Noemion — Data Processing Agreement

Version: 1.0

Last updated: 9 October 2026

1. Parties and scope

This Data Processing Agreement ("DPA") is entered into between:

NOT SO COMMON LTD, trading as The Tryon Company, a company registered in England and Wales under company number 17504170, registered office Office 21814, 182-184 High Street North, East Ham, London, E6 2JA, United Kingdom ("Noemion", the "Processor"); and
the merchant who installs and uses the Noemion application (the "Merchant", the "Controller").

It forms part of, and is incorporated by reference into, the agreement under which the Merchant uses Noemion — the Noemion Terms of Service (the "Principal Agreement"). The Merchant accepts this DPA when it accepts the Principal Agreement. Where this DPA conflicts with the Principal Agreement on the subject of personal data, this DPA prevails, save that the Principal Agreement's limitations and exclusions of liability apply to this DPA as Clause 14.1 provides.

It applies to Noemion's processing of personal data about the Merchant's customers, website visitors and others who contact the Merchant for support ("Shopper Data") carried out on the Merchant's behalf, as Annex I describes. Where the Merchant is subject to a US state privacy law, the US State Privacy Laws Addendum (Annex IIIA) applies as well.

It does not apply to personal data for which Noemion is itself the controller — the Merchant's own account details, staff accounts, sign-in records, and billing records. Those are governed by the Noemion Privacy Policy, §6.

2. Definitions

"Data Protection Law" means, to the extent it applies to the processing, the UK General Data Protection Regulation and the Data Protection Act 2018, as amended (including by the Data (Use and Access) Act 2025) ("UK GDPR"); Regulation (EU) 2016/679 ("EU GDPR"); and the Swiss Federal Act on Data Protection ("Swiss FADP"). "Controller", "processor", "personal data", "processing", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the applicable Data Protection Law, and a reference to an Article of the UK GDPR includes the corresponding Article of the EU GDPR.

"Subprocessor" means any third party engaged by Noemion to process Shopper Data.

"Service" means the Noemion application and the services described in Annex I, as the Principal Agreement defines them.

3. Roles

The Merchant is the controller of Shopper Data. Noemion is a processor acting on the Merchant's behalf.

The Merchant warrants that it has a lawful basis and has given the notices needed for the processing in Annex I — including that the chat is answered by an AI assistant and that messages are processed by the subprocessors in Annex III — and that its instructions comply with Data Protection Law.

4. Processing on documented instructions

4.1 Noemion processes Shopper Data only on the Merchant's documented instructions, including as to international transfers, unless required otherwise by law — in which case Noemion will inform the Merchant before processing, unless the law prohibits it on important grounds of public interest.

4.2 The following constitute the Merchant's documented instructions:

(a) this DPA and the Principal Agreement;

(b) the Merchant's use and configuration of the application, including the knowledge base it supplies, the response templates and support situations it configures, and the assistant's persona and instructions it writes; and

4.3 Noemion will immediately inform the Merchant if, in its opinion, an instruction infringes Data Protection Law. Noemion may suspend processing of the affected instruction until it is withdrawn, amended or confirmed.

4.4 Purpose limitation. Noemion processes Shopper Data solely to provide customer-service functionality to the Merchant, with one exception: it also uses some Shopper Data as a controller in its own right, for these purposes only — protecting the Service from abuse and attack; metering conversations to bill merchants; diagnosing faults and measuring what the Service costs to run; checking that the Service works as intended, and fixing it when it does not, from counts and outcomes, never from message content; and meeting its legal obligations, including keeping proof that a privacy request was carried out (Clause 12.1). The Privacy Policy (§3) lists the same purposes. Noemion uses Shopper Data for nothing else: it does not sell Shopper Data, does not share it for advertising, does not use it to build profiles or audiences, and does not use it, or any anonymised, aggregated or derived form of it, to train or improve machine-learning models, whether its own or a third party's.

4.5 AI subprocessors. Noemion uses an AI subprocessor only on terms under which it may not use Shopper Data to train AI models.

(a) OpenAI OpCo, LLC — production. OpenAI does not use API data to train its models. Noemion sends every request with OpenAI's response storage switched off (store: false). Noemion does not use OpenAI's zero data retention: OpenAI may keep requests and responses for up to 30 days to detect abuse.

(b) SpaceXAI LLC (xAI) — backup. Used only if Noemion switches production to it. If it does, xAI is used only under its Zero Data Retention service, and under xAI's Enterprise Terms it does not use customer content to train any model.

4.6 Merchant-directed disclosures. When the Merchant creates an API key, connects a mailbox, forwards its support address to Noemion or has its staff take an order action, it instructs Noemion to process or disclose Shopper Data accordingly. Systems the Merchant connects with an API key, and its own mailbox provider, are the Merchant's choice and not Noemion's subprocessors; Noemion is not responsible for their processing.

5. Confidentiality

Noemion ensures that every person authorised to process Shopper Data is bound by an appropriate duty of confidentiality, and that access is limited to those who need it to deliver or support the service.

6. Security

Noemion implements appropriate technical and organisational measures under Article 32 of the UK GDPR. The measures in force are set out in Annex II.

Noemion may update those measures from time to time provided the level of protection is not materially reduced.

7. Subprocessors

7.1 The Merchant gives general authorisation for Noemion to engage subprocessors, subject to this clause.

7.2 The subprocessors engaged at the date of this DPA are listed in Annex III, which is the one list of Noemion's subprocessors.

7.3 Noemion will give the Merchant at least 14 days' notice before engaging a new subprocessor or replacing one in Annex III or, where a subprocessor gives Noemion shorter notice of a change to its own subprocessors, notice as soon as Noemion receives it; in that second case the Merchant's objection period ends when the change takes effect. Noemion gives notice by updating Annex III of this DPA where it is published, at https://thetryoncompany.com/apps/noemion/dpa, and by emailing the Merchant's store contact address or telling the Merchant in the app. Where a change is urgently needed to protect Shopper Data or keep the Service available, Noemion may make it on shorter notice and will notify the Merchant as soon as practicable. Moving processing between providers already listed in Annex III, including to the backup AI provider, is not a change under this clause.

7.3A The Merchant may object in writing, stating reasonable data-protection grounds, within the notice period; if it does not, the change is deemed approved. If Noemion cannot reasonably resolve an objection, the Merchant's sole and exclusive remedy is to terminate the Principal Agreement, without penalty, by uninstalling the application, and Clause 12 applies. In that case, on the Merchant's written request made before uninstalling, Noemion cancels the Merchant's subscription with a pro rata refund of the unused part of the current billing period, and the Merchant then uninstalls. Every other cancellation follows the Principal Agreement.

7.4 Noemion imposes on each subprocessor, by written contract, data-protection obligations that are substantially the same as those in this DPA to the extent they apply to the service that subprocessor provides, and that in any case meet Article 28(3) and (4). Noemion remains fully liable to the Merchant for each subprocessor's performance of those obligations, subject to Clause 14.1.

7.5 The AI subprocessor receives the content of shopper conversations. Each time a reply is generated, the AI provider in use under Annex III receives the shopper's messages and the conversation history, the Merchant's knowledge-base and product-catalogue context, and the results of any order-status lookup the assistant made (order number, fulfilment status and dates, item names and tracking details). It also receives reply text that a member of the Merchant's staff asks it to improve, with the Merchant's writing-style guidelines for such rewrites, but not the rest of the conversation. While OpenAI is the provider, it may keep requests and responses for up to 30 days for abuse monitoring (Clause 4.5(a)). If Noemion switches to the backup provider (xAI), it is used only under zero data retention (Clause 4.5(b)).

8. International transfers

8.1 Noemion hosts Shopper Data at rest in the European Union (Frankfurt, Germany) with the hosting provider in Annex III. Subprocessors process or can access Shopper Data from outside the UK and EEA as Annex III states for each.

8.2 The Merchant instructs Noemion to transfer Shopper Data to the subprocessors in Annex III, in the locations stated there. Where a transfer is restricted under UK GDPR, EU GDPR or the Swiss FADP, Noemion relies on the mechanism Annex III states for that subprocessor: (a) the EU-U.S. Data Privacy Framework, its UK Extension or the Swiss-U.S. Data Privacy Framework, where the subprocessor is certified; otherwise (b) the EU Standard Contractual Clauses (Module 3, processor to processor) as incorporated in that subprocessor's data-processing terms, with, where those terms provide them, the UK International Data Transfer Addendum for data subject to UK GDPR and the Swiss amendments for data subject to the Swiss FADP.

8.3 Noemion will provide a copy of the transfer terms in force with any subprocessor on request, with commercial terms redacted.

8.4 Transfers of Shopper Data from the EEA or Switzerland to Noemion in the UK rely on the adequacy decisions for the UK. If those cease to apply, the EU Standard Contractual Clauses (Module 2, or Module 3 where the Merchant is itself a processor) are deemed incorporated between the Merchant as exporter and Noemion as importer, completed with Annexes I–III of this DPA, with Option 2 of Clause 9 using the notice period in Clause 7.3, Irish law, and the courts of Ireland.

9. Assistance with data subject rights

9.1 The Merchant, as controller, handles requests from its own customers.

9.2 Where a data subject sends a request to Noemion directly, Noemion will not respond substantively. It will forward the request to the Merchant without undue delay, and identify which Merchant a given conversation belongs to.

9.3 Noemion assists the Merchant, taking into account the nature of the processing, in fulfilling requests for access, rectification, erasure, restriction, portability and objection.

(a) Erasure is automated. Noemion implements Shopify's customer-redaction and shop-redaction webhooks, so an erasure request made through the Merchant's Shopify admin reaches Noemion without manual work, and Noemion completes it within 30 days of receipt.

(b) Access and portability. The Merchant can read a shopper's conversations itself in the staff workspace and through the Conversations API. When Shopify sends a customer data request, Noemion records it and, on the Merchant's request, provides the matching Shopper Data within 30 days.

(c) Assistance beyond the tools and webhooks above is provided where reasonable in scope; where a request is manifestly excessive or repetitive, Noemion may charge its reasonable costs, notified in advance.

9.4 What erasure deletes. For each conversation located under Clause 9.5, Noemion deletes the entire transcript, including internal notes written by the Merchant's staff; the handoff and email-routing records carrying the person's name and email address; and the orders linked to the conversation. It also removes the person's order numbers from the conversation's event timeline, from the record of refunds (except a refund still in progress, which keeps its order number until its record is deleted under Clause 12.1) and from the staff access log. From the staff access log, the order number is removed where the order is linked to a conversation located under Clause 9.5 or is named in a refund or order-change record Noemion still holds (an order change's record goes with its conversation at 12 months); any other record of a lookup of one of the person's orders (for example, of an order only viewed, or one changed only in a conversation already deleted at 12 months) keeps its order number until it is deleted under Clause 12.1. The conversation record itself — timestamps, counts, tags, and the record of who assigned it, resolved it or took an order action on it — is kept until Clause 12.1 deletes it; its session identifier, and that of its satisfaction ratings, is replaced, so that neither links back to the person's browser. Noemion keeps a record of the request itself (Clause 12.1). The name and email address the contact sync added to the Merchant's Shopify customers (Annex I) are the Merchant's own record in its Shopify store, and Noemion does not delete them.

9.5 A stated limitation. Noemion locates a data subject's conversations through the email address associated with them: an email channel, a handoff submission, or an order-status check in which the assistant looked up an order with that address. A conversation in which an address was typed into chat but which produced none of these is not linked to that person and will not be located by an erasure request. Such conversations are deleted by the retention schedule in Clause 12.1.

10. Personal data breach

10.1 Noemion notifies the Merchant of a personal data breach affecting Shopper Data without undue delay after becoming aware of it (including on notification by a subprocessor), and in any event within 24 hours, by email to the Merchant's store contact address. Unsuccessful attempts that do not compromise Shopper Data (blocked log-ins, port scans, denial-of-service attacks) are not breaches for this purpose.

10.2 The notification will describe, so far as known: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point. Where the information is not all available at once, it will be provided in phases without further undue delay.

10.3 Noemion assists the Merchant in meeting its own obligations under Articles 33 and 34, including the Merchant's 72-hour deadline for notifying the supervisory authority.

11. Assistance with DPIAs

Noemion provides the Merchant with reasonable assistance in carrying out data protection impact assessments and any prior consultation with a supervisory authority, taking into account the nature of the processing and the information available to Noemion. Noemion meets this by providing this DPA, Annex II and the Privacy Policy; further assistance is at the Merchant's reasonable cost, agreed in advance.

12. Retention, deletion and return

12.1 Noemion applies a fixed retention schedule, enforced automatically:

Data	Retention
Conversations and messages (including internal notes); the shopper names and email addresses, handoffs, linked orders, tags, reminders and lifecycle record attached to them	12 months from the start of the conversation (for a handoff, from its creation)
Satisfaction ratings (a rating with the conversation's random identifiers; no name, email address or message content)	For the life of the Merchant's account; deleted under Clause 12.2. The session identifier on a rating is replaced when an erasure request finds the rating's conversation (Clause 9.4)
Records of each AI call (model, amount of text, timing and cost, and the conversation's random identifier while the conversation exists; no message text)	For the life of the Merchant's account; deleted under Clause 12.2
Support-access records (identifiers only)	24 months
Shopper IP addresses (rate limiting)	At most 1 hour
Records of data-protection requests received from Shopify: the request type, the store, Shopify's customer id, a keyed hash of the email address, and the dates; no phone number and no copy of the request	6 years from receipt, as evidence that the request was handled, including after the Merchant's other data is erased
Raw notifications Shopify sends about the store, of every topic, including data-protection requests (whose contact details are removed when received)	90 days from receipt, or until the Merchant's data is erased under Clause 12.2, if sooner
Records of refunds attempted through the Service (store, order number and ID, amounts, items, status; no names or contact details)	24 months from the attempt (a refund still in progress is kept until it settles), or until the Merchant's data is erased under Clause 12.2, if sooner

12.2 Deletion. When the Service ends, Noemion deletes the Merchant's Shopper Data, apart from the exceptions below. Uninstalling the application is the Merchant's instruction to delete its Shopper Data. Shopify sends Noemion a shop-redaction request about 48 hours after an uninstall (unless the Merchant has reinstalled), and Noemion erases the Merchant's Shopper Data when it processes that request, retrying if it fails. The exceptions are the records Clause 12.1 keeps beyond that (the records of data-protection requests) and any records Noemion must keep by law. Deleted data may remain in the hosting provider's backups for up to 7 days and in its platform logs for up to 14 days, and in subprocessors' systems for the periods in their terms (Annex III). The name and email address the contact sync added to the Merchant's Shopify customers (Annex I) are the Merchant's own record in its Shopify store, and Noemion does not delete them.

12.3 Return. Before uninstalling, the Merchant may retrieve its conversation data at any time through the Conversations API. On written request made before uninstalling, Noemion will also provide, in JSON within 30 days of the request, the Shopper Data the API does not expose (internal staff notes and the conversation event timeline), provided that data has not been erased under Clause 12.2; uninstalling starts that erasure, and a pending request does not delay it. Retrieval this way is the Merchant's choice of return; data not retrieved is deleted under Clause 12.2.

13. Audit and information

13.1 Noemion makes available to the Merchant the information necessary to demonstrate compliance with Article 28: this DPA, including Annex II, and the Privacy Policy; and, on written request no more than once in any 12 months, supporting evidence for Annex II, its incident response policy and written answers to a reasonable security questionnaire.

13.2 Where the Merchant reasonably shows that information is insufficient, or a supervisory authority requires it, or following a personal data breach affecting the Merchant's Shopper Data, Noemion allows for and contributes to an audit, including inspection, by the Merchant or an independent auditor it mandates who is not a Noemion competitor and is bound by confidentiality. It requires at least 30 days' notice (less if a supervisory authority requires), is conducted remotely where practicable, during UK business hours, for at most one business day, and must not compromise other merchants' data or Noemion's security. The Merchant bears its own costs and Noemion's reasonable costs of any audit not prompted by a breach or a supervisory authority.

14. Liability and governing law

14.1 Each party's liability under or in connection with this DPA, including under Clause 7.4 for subprocessors, is subject to the limitations and exclusions in the Principal Agreement and counts towards the single aggregate cap there; nothing limits liability that cannot lawfully be limited, or a data subject's rights against either party.

14.2 This DPA is governed by the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.

14.3 If any provision is held invalid, the remainder continues in force.

14.4 Noemion may amend this DPA on at least 30 days' notice given as Clause 7.3 provides, where the change is required by law or a supervisory authority, reflects a change to the Service, or does not reduce the protection of Shopper Data; changes required by law may take effect sooner. Updates to Annex III follow Clause 7.3. The Merchant's remedy if it does not accept a change is to stop using the Service before it takes effect.

Annex I — Details of the processing

Subject matter. Provision of an AI-assisted customer-service application for the Merchant's Shopify store, including an automated assistant, a knowledge base, order-status lookups, a staff inbox, support email (sent and received, including through a mailbox the Merchant connects), AI-assisted rewriting of staff drafts, staff order actions, and a read-only Conversations API for the Merchant's own tools.

Duration. For the term of the Principal Agreement, plus the retention periods in Clause 12.

Nature and purpose. Collection, recording, storage, retrieval, transmission to subprocessors, use for generating support replies, disclosure to the Merchant's staff and, through API keys the Merchant creates, to the Merchant's own systems; sending and receiving email, including through a mailbox the Merchant connects and mail the Merchant forwards to Noemion; modification of the Merchant's own order records on the instruction of its staff (refunds, cancellations, delivery-address corrections, item edits, order notes and tags, and the Shopify invoices or notifications staff choose to send); adding the name and email address a shopper gives when asking for a person to the Merchant's Shopify customers (the "contact sync", described under contact details below); and erasure. The purpose is customer service only. No marketing, advertising, profiling or audience-building is performed. Product suggestions the assistant makes answer the shopper's own question in that conversation, from the Merchant's catalogue, and are not personalised from any history or profile outside it.

Categories of data subject.

Shoppers and website visitors who use the chat widget on the Merchant's storefront
People who email the Merchant's support address where the Merchant forwards it to Noemion, or who reply to a support email, including senders who are not customers
The Merchant's customers whose Shopify customer or order records the Merchant's staff look up, contact or modify through the staff workspace

Categories of personal data.

Category	Detail
Contact details	Name and email address, where the shopper or correspondent supplies them; and, in the staff workspace, the customer name and email address read from the Merchant's own Shopify customer and order records. The name and email address a shopper gives when asking for a person are also added to the Merchant's Shopify customers by the contact sync: a new customer is created or, for an existing customer with that email address, only an empty first or last name is filled. The customer is tagged "Noemion chat", and no marketing consent is given. The email address a shopper types only to check an order, the sender of an email forwarded to Noemion and the recipient of a staff email are not added
Communications content	The full conversation transcript, chat and email, including anything the shopper chooses to type, internal notes and tags written by the Merchant's staff, and reply text a staff member asks the assistant to improve
Order-related data	Order number; the email address on the order, used solely to verify entitlement and never displayed back to the shopper; fulfilment status and dates; item names and quantities; delivery tracking number, carrier and tracking link; and, in the staff workspace only, the customer's name and email address on the order, the delivery address and its phone number, line items with prices and discounts, order totals, the order note and tags, and the payment transactions a refund is made against — viewed and, where the shopper asks, updated by the Merchant's staff
Online identifiers	A random, pseudonymous session identifier, which the widget stores in the shopper's browser (local storage) only once the shopper first interacts with the chat, and removes on the first page load after it has gone 12 months unused (a second local-storage item holds only the time of its last use). The widget's other browser storage holds nothing that identifies the shopper. The shopper's IP address (for IPv6, only its /64 network prefix), used solely for abuse rate limiting and held in the rate-limit store for at most one hour; Noemion does not write it to its application logs or analytics. The hosting provider's network edge (Annex III) handles it, and its platform request logs may record it
Feedback	A thumbs-up / thumbs-down rating
Operational metadata	Timestamps, message counts, delivery status, the model that answered, which automated tools ran

Special category data. None is requested, required, or intentionally processed. Because the transcript is free text, a shopper may volunteer such data unprompted. Noemion does not solicit it, does not use it, and applies the same measures to it as to all conversation content.

Children's data. Noemion is not directed at children and does not knowingly process children's data.

Frequency. Continuous, for the duration of the Principal Agreement.

Annex II — Technical and organisational measures

II.1 Access control and tenant isolation

Tenant isolation is machine-enforced. Every database query passes through a repository layer and filters by store identifier; an automated check fails the build if any route reaches the database directly.
Composite foreign keys bind records, including the actor on an audit record, to their store.
Role-based access control in the staff workspace: three roles (owner, admin, agent), mapped to explicit capabilities enforced in code. Order actions and API-key management are off for agents unless the Merchant extends them. Revocation is terminal.
No passwords in the staff workspace. Staff sign in with a six-digit one-time code sent by email, stored hashed, valid for 5 minutes, limited to 3 attempts, and rate-limited. Merchant authentication is Shopify OAuth.
Least privilege on Shopify scopes. Every scope is tied to a shipped feature. Three write scopes are held: write_orders and write_order_edits, used solely for order actions the Merchant's staff take from the staff workspace, and write_customers, used solely by the contact sync (Annex I). The assistant cannot invoke any of them (II.7).

II.2 Encryption

In transit: HTTPS throughout.
Destination validation in the storefront widget: the widget transmits only to an HTTPS address on an allowlist of known hosts, and stops rather than degrades if the check fails.
At rest: storage-layer encryption on the managed database.
Application-level: Shopify access and session tokens, a connected mailbox's OAuth tokens and email-routing tokens are encrypted with AES-256-GCM at the storage boundary, under a key that can be rotated without downtime; API keys and staff sign-in codes are stored only as hashes. Shopper names, email addresses and message text rely on storage-layer encryption.

II.3 Pseudonymisation and data minimisation

Shoppers are identified by a random session identifier, not by name or email, unless they choose to supply those.
The assistant's order-status query selects only the fields required to answer the question, and one protected field — the email address on the order — used solely as a verification gate and never returned to the shopper. It does not read the shipping address or phone number. The staff order workspace also reads the delivery address and its phone number, only for a signed-in staff member who can reply to conversations, one order at a time, recorded in the access log (II.5).
The support-access log stores identifiers only — never message content, a shopper's email address or a search term.
Log redaction strips, by field name, email addresses, shopper names, access tokens, refresh tokens, passwords and authorisation headers before any log leaves the application, and drops the bound values of a failed database query and the data in a failed Shopify response from logged errors.
Product analytics events and error reports are keyed to the store, never to a shopper. They may carry a conversation's or a request's random identifier; an error report can carry a shopper's random chat-session identifier, and one about a failed staff order action can name the order number. Noemion sends no message text, names, email addresses, phone numbers or IP addresses to its analytics provider; a third party's own error text could, rarely, quote an identifier back.

II.4 Security of Noemion's own accounts

Accounts in scope: the Shopify Partner account, the hosting provider, the database, the AI providers (the OpenAI organisation not-so-common, and the xAI Console team, whose admin controls the Zero Data Retention setting), the email provider, the analytics provider, the Google Cloud project and the Microsoft Entra app registrations used for mailbox connections, the source-code repository, the domain registrar and DNS, and the store holding the application's encryption key.

Unique, high-entropy passwords, generated and stored in a password manager.
Multi-factor authentication on every account that offers it.
Production secrets are held in the hosting provider's secret store, never in the repository.
Access is reviewed when anyone joins or leaves.

II.5 Accountability and audit

A support-access log records staff reads of shopper conversations and orders — who, what, when — across the staff workspace, the compose flow and the assistant's order lookups. The application only adds rows; the log otherwise changes only when a customer's order numbers are removed on erasure (Clause 9.4), when rows pass 24 months, or on shop redaction.
Privacy requests are recorded in a separate audit log that survives shop deletion, with a completion record written on success, so that an unfinished redaction is detectable. It keeps only the request type, the store, Shopify's customer id, a keyed hash of the email address, and the dates, for six years.
Reads made with a Merchant's own API key (the Conversations API) are not written to the support-access log. The API records when each key was last used, and key creation and revocation are recorded.
The contact sync's read of an existing customer's first and last name and its write (Annex I) are not written to the support-access log either; each run is recorded in the job's own log line, with identifiers and the outcome.

II.6 Resilience, integrity and availability

Managed Postgres with automated backups.
Separate development, test and production databases; the development store is separate from any live store.
Rate limiting on shopper-facing endpoints per store, per session and per client IP address (IPv6 keyed by /64); a maintenance-mode switch that takes every serving surface offline; and bulk revocation of staff sessions, for use in an incident.
Background jobs use a durable queue with bounded retries; the compliance-webhook handler backs off and retries rather than failing silently.
The full automated test suite, including integration tests of tenant isolation, runs before every code change is committed, and again in continuous integration.

II.7 Measures specific to AI processing

Shopper messages and knowledge-base content are treated as untrusted input in every prompt and are wrapped in explicit delimiters, with forged-delimiter handling, so that shopper text cannot impersonate system instructions.
The assistant cannot take transactional actions. Its tools are read-only: policy lookup, order-status lookup, product search and product details, and situation guidance. Refunds, cancellations, address changes and other order edits exist only as controls in the staff workspace, behind staff capability checks.
The order-disclosure gate is server-side and cannot be triggered by anything a shopper types.
Prompt-injection resistance is a release gate, measured by a regression suite of scripted adversarial cases. A provider that has not passed it cannot be selected in production.
The assistant is disclosed as an AI. A fixed notice at the top of every chat — "You're chatting with an AI assistant. Ask anytime to talk to a person." — which no Merchant setting removes, and the assistant is instructed to say plainly that it is an AI when asked.
No shopper data is used to train models (Clause 4.4).
The production model identifier (gpt-6-luna) is not version-pinned by its provider; Noemion records the model reported on every reply, and can switch to the backup provider in Annex III without a code change.

II.8 Governance

Data protection contact: support@thetryoncompany.com.
A written incident response policy, available to the Merchant under Clause 13.1.

Annex III — Subprocessors

This annex is the one list of Noemion's subprocessors. Where another Noemion document lists them, this list prevails.

Subprocessor	Purpose	Data received	Where processed	Transfer mechanism
OpenAI OpCo, LLC (1455 3rd Street, San Francisco, CA 94158) — production AI provider	Generating the assistant's replies, and rewriting reply drafts that the Merchant's staff ask it to improve	As Clause 7.5. Not used to train OpenAI's models; sent with response storage switched off (`store: false`); OpenAI may keep requests and responses for up to 30 days to detect abuse	United States. OpenAI's own subprocessors are on its published list (platform.openai.com/subprocessors)	EU SCCs (Modules 2 and 3) with the UK Addendum, deemed entered into through OpenAI's Data Processing Addendum, governed by the laws of England and Wales, with the ICO as supervisory authority
SpaceXAI LLC (xAI) — backup AI provider, used only if Noemion switches production to it	The same	As Clause 7.5, only while in use, and then only under xAI's Zero Data Retention service	United States. SpaceXAI's own subprocessors are on its published list	EU SCCs (Modules 2 and 3) with the UK Addendum and Swiss terms, deemed executed through SpaceXAI's Data Processing Addendum
Plus Five Five, Inc. (Resend)	Sending support and notification email; receiving replies and mail the Merchant forwards	Shoppers' names and email addresses, and message text (a handoff notification includes the conversation transcript). Resend keeps email data for 30 days	United States. Resend's own subprocessors are on its published list	EU–U.S. Data Privacy Framework and UK Extension, where certified; otherwise the EU SCCs in Resend's DPA, with the UK Addendum where that DPA provides it
Render Services, Inc. (Render), with Cloudflare at its network edge	Hosting: the web service, the background worker, the managed Postgres database and its backups, the key-value store and platform logs. Cloudflare carries all web traffic before it reaches Render	All stored Shopper Data; shoppers' IP addresses in transit and in the rate-limit store (at most 1 hour). Backups are kept for up to 7 days and platform logs for up to 14 days	Render: Frankfurt, Germany (EU). Render is a US company, and its own subprocessors include US providers. Cloudflare: a global network	EU–U.S. Data Privacy Framework and UK Extension, where certified; otherwise the EU SCCs in Render's DPA, with the UK Addendum where that DPA provides it
PostHog, Inc. (PostHog Cloud EU)	Product analytics and error reports	Events keyed to the store. Some carry a conversation's random identifier and error reports a request's random identifier; an error report can also carry a shopper's random chat-session identifier, and one about a failed staff order action can name the order number. No message text, names, email addresses or phone numbers (Annex II.3). PostHog keeps events for one year	European Union (PostHog Cloud EU). PostHog, Inc. is a US company, and its own subprocessors are on its published list	EU–U.S. Data Privacy Framework and UK Extension, where certified; otherwise the EU SCCs

Not subprocessors:

Shopify — the Merchant's own platform and the source of its store data.
A merchant-connected mailbox (Google or Microsoft) — mail is sent through the Merchant's provider, under the Merchant's account and its own agreement with that provider. Noemion holds only the authorisation to send.
Systems the Merchant connects with an API key — the Merchant's choice (Clause 4.6).
AI providers used only for Noemion's own testing and evaluation, including Google (Gemini) — these see synthetic test cases and Noemion's own development store, never Shopper Data, and cannot be selected by the production application.

Annex IIIA — US State Privacy Laws Addendum

A.1 Application. This Addendum applies, in addition to the DPA, where Noemion processes personal information on behalf of a Merchant that is a "business" or "controller" under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, and its regulations (the "CCPA"), or under another US state comprehensive privacy law (together, "US State Privacy Laws"), and the information relates to a consumer protected by that law. In this Addendum "personal information" includes Shopper Data, and "business", "service provider", "processor", "consumer", "sell", "share" and "business purpose" have the meanings given in the applicable US State Privacy Law.

A.2 Roles. The Merchant is the business (or controller); Noemion is its service provider (or processor).

A.3 Specified business purpose. The Merchant discloses personal information to Noemion only for the limited and specified business purpose of providing, on the Merchant's behalf, the customer-service functionality described in Annex I.

A.4 What Noemion will not do. Noemion will not: (a) sell or share personal information; (b) retain, use or disclose it for any purpose other than the business purpose in A.3, including any commercial purpose other than that business purpose, except as the CCPA permits; (c) retain, use or disclose it outside the direct business relationship between Noemion and the Merchant; or (d) combine it with personal information that it receives from or on behalf of another person, or collects from its own interaction with the consumer, except as the CCPA permits.

A.5 Same level of protection. Noemion will comply with the obligations the CCPA places on a service provider and will provide the same level of privacy protection as the CCPA requires of the business.

A.6 The Merchant's rights. The Merchant may take reasonable and appropriate steps to ensure that Noemion uses the personal information consistently with the Merchant's obligations under US State Privacy Laws, using the information and audit rights in Clause 13. On notice, the Merchant may take reasonable and appropriate steps to stop and remediate any unauthorised use of personal information, including by requiring documentation that Noemion no longer retains or uses the information of a consumer who has made a valid deletion request.

A.7 Notice if unable to comply. Noemion will notify the Merchant if it determines that it can no longer meet its obligations under US State Privacy Laws.

A.8 Consumer requests. The Merchant tells Noemion of any consumer request that Noemion must act on and gives it the information it needs. Clause 9 applies to the assistance Noemion gives and to a request that reaches Noemion directly.

A.9 Subprocessors. Noemion engages subprocessors only under a written contract that binds them to the restrictions in this Addendum, and the Merchant authorises those listed in Annex III (Clause 7).

A.10 Other US state laws; conflict. Where a US State Privacy Law other than the CCPA applies, the parties intend Clauses 3 to 13 of the DPA, with this Addendum, to be the contract that law requires between a controller and a processor. If this Addendum and the rest of the DPA conflict, the provision more protective of personal information prevails.