Data processing addendum

The agreement and roles

This Data Processing Addendum ("DPA") supplements the Terms of Service between NXTNET (GSTIN 07BUPPK0544M1Z8) ("we", "us", or "processor") and the merchant or business subscribing to Clyrix ("you", "merchant", or "controller/data fiduciary").

This addendum applies when you connect external sales channels (such as Shopify) or upload personal data of your customers or personnel into Clyrix. You are the controller / data fiduciary who decides why and how personal data is processed; we are the processor who processes it solely on your instructions to deliver the service.

Scope and purpose of processing

We process personal data solely on your documented instructions and for the purpose of providing Clyrix's commerce and business management features, including:

• syncing products, inventory levels, store locations, and orders
• displaying customer order history, fulfillment status, and returns
• generating GST tax invoices, credit notes, and GSTR-1 return filing exports
• running automated store check-ups and conversion analytics
• enabling your workspace's AI assistant to answer operational questions about your store

Purpose limitation and no data sales

We will not process personal data for any purpose other than providing the Clyrix service on your instructions.

We never sell, rent, or trade personal data. We never use your customers' information for marketing, profiling, or behavioral advertising. Data from your workspace is strictly isolated and never shared with or accessible to other merchants.

Staff confidentiality and access controls

All Clyrix personnel with access to systems handling personal data are subject to binding confidentiality commitments.

Access to production systems is governed by least-privilege principles, managed via authenticated platform roles (owner, admin, support), and audited via automated logging. Access is restricted to personnel who require it to operate, secure, and support the service.

Technical and organizational security measures

We maintain industry-standard security measures to safeguard personal data against unauthorized access, loss, or disclosure:

• Encryption in transit: all web connections and API calls use TLS (HTTPS).
• Encryption at rest: production databases (Google Cloud Firestore in asia-south2, Delhi) and backup storage are encrypted at rest using AES-256.
• Secret management: third-party integration tokens (such as Shopify offline access tokens) are encrypted with AES-GCM before storage.
• Automated backups: daily database backups are stored in asia-south2 and retained for 30 days.
• Tenant isolation: Firestore security rules enforce strict boundary controls, ensuring each workspace can access only its own data.

Sub-processors

You authorize us to engage the following sub-processors to assist in delivering the service, subject to contracts imposing data protection standards no less protective than this addendum:

• Google Cloud & Firebase (India region, asia-south2): cloud hosting, database, authentication, file storage, and encrypted backups.
• Anthropic & Google: AI language models (Claude and Gemini) for assistant features invoked by the merchant.
• Twilio & Meta: WhatsApp message delivery and one-time verification codes.
• Hostinger: transactional email notifications.
• Razorpay: payment processing for Clyrix subscription plans and wallet recharges (handles billing transactions only; does not receive Shopify customer data).

Assisting with customer requests

We provide tools and automated endpoints to help you fulfill requests from data principals (customers) under applicable privacy laws:

• Data access requests (customers/data_request): when Shopify forwards a customer data request, we aggregate all order and customer records held for that customer into a server record for you to supply to the customer within statutory timelines.
• Erasure and redaction (customers/redact): when Shopify forwards a customer redact webhook, we permanently delete the customer's personal details (name, email, phone, address) from matching orders while preserving order amounts and item lines needed for GST tax and financial records.

Security incident and breach notification

If we confirm a security incident or personal data breach affecting your data, we will notify you without undue delay (and within 24 hours of confirmation) with details of the incident, affected data, and remedial actions taken.

We comply with statutory breach notification obligations under Indian law, including reporting qualifying incidents to CERT-In within 6 hours of noticing them (to be confirmed by legal counsel) and notifying the Data Protection Board of India and affected data principals without delay, with a detailed report within 72 hours (to be confirmed by legal counsel).

For incidents involving Shopify store data or customer data, we also notify Shopify in accordance with Shopify Partner and App Store requirements.

Data return, retention, and deletion

Customer personal details on synced orders are retained for 24 months after the order date (decided 4 Nov 2026; GST invoices are kept as tax records for as long as GST law requires), after which personal identifiers are removed.

When you uninstall the Clyrix Connect application, our stored access tokens are deleted immediately.

When Shopify sends a shop redaction notice (shop/redact) 48 hours after uninstall, or when you manually disconnect the store in Clyrix, all synced orders, products, rollups, and channel collections are permanently purged from the workspace.

Upon workspace closure, your data is erased or anonymized within 90 days, except for financial and tax records required to be kept under applicable Indian law.

Audits

Upon reasonable written request and subject to reasonable confidentiality arrangements, we will make available information necessary to demonstrate compliance with this DPA, and allow for and contribute to reasonable security reviews or audits conducted by you or an agreed independent auditor, no more than once per year.

Governing law

This DPA is governed by the laws of India, including the Digital Personal Data Protection Act, 2023. The courts at New Delhi have exclusive jurisdiction over any disputes arising under or in connection with it.