Prompted

Data Processing Agreement

Auftragsverarbeitungsvertrag nach Art. 28 DSGVO · Last updated 15 October 2026

1. Parties and scope

This agreement is between the merchant who uses Prompted, as controller (“you”), and Norman Dobschal, Schleibogen 27, 24857 Fahrdorf, Deutschland, as processor (“we”). It is part of the Terms of service and applies whenever Prompted processes personal data on your behalf. It takes precedence over the terms on data protection matters.

2. Subject matter, nature and purpose

If you allow Prompted to read your orders, it reads your store’s recent orders to find those whose shopper arrived from an AI assistant, and shows you the revenue and orders that came from each assistant. That is the only purpose for which Prompted processes personal data on your behalf.

3. Types of data and data subjects

Data subjects: your store’s customers who placed orders.

Data read from each recent order: order number, total and currency, date, whether it is a test or cancelled order, the sales channel app, and for the shopper’s first and last visit the source, referring website and campaign source tag.

Data stored, for AI-referred orders only: order number, total, currency, date, which assistant it was, the referring website’s host, and Shopify’s visit identifier. Nothing is stored about other orders.

Prompted does not read or store customer names, email addresses, phone numbers, postal addresses, payment details or customer accounts. Special categories of personal data (Art. 9 GDPR) are not processed.

4. Duration

This agreement lasts as long as Prompted is installed on your store. Stored order records are deleted automatically after 90 days, and cancelled orders are removed when Prompted next reads your orders.

5. Your instructions

We process the data only on your documented instructions. These are this agreement, the terms, and the settings you choose in Prompted, including granting or withdrawing order access. If we believe an instruction infringes data protection law, we tell you. We process the data for no other purpose, unless the law of the EU or a member state requires it, in which case we tell you first where that is permitted.

6. Confidentiality

Only persons who need access to operate and support Prompted have access to the data, and they are bound to confidentiality.

7. Security (Art. 32 GDPR)

• All connections are encrypted in transit (TLS); the database is encrypted at rest.
• Data is hosted in Frankfurt, Germany.
• Data minimisation: only the fields listed above are read, and only AI-referred orders are stored.
• Automatic deletion after 90 days.
• Each store’s data is separated in the database and only shown to that store, after Shopify has authenticated the request.
• Development and testing use a separate database.
• Access to production systems is limited to the operator and protected by the hosting providers’ access controls.

We may improve these measures over time, provided the level of protection does not drop.

8. Sub-processors

You authorise these sub-processors, which store or process the order data:

• Fly.io, Inc. — application hosting, in Frankfurt, Germany.
• Neon, Inc. — database hosting, on Amazon Web Services in Frankfurt, Germany.

The AI providers Prompted uses (OpenAI, Perplexity, Google) do not receive order data or any other data about your customers. We bind each sub-processor to data protection obligations equivalent to these. We tell you in advance of adding or replacing a sub-processor, and you may object; if we cannot address your objection, you may end the agreement by uninstalling Prompted.

9. Transfers outside the EU

The data is stored in the EU. Some sub-processors are companies based in the United States. Where data may be accessed from a country outside the EU or EEA, we ensure the transfer is protected under Art. 44 ff. GDPR, for example by the EU Standard Contractual Clauses or the provider’s certification under the EU–US Data Privacy Framework.

10. Supporting you

We help you respond to requests from your customers exercising their rights. When Shopify sends a customer data erasure request, Prompted deletes the records of the orders it lists automatically. For access requests, contact us at support@prompted-app.com and we provide the records we hold for the orders concerned. We also support you, as far as our processing is concerned, with security, data protection impact assessments and consultations with supervisory authorities.

11. Personal data breaches

We notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.

12. Deletion at the end

When you uninstall Prompted, Shopify sends a deletion request 48 hours later, and Prompted then permanently deletes all data it holds for your store. You can ask for deletion sooner at support@prompted-app.com. Database recovery history is kept for a short period only and expires on its own.

13. Information and audits

We make available the information needed to show that we meet these obligations, and allow for and contribute to audits, including inspections, by you or an auditor you appoint. Audits are arranged in advance, during business hours, and at your cost, with care for the confidentiality of other merchants’ data.

14. Liability and law

Liability follows Art. 82 GDPR and the Terms of service. German law applies.