Data Controller in compliance with the General Data Protection Regulation (GDPR) and other applicable privacy laws.
2. Scope of Processing Surgee provides autonomous SEO and site speed optimization. In providing this service, the Processor may process the following types of data on behalf of the Controller:
Store Data: Product details, meta tags, and catalog architecture.
Traffic Data: IP addresses and user-agent strings temporarily processed by our 404-error tracking scripts to automatically generate 301 redirects.
The Processor will only process this data for the purpose of providing the Surgee service and in accordance with the Controller's documented instructions (i.e., installing and configuring the app).
3. Sub-Processors The Controller provides general authorization for the Processor to engage third-party Sub-processors to deliver the service. Surgee utilizes the following core Sub-processors:
Shopify: For app hosting infrastructure and billing integration.
Supabase / PostgreSQL: For encrypted, multi-tenant database hosting.
Railway / Vercel: For edge network application hosting.
LiteLLM, OpenAI, Anthropic: For processing text to generate humanized SEO content and meta tags (No store data is used to train these third-party models).
DataForSEO: For executing technical SERP crawls and keyword discovery.
4. Security of Processing The Processor implements robust, enterprise-grade technical and organizational measures to ensure a level of security appropriate to the risk, including:
Strict multi-tenant architecture utilizing Row-Level Security (RLS) to mathematically isolate the Controller's data from all other users.
Encryption of sensitive access tokens (Shopify Offline Tokens, Google OAuth tokens) at rest using AES-256-GCM encryption.
A zero-secret leak deployment pipeline to prevent unauthorized code exposure.
5. Data Subject Rights & Shopify Compliance The Processor shall assist the Controller in fulfilling its obligations to respond to requests from end-users exercising their privacy rights. Surgee fully integrates with Shopify’s mandatory GDPR webhooks (customers/data_request, customers/redact, shop/redact). When Shopify signals a deletion or data request, the Processor will automatically and permanently execute the required redaction within its database.
6. Data Deletion on Termination Upon termination of the service (uninstallation of the application), the Processor will securely delete or anonymize all personal data associated with the Controller, unless further storage is required by applicable law.
7. Liability The Processor’s liability for breaches of this DPA is subject to the limitation of liability clauses set forth in the primary Terms of Service.