Seokai Logo
Get Started (opens in new tab)

Data Processing Agreement

The GDPR Article 28 terms that apply when Seokai processes personal data on behalf of merchants using the app.

Effective Date: 16 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Meta Mine, a limited liability company established in Bulgaria (European Union) ("Seokai", "we", "us"), and the merchant that installs or uses the Seokai application ("Merchant", "you"). It applies where Seokai processes personal data on your behalf in the course of providing the Seokai app. It reflects the requirements of Article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR. If this DPA and the Terms of Service conflict on data protection, this DPA prevails.

1. Roles of the Parties

For personal data contained in the store content and other material you submit to the app, you act as the controller and Seokai acts as your processor. This includes product, collection, page, and blog post text, images, AI visibility questions, brand voice settings, and social post drafts.

For data whose purposes we determine ourselves, Seokai acts as a controller, and our Privacy Policy governs that processing rather than this DPA. Examples are merchant account administration, billing, service emails, security, error monitoring, and records we keep after uninstall.

Seokai does not access Shopify Protected Customer Data. We do not request access to your customers' or orders' personal data.

Recipients you choose. You may tell Seokai to make data available to Shopify Sidekick or to a third-party AI assistant that you connect through Seokai's MCP server (for example ChatGPT or another MCP-compatible assistant). Seokai does this on your instruction. Shopify and the assistant provider are not Seokai's sub-processors. They handle the data under their own terms with you.

2. Subject Matter, Duration, Nature and Purpose

  • Subject matter: processing of personal data as necessary to provide the Seokai SEO application and its features.
  • Duration: for as long as the app is installed, plus the period needed to complete deletion as described in Section 8.
  • Nature and purpose:
    • storing copies of store content and scoring and auditing it;
    • generating and writing back SEO fields, titles, descriptions, FAQ, alt text, product types, and structured data, with AI where requested;
    • creating embeddings for internal-link suggestions and duplicate-content detection;
    • indexing, compressing, resizing, and backing up images, and replacing them in your store;
    • running AI visibility checks using an AI model with web search;
    • drafting social media captions;
    • managing redirects and, where you grant theme access, editing theme files;
    • generating llms.txt and backup files;
    • reporting;
    • answering requests from Shopify Sidekick and from AI assistants you connect.

3. Categories of Data Subjects and Personal Data

The personal data processed under this DPA is limited and mostly incidental. It may include:

  • Merchant contacts: the store's contact email address and store domain.
  • People appearing in store content: names or other details that you include in product, collection, page, or blog post text, and people shown in product, collection, or blog post images.
  • People mentioned in free text you submit: support ticket messages, brand voice settings, AI visibility questions, competitor names, and social post captions and notes.
  • Third parties named in AI visibility results: businesses or individuals mentioned in AI answers or in the websites they cite.

No special categories of personal data are intended to be processed. We do not access your customers' or orders' personal data. Shopify sends mandatory privacy notifications about shopper data requests and deletions. Because Seokai holds no shopper data, there is nothing to return or delete in response, and we do not log or store the shopper details these notifications contain.

4. Seokai's Obligations

Seokai will:

  • process personal data only on your documented instructions, including as set out in the Terms of Service, this DPA, and the settings you choose in the app, unless EU or Member State law requires otherwise (in which case we will inform you unless legally prohibited);
  • ensure that persons authorised to process the personal data are bound by confidentiality;
  • implement appropriate technical and organisational measures as described in Section 7 (Article 32 GDPR);
  • respect the conditions in Section 5 for engaging sub-processors;
  • taking into account the nature of the processing, assist you by appropriate measures in responding to data subject rights requests;
  • assist you in ensuring compliance with your obligations regarding security, breach notification, data protection impact assessments, and prior consultation (Articles 32–36 GDPR);
  • delete the personal data at the end of the provision of services, as set out in Section 8; and
  • make available the information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits as set out in Section 9.

Where assistance requested under this Section requires effort beyond the self-service tools and standard functionality of the app, we may charge a reasonable fee for that assistance. We will tell you the expected cost before proceeding.

5. Sub-processors

You give general authorisation for Seokai to engage sub-processors to provide the service. We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain responsible for their performance. Our current sub-processors are:

  • Shopify (Shopify Inc., Canada, and Shopify International Limited, Ireland):
    • Purpose: the platform the app runs on. Handles authentication, billing, and reading and writing store data.
    • Data: all store data processed by the app.
    • Location: worldwide.
  • OpenAI:
    • Purpose: AI text generation, translation, image alt text (vision), embeddings, and AI visibility answers with web search.
    • Data: item titles, descriptions, handles and keywords, store domain, brand voice settings, product image URLs, AI visibility questions, and aggregate report statistics.
    • Location: United States.
    • Retention: requests are sent with storage turned off. OpenAI may retain API inputs and outputs for up to 30 days to monitor for abuse, then deletes them, and does not use them to train its models. For AI visibility web search, OpenAI shares search queries with its third-party search providers.
  • Supabase, Inc.:
    • Purpose: primary database.
    • Data: all app data described in Section 3.
    • Location: United States (hosted on Amazon Web Services, us-east-2, Ohio).
  • Amazon Web Services:
    • Purpose: file storage (S3) for image backups, llms.txt files, and meta backup CSVs, and email delivery (SES).
    • Data: original image files, exported files, the store contact email, and email content.
    • Location: United States (us-east-2, Ohio).
  • Hetzner Online GmbH:
    • Purpose: application servers, background job queue, image compression, and error logs.
    • Data: all data in transit through the app, queued jobs, and error reports.
    • Location: Finland (EU).

Before we add or replace a sub-processor, we will update this list and email your store contact address before the change takes effect. You may object on reasonable data protection grounds. If we cannot address your objection, you may stop using the app and uninstall it.

6. International Transfers

Personal data processed under this DPA is stored and processed in the United States. Our database (Supabase), file storage, and email delivery (Amazon Web Services) are hosted in us-east-2 (Ohio), and OpenAI processes data in the United States. Our application servers are provided by Hetzner Online GmbH in Finland (EU). Shopify processes data in multiple countries.

Where personal data is transferred outside the EEA, the UK, or Switzerland, the transfer is made under an appropriate safeguard within the meaning of Chapter V GDPR. That safeguard is the European Commission's Standard Contractual Clauses included in each sub-processor's data processing terms, with the UK International Data Transfer Addendum and Swiss amendments where relevant. Where a sub-processor is certified under the EU–U.S. Data Privacy Framework and its UK and Swiss extensions, we also rely on that certification.

7. Security Measures

Seokai maintains appropriate technical and organisational measures, including:

  • encryption of data in transit (TLS);
  • encryption at rest for the database and cloud file storage, provided by our database and storage providers;
  • additional field-level encryption for sensitive fields such as newsletter email addresses;
  • authentication through Shopify OAuth, and verification of every incoming Shopify notification;
  • AI assistant access through OAuth 2.1 with your explicit consent, with tokens that are store-scoped, stored only as hashes, short-lived (1-hour access, 30-day refresh), revocable in Settings, deleted when you uninstall, and limited by a daily credit budget you control;
  • separate databases and storage for production and test environments;
  • rate limiting, with IP addresses used as rate-limit keys deleted by a daily clean-up;
  • error logging and monitoring, with error reports (including IP address and user agent) deleted automatically after 30 days, and rotation of server logs;
  • signed unsubscribe links in our emails;
  • least-privilege access to production systems.

We review and update these measures as risks evolve.

8. Return and Deletion of Data

When you uninstall the app, Seokai immediately deletes your Shopify session and access token, and all AI assistant (MCP) tokens, which ends access for connected assistants. Store data is deleted when Shopify sends its shop/redact request, about 48 hours after uninstall. At that point Seokai deletes:

  • store content copies and revision history;
  • the image index and image backups;
  • all exported llms.txt and meta backup files (older llms.txt files are already deleted whenever a new one is generated);
  • any remaining AI assistant connection records and tokens;
  • content embeddings, internal-link suggestions, and competing-content results;
  • support tickets;
  • AI visibility settings (brand names, competitors, hidden domains);
  • social post drafts;
  • redirect records, sitemap URL lists, and site audit runs;
  • theme file copies;
  • job and event records;
  • the store's contact email, primary domain, and store URL.

Seokai then retains, as controller and for the periods described in our Privacy Policy:

  • billing, subscription, credit, and usage history;
  • weekly reports;
  • SEO and sitemap audit history;
  • AI visibility questions and check results (including AI answers);
  • a minimal store record (including plan and brand voice settings).

Deleted data is removed from database backups when those backups roll over. Before uninstalling, you can export your data using meta backups, llms.txt downloads, and the Statistics CSV export. You may also ask us to delete retained records, or to delete data without uninstalling. On written request, we will confirm deletion.

9. Audit

Seokai will make available information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR. Such information will ordinarily be provided in the form of existing documentation, policies, and, where available, third-party certifications or reports. An on-site inspection will be permitted only where strictly required by applicable data protection law or by a competent supervisory authority. In that case, the inspection:

  • requires at least thirty (30) days' prior written notice;
  • is subject to confidentiality obligations;
  • may take place no more than once in any twelve (12) month period;
  • must be conducted during business hours without disrupting our operations; and
  • is carried out at your cost.

10. Personal Data Breach

Seokai will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed under this DPA. We will provide the information reasonably available to us to help you meet your notification obligations under Articles 33–34 GDPR.

11. Liability and Governing Law

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service. This DPA is governed by the laws of the Republic of Bulgaria and applicable European Union law.

12. Contact

Data protection queries and requests under this DPA can be sent to support@seokai.ai, or to Meta Mine, Burgas 8018, Bulgaria.