Data Processing Addendum

Roles

The merchant is the controller of storefront and customer data. Pivony processes that data to provide Sonic Prospect. Terms used here have the same meaning as in the Terms of Service, including the 72-hour attribution window and the $500 of attributed order value (not commission).

Data flow

Storefront chat → this app (sonic.pivony.com on Google Cloud, us-central1) → Pivony commerce API → Google Gemini on Vertex AI (us-central1).

Personal data in chat

Shoppers may type personal information into the chat, such as their name, email or phone number. We store it with the conversation so the merchant can follow up, and we automatically mask payment card numbers. Shoppers can request deletion through the merchant.

If you use “Talk to the store”, we ask for your email and a short message, email them to the store (Reply-To: you), and keep them only in the chat transcript (13 months / 390 days).

What we keep

From paid-order, refund, and cancellation notices we keep only: order id; line items (variant id, quantity, price, discount allocations, and cart properties used to match a chat to an order); currency; financial status; timestamps; refund line items; shipping country; and the Shopify customer id stored as a salted hash. We do not store customer name, email, phone, or full address from orders. Extra fields are dropped before anything is saved.

To answer shoppers from published store content we index the Storefront API: shop details, legal policies, Online Store pages, blog articles, products (descriptions, variants, and metafields exposed to the storefront), collections, and navigation menus. Unpublished drafts, staff notes, and non-public discount codes are not ingested.

Payment card numbers that pass a Luhn check are irreversibly masked at ingestion (last four digits only) before the message is stored, logged, or sent to the commerce API. Retention: chat transcripts 13 months (390 days); pixel events 90 days; conversation summaries 36 months. Our search index (Qdrant) runs on our own Google Cloud servers. Exchange-rate services receive no personal data.

Processing location and transfers

Data is processed in the United States (Google Cloud, us-central1). Transfers from the EU/EEA rely on the EU Standard Contractual Clauses; UK transfers on the UK Addendum.

Sub-processors

• Google Cloud — hosting and database (us-central1).
• Google Gemini via the Pivony commerce API, on Vertex AI in us-central1.
• Resend — merchant notices and shopper-requested “Talk to the store” emails.

Governing law and disputes

Governing law and disputes are as set out in Sections 19 and 20 of the Terms of Service.