Data Processing Agreement

Last updated: 26 October 2026

This Data Processing Agreement ("DPA") explains how flareOps processes personal data on behalf of the businesses that use it. It forms part of the flareOps terms of service ("Terms") and is incorporated into them by reference.

1. Parties and acceptance

• "flareOps", "we", "us": flareOps (operated by its founder, Israel). Contact: hello@flareops.ai.
• "Merchant", "you": the business that connects a store to flareOps. The person who connects the store confirms that they are allowed to accept this DPA on behalf of that business.
• You accept this DPA when you connect a store to flareOps and tick the agreement box. This DPA is concluded in electronic form, which is a valid written form under Article 28(9) of the GDPR and the equivalent rules of other laws listed below. We keep a record of who accepted it, when, and which version.

2. Definitions

• "Data Protection Laws" means all privacy and data protection laws that apply to the processing under this DPA, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and the UK Data Protection Act 2018, the Israeli Protection of Privacy Law, 5741-1981, as amended including by Amendment 13 ("PPL"), the Israeli Protection of Privacy (Data Security) Regulations, 5777-2017 ("Data Security Regulations"), and US state privacy laws such as the California Consumer Privacy Act as amended by the CPRA ("CCPA").
• "Store Personal Data" means the personal data that flareOps processes on your behalf to provide the service, as described in Annex 1.
• "Sub-processor" means another company that flareOps engages to process Store Personal Data.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Store Personal Data.
• Terms such as "controller", "processor", "data subject", "personal data" and "processing" have the meanings given in the GDPR. Under the PPL, the controller is the "database owner" and the processor is the "holder". Under the CCPA, you are the "business" and we are the "service provider". Under other US state laws, you are the "controller" and we are the "processor".

3. Roles and scope

• For Store Personal Data, you are the controller and flareOps is your processor.
• For account data (the Google account ID, email address and name of the people who sign in to the flareOps app, the session cookie, consent records and support emails), flareOps is the controller. That data is covered by our privacy policy, not by this DPA.
• Annex 1 describes the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.

4. Processing only on your instructions

• We process Store Personal Data only on your documented instructions, including with regard to transfers to other countries, unless the law requires otherwise. If the law requires otherwise, we will tell you before processing, unless that law forbids it on important grounds of public interest.
• Your instructions are: the Terms, this DPA, the settings you choose in the app and the plugin, the changes you approve, and any other written instructions you send us by email that are consistent with the Terms.
• We will tell you straight away if, in our opinion, an instruction infringes Data Protection Laws.

5. Confidentiality

flareOps is currently operated by its founder, who is the only person with administrative access to Store Personal Data. Anyone we authorise in the future to process Store Personal Data will be bound by a written duty of confidentiality, or an appropriate legal duty of confidentiality, and will have access only as far as needed for their role.

6. Security

We take the technical and organisational measures described in Annex 2, which are designed to meet Article 32 of the GDPR and the Data Security Regulations. We may update these measures over time, but we will not reduce the overall level of protection.

7. Sub-processors

• You give us general authorisation to use the Sub-processors listed on our sub-processors page (Annex 3).
• We will give at least 30 days' notice before adding or replacing a Sub-processor, by updating the sub-processors page and emailing the store owners of connected stores. You can also subscribe to updates as described on that page.
• You may object to a new Sub-processor on reasonable data protection grounds by emailing us within the notice period. We will then try to find a reasonable solution. If we cannot, you may stop using the affected part of the service or end the Terms, and we will delete the Store Personal Data as described in section 10.
• We impose on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, in particular sufficient guarantees of appropriate security measures. We remain responsible to you for the performance of our Sub-processors' obligations.

8. Helping you with data subject requests

Taking into account the nature of the processing, we will help you, by appropriate technical and organisational measures and as far as possible, to respond to requests from people exercising their rights (such as access, correction, deletion, restriction, objection or portability). If we receive a request directly that relates to Store Personal Data, we will pass it to you without undue delay and will not respond ourselves, except to tell the person to contact you, unless you instruct us otherwise. Because the service holds no shopper names, emails or account details, most requests will concern IP addresses in bot logs or pseudonymised order references; we can find and delete these on your request.

9. Security incidents and other help

• We will notify you of a Security Incident without undue delay, and at the latest within 48 hours after becoming aware of it, by email to the store owner's address.
• The notice will describe, as far as we know at the time: what happened, the categories and approximate number of people and records affected, the likely consequences, and the measures taken or proposed to deal with it and reduce its effects. Where we cannot give all of this at once, we will give it in stages without further undue delay.
• We will take reasonable steps to contain and investigate the incident and will cooperate with you so that you can meet any duty to notify a supervisory authority (such as the Israeli Privacy Protection Authority or an EU or UK authority) or the people affected.
• Taking into account the nature of the processing and the information available to us, we will also give you reasonable help with data protection impact assessments and prior consultations with supervisory authorities (GDPR Articles 32 to 36).
• Notifying you of a Security Incident is not an admission of fault or liability.

10. Deletion or return at the end

• When you remove a store, or when the Terms end, the plugin stops sending data and we delete the Store Personal Data we hold for that store within 90 days. Our systems do this automatically. You can ask us to delete it sooner by email.
• Before deletion, you can ask us by email for a copy of your store's data that we hold, in a common electronic format.
• Google access tokens are revoked and deleted straight away when you disconnect Google or remove the store.
• We may keep Store Personal Data after that period only where the law requires it, and then only for as long as required, protected under this DPA.
• Data that stays in the plugin's own tables on your server is under your control. Uninstalling the plugin removes it.

11. Information and audits

• We will make available to you all information reasonably necessary to show that we meet our obligations under this DPA and Article 28 of the GDPR, for example written answers to a security questionnaire and a description of our measures.
• We will allow for and contribute to audits, including inspections, by you or an independent auditor you appoint. You must give at least 30 days' written notice, the auditor must be bound by confidentiality, audits may take place at most once a year (unless a supervisory authority requires it or after a Security Incident), and they must not unreasonably disrupt the service. Each party bears its own costs. Our Sub-processors are large providers that do not allow customer site audits; for them we will provide their published security reports and certifications where available.
• At least once a year, on your request, we will give you a short written report on how we have met our obligations under this DPA and the Data Security Regulations.

12. Transfers to other countries

• flareOps is operated from Israel. Transfers of personal data from the EU or the European Economic Area to Israel rely on the European Commission's adequacy decision for Israel (Decision 2011/61/EU, reaffirmed on 15 January 2024). Transfers from the UK to Israel rely on the UK's adequacy regulations, which recognise Israel.
• Onward transfers to Sub-processors in the United States rely on the EU-US Data Privacy Framework (and its UK Extension) where the Sub-processor is certified, and otherwise on the Standard Contractual Clauses (and, for the UK, the International Data Transfer Addendum) in that Sub-processor's data processing terms. The sub-processors page shows the basis for each one.
• Transfers out of Israel comply with the Israeli Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001, including by written commitments from each recipient to take adequate measures to protect the data and not to transfer it onward except under the same conditions (regulation 2(4)).

13. UK

Where the UK GDPR applies, references in this DPA to the GDPR mean the UK GDPR, references to EU supervisory authorities mean the UK Information Commissioner, and references to the Standard Contractual Clauses include the UK International Data Transfer Addendum.

14. Israel

Where the PPL applies, flareOps acts as a "holder" of your database and will, in addition to the rest of this DPA:

• process Store Personal Data only for the purposes and in the systems described in Annex 1, and only for the duration of the Terms plus the deletion period in section 10;
• apply the security measures required of a holder under the Data Security Regulations and keep the data confidential;
• document every security event and notify you of any Security Incident as set out in section 9;
• return or delete the data at the end of the Terms as set out in section 10;
• report to you at least once a year, on request, on how it meets these obligations (section 11).

15. US state privacy laws

Where the CCPA or another US state privacy law applies, flareOps acts as your service provider or processor, and:

• will process Store Personal Data only for the limited and specified business purposes described in the Terms and Annex 1 (providing, measuring, securing and supporting the service);
• will not sell or share Store Personal Data, as "sell" and "share" are defined in the CCPA (including for cross-context behavioural advertising);
• will not retain, use or disclose Store Personal Data for any purpose other than those business purposes, or outside our direct business relationship with you;
• will not combine Store Personal Data with personal data we receive from other sources or from other customers, except as the law allows a service provider to do;
• will comply with the obligations that apply to us under those laws and give the data the same level of privacy protection the laws require of you;
• will notify you if we decide we can no longer meet our obligations under those laws;
• allows you to take reasonable and appropriate steps to ensure that we use Store Personal Data in line with your obligations, and, after notice to us, to stop and remediate any unauthorised use;
• will bind each Sub-processor by written contract to the same obligations, and will give you notice of new Sub-processors and a chance to object as set out in section 7.

16. Aggregated and de-identified data

We may create aggregated, de-identified statistics from the service (for example, how often AI assistants mention products after an improvement across all stores), in a form that does not identify you, your store or any individual. We use them only to measure and improve the service and to describe its results. We will keep such data de-identified, will not try to re-identify it, and will require anyone we share it with to do the same.

17. Your responsibilities

• You are responsible for having a lawful basis for the processing you instruct, for telling your visitors and customers about it in your own privacy policy (we provide suggested text in the plugin), and, where the law requires it, for obtaining consent, for example through a cookie or consent tool.
• Where you use a consent tool that supports the WordPress Consent API, the plugin's AI-visit counting script runs only after the visitor gives consent for statistics.
• You must not instruct us to process special categories of personal data or shoppers' contact or payment details. The service is not designed for them.

18. Liability

Each party's liability under or in connection with this DPA is subject to the limitation and exclusions of liability in the Terms (which limit our total liability to the greater of the fees you paid us in the 12 months before the claim or USD 1,000). This does not limit any party's liability to data subjects where the law does not allow it to be limited.

19. Duration

This DPA applies for as long as we process Store Personal Data for you, and its obligations continue until all of that data has been deleted or returned.

20. Order of precedence

If there is a conflict on a data protection matter, the following order applies: (1) any Standard Contractual Clauses that apply to a transfer; (2) this DPA; (3) the Terms. A signed agreement with flareOps (such as a pilot agreement) that refers to this DPA does not override it unless it expressly says it does. Otherwise the Terms apply to this DPA, including the governing law and courts clause, except where Data Protection Laws or the Standard Contractual Clauses require a different law or court.

21. Changes

We may update this DPA to reflect changes in the law, the service or our Sub-processors. We will update the date above and email connected store owners before a material change takes effect. Changes will not reduce the protection of Store Personal Data. If you do not agree, you may end the Terms before the change takes effect.

Annex 1: Description of the processing

Annex 2: Security measures

• Encryption in transit: all traffic uses HTTPS only.
• Signed requests: requests between the plugin and flareOps are signed (HMAC) with a secret unique to each store.
• Encryption at rest: Google OAuth refresh tokens and store secrets are encrypted with AES-GCM.
• Secrets management: application secrets are kept in Cloudflare's and Google's secret stores, not in code.
• Sessions and web security: session cookies are signed and HttpOnly; CSRF protection; a strict Content Security Policy.
• Access control: only the founder has administrative access; cloud accounts are protected with two-factor authentication; service accounts have the least privileges needed.
• Data minimisation: no shopper contact or payment data is collected; order references are pseudonymised with a per-store salt that stays on the merchant's server; the visit counting script uses no cookies and stores nothing on the device.
• Retention limits: full IP addresses are truncated after 7 days and raw bot log rows deleted after 30 days in the plugin; a removed store's data is deleted automatically after 90 days; Google tokens are revoked and deleted on disconnect.
• Incident handling: every security event is logged and assessed under a written incident procedure, and merchants are notified within 48 hours of a Security Incident.
• Sub-processors: large providers with their own security programmes, bound by data processing terms (Annex 3).

Annex 3: Sub-processors

The current list of Sub-processors, with their location, purpose, data and transfer basis, is on our sub-processors page.

Contact

Questions about this DPA, requests for information or audits, and objections to Sub-processors: hello@flareops.ai.