Arc Data Processing Agreement (DPA)

Effective date: June 18, 2026. Last updated: October 14, 2026.

This Data Processing Agreement ("DPA") forms part of the Arc Merchant Terms of Service (the "Agreement") between:

• Controller: the Shopify merchant that installs and uses Arc (the "Merchant", "you"); and
• Processor: Kinori Labs Inc. ("Kinori Labs", "Arc", "we"). Contact: legal@arcsubscriptions.com. No postal address is published.

It reflects Article 28 of the GDPR and, where they apply, the UK GDPR and the Swiss FADP. Terms not defined here have their GDPR meaning.

Roles. For Customer Personal Data, the Merchant is the controller and Arc is the processor, acting only on the Merchant's documented instructions. Shopify acts as an independent controller for the payment processing it performs, under its own terms. If this DPA and the Agreement conflict on personal data, this DPA controls.

1. Subject matter, duration, nature and purpose

• Subject matter: processing Customer Personal Data to provide the Arc subscriptions service.
• Duration: from installation until uninstall or termination, plus the deletion period in Section 9.
• Nature: collection, storage, retrieval, use, transmission to sub-processors and erasure, including automated and AI-assisted operations.
• Purpose: running subscriptions and billing through Shopify, recovering failed payments, and AI-assisted retention, solely to provide the service to the Merchant.

The Agreement, this DPA and the Merchant's configuration of Arc are the Merchant's complete documented instructions. Arc does not process Customer Personal Data for its own purposes and does not sell it.

2. Data subjects and categories of data

• Data subjects: the Merchant's customers and subscribers and, incidentally, the Merchant's staff who use the embedded admin.
• Personal data: name, email, phone number, shipping and billing address, order and subscription details, cancellation reasons and feedback, churn-risk scores, save-offer outcomes, sign-in tokens (stored only as hashes) and Shopify access tokens (encrypted).
• Payment data: Arc holds only payment references issued by Shopify. It never receives or stores card numbers or full payment credentials.
• Special categories: Arc is not designed for special-category or criminal-offence data, and the Merchant must not use it for such data. A subscriber may still choose to type such data into free-text feedback; it receives the same protection.

3. Arc's obligations

Arc will:

1. process Customer Personal Data only on the Merchant's documented instructions, including for international transfers, unless the law requires otherwise (in which case Arc will tell the Merchant first unless the law forbids it);
2. ensure everyone authorised to process the data is bound by confidentiality;
3. maintain the security measures in Annex II;
4. engage sub-processors only as set out in Section 4;
5. help the Merchant respond to data-subject requests (Section 5);
6. help the Merchant meet its obligations on security, breach notification, impact assessments and prior consultation, given the nature of the processing and the information available to Arc;
7. delete or return the data at the end of the service (Section 9);
8. make available the information needed to show compliance with Article 28 and allow audits (Section 6); and
9. tell the Merchant immediately if it believes an instruction breaks data-protection law.

4. Sub-processors

The Merchant gives general written authorisation for Arc to use sub-processors. The current list is in Annex III. Arc binds each sub-processor to data-protection terms at least as protective as this DPA and remains liable for them.

Arc will give at least 30 days' notice by email before adding or replacing a sub-processor. The Merchant may object in writing on reasonable data-protection grounds. If the objection cannot be resolved, the Merchant may end the affected part of the service.

5. Data-subject requests

Arc supports Shopify's mandatory privacy webhooks. Each is verified, scoped to the requesting store and safe to repeat:

• customers/data_request: Arc prepares an export of the data it holds on that customer for the Merchant.
• customers/redact: Arc deletes that customer's personal data.
• shop/redact: sent by Shopify about 48 hours after uninstall; Arc deletes all of the store's data.

If a data subject contacts Arc directly about the Merchant's data, Arc will tell the Merchant and will respond only on the Merchant's instruction or where the law requires.

6. Audits

Arc will provide the information reasonably needed to show compliance with this DPA. Once every 12 months (or more often if a regulator requires it or after a confirmed breach), on written request and at least 30 days' notice, Arc will answer a reasonable security questionnaire and, where needed, allow an audit by the Merchant or an independent auditor bound by confidentiality, at the Merchant's cost. Arc does not hold any third-party certification or audit report.

7. Personal-data breaches

Arc will notify the Merchant without undue delay, and within 72 hours, of becoming aware of a personal-data breach affecting Customer Personal Data. The notice will describe, as far as then known, what happened, the data and people affected, the likely consequences, and the steps taken, with a contact point. Arc will cooperate with the Merchant, who is responsible for notifying authorities and data subjects. Notification is not an admission of fault.

8. International transfers

Customer Personal Data may be processed outside the Merchant's country. Where EEA, UK or Swiss data is transferred to a country without an adequacy decision, the parties use the EU Standard Contractual Clauses (Decision (EU) 2021/914), Module Two between the Merchant and Arc and Module Three for sub-processors, with the UK Addendum and Swiss amendments where they apply. The SCCs are incorporated by reference and completed by Annexes I to III, with the docking clause enabled and Ontario law chosen. If the SCCs and this DPA conflict, the SCCs prevail.

9. Deletion and return

At the end of the service, Arc will delete or return Customer Personal Data at the Merchant's choice, unless the law requires it to be kept. On uninstall, Arc deletes the store's access tokens straight away and all of its data when Shopify sends the store-deletion request. Backups rotate out within 90 days. Any data kept because the law requires it stays protected by this DPA until it is deleted. Arc will confirm deletion in writing on request.

10. General

• Liability: subject to the limits in the Agreement, except where data-protection law does not allow them. Nothing here limits data subjects' rights or the SCCs.
• Changes: Arc may update this DPA for changes in law, sub-processors or the service, with notice as described in the Agreement, without reducing the protections required by law.
• Governing law: Ontario, Canada, except where data-protection law or the SCCs require otherwise.
• Contacts: privacy@arcsubscriptions.com, security@arcsubscriptions.com and legal@arcsubscriptions.com. No Data Protection Officer is appointed, as the GDPR does not require one for Kinori Labs. No EU or UK representative is appointed yet; Kinori Labs will appoint one before processing data for merchants established there.

Annex I. Description of processing

• Data exporter (controller): the Merchant, contactable through its Shopify store contact.
• Data importer (processor): Kinori Labs Inc., legal@arcsubscriptions.com.
• Data subjects, data categories and special categories: Section 2.
• Frequency: continuous for the term.
• Nature and purpose: Section 1.
• Retention: Section 9.
• Competent supervisory authority: the authority competent for the Merchant. Kinori Labs has no EU or UK establishment.

Annex II. Security measures

• Encryption: TLS for all connections; access tokens, credentials and secrets are individually encrypted before they are stored.
• Tenant isolation: every query is limited to one merchant's data.
• Authentication: Shopify session tokens for the merchant admin; single-use, short-lived, hashed sign-in links for the customer portal.
• Request integrity: Shopify webhooks and storefront requests are signature-checked before anything happens.
• Access control: least-privilege access for Kinori Labs personnel, who are bound by confidentiality; minimal Shopify access scopes.
• Data minimisation: personal details are kept out of logs, and removed from typed text before it is sent for AI processing.
• Resilience: billing is idempotent so retries cannot double-charge, and billing does not depend on AI features. Backups are kept and rotate out within 90 days.

Annex III. Sub-processors

Arc runs on servers operated by Kinori Labs.

Arc is an independent application and is not affiliated with, endorsed by, or sponsored by Shopify Inc.