Data processing terms

The merchant is the controller and BYOM LTD is the processor, under UK GDPR and the Data Protection Act 2018, and under the EU GDPR where it applies.

Data from the merchant's Shopify store that the merchant has allowed BYOM to read, which can include customer names, email addresses and order details, and the conversations and records the merchant creates in BYOM. BYOM does not request customer phone numbers or addresses from Shopify. The purpose is to provide the service the merchant has chosen to use, for as long as the merchant uses it.

BYOM processes this data only on the merchant's documented instructions, which are these terms and the merchant's use of the service. BYOM does not use it for its own purposes, does not sell it and does not use it to train models. If BYOM thinks an instruction breaks the law it will say so.

People who can reach the data are bound by confidentiality. BYOM keeps the data in separate records for each merchant, limits who can read it, records access to customer data, and protects it with encryption in transit and at rest.

The merchant gives general authorisation for the subprocessors below. BYOM uses each under that provider's data processing terms and remains responsible for them. BYOM will tell merchants of a new subprocessor before it handles merchant data, and a merchant who objects can stop using the service.

Google Cloud: hosting and database (London).

Cloudflare: network edge and file storage.

Hetzner: the AI assistant's runtime (Germany).

OpenRouter, OpenAI and xAI: AI model providers.

TypeSafe: checks on drafted content.

Nango: connections to the merchant's other tools.

Stripe: payments.

Resend: email.

WaveSpeed: image and video generation.

Sentry: error monitoring.

The current list is at byom.co/legal/subprocessors.

Some subprocessors are outside the UK. Where they are, BYOM relies on the UK International Data Transfer Addendum or an adequacy decision.

BYOM will help the merchant answer requests from the people the data is about, and will complete Shopify's customer data requests and erasure requests within 30 days. An operator at BYOM carries these out.

BYOM will tell the merchant without undue delay, and within 48 hours of becoming aware, of a breach affecting their data, with what it knows about what happened and what is being done.

BYOM deletes the merchant's data within 30 days of Shopify's shop/redact request, and on the merchant's request when they end the service. In BYOM's database, customer order evidence is kept for 90 days and deleted by the weekly deletion run that follows, so within 7 days after that; a very large backlog can take further runs. Copies held in the assistant's working cache are deleted on request. The merchant can ask for a copy of the data before it is deleted.

BYOM will give the merchant the information needed to show it is meeting these terms, and will cooperate with a reasonable audit on notice.

These terms are governed by the law of England and Wales.

BYOM LTD, hello@byom.co.