Data Processing Addendum

Roles

For public audits, Chorrus acts as a controller of the limited public data it reads. When you connect a store, Chorrus acts as a processor of your product data, acting on your instructions.

Sub-processors

We use cloud hosting (Google Cloud) and AI-surface developer APIs (e.g., OpenAI, Google) solely to run audits and scans. We do not send them your customers' personal data.

Security

Access is least-privilege; secrets are held in a managed secret store; data is encrypted in transit.

Data subject requests

We assist you in responding to data-subject requests relating to data we process on your behalf.

Deletion

On termination, we delete or return processed product data on request, subject to the retention windows in our Privacy Policy.

Contact

dpa@chorrus.com.