Data Processing Addendum (DPA)
This addendum governs Matajir AI's processing of personal data on behalf of the merchant (the controller) in the course of providing the service, and forms part of the platform Terms. Where a conflict arises regarding data processing, this addendum prevails.
1. Roles
The merchant is the controller of its store customers' data. Matajir AI acts as a processor of that data solely to operate the service and per the merchant's documented instructions. Matajir AI remains a controller for merchant accounts, subscriptions, security, and platform administration.
2. Scope of processing
Processing includes storing, hosting, and processing customer data (name, contact, orders, addresses) to the extent needed to provide the storefront, orders, payment, delivery, and communications.
3. Security
Matajir AI applies reasonable technical and organizational measures including encryption in transit, per-tenant data isolation, and least-privilege access control, consistent with the Protection of Privacy (Data Security) Regulations, 2017.
4. Subprocessors
The merchant agrees to Matajir AI's use of the subprocessors listed below. Matajir AI will notify the merchant of a material change to this list a reasonable time before it takes effect.
5. International transfer
Some data may be processed outside Israel by the international providers listed below, subject to appropriate safeguards. [Transfer-mechanism details are subject to legal review.]
6. Deletion after termination
On termination, the merchant may export its data within a reasonable period, after which store data is deleted per the applicable deletion schedule unless retention is legally required.
Subprocessor list
The merchant relies on the following subprocessors depending on the features it enables. Optional providers process no data unless the merchant enables the related feature.
| Provider | Activation | Purpose | Data categories | Region |
|---|---|---|---|---|
| DigitalOcean | Always | Application hosting, database, and file storage. | All stored platform data (accounts, orders, content). | EU (Frankfurt / Amsterdam) |
| Clerk | Always | Identity, sign-in, and authentication. | Email, phone number, session identifiers. | US / EU |
| CardCom | Optional (when enabled) | Credit-card payment processing and tax-invoice issuance. | Payment data entered into CardCom's hosted fields; we do not store the full card number or CVV. | Israel |
| Tranzila | Optional (when enabled) | Credit-card payment processing (alternate gateway). | Payment data entered into Tranzila's hosted fields; we do not store the full card number or CVV. | Israel |
| Brevo | Always | Sending transactional and marketing emails. | Email, name, and the order details included in the message. | EU (France) |
| EM100 (WhatsApp) | Optional (when enabled) | Sending notifications and verification codes via WhatsApp. | Phone number and message content. | Israel |
| Ameer Express | Optional (when enabled) | Delivery service and shipping-label creation. | Recipient name, phone, address, package details. | Israel |
| Meta Platforms | Optional (when enabled) | Ad-conversion measurement (Pixel + Conversions API) and catalog feed. | Browsing/purchase events; hashed identifiers (email/phone) via the server-side CAPI when enabled. | US / global |
| Optional (when enabled) | Analytics (GA4), advertising (Google Ads), and Merchant Center feed. | Browsing/purchase events and measurement identifiers. | US / global | |
| PostHog | Always | Product analytics and performance monitoring (anonymous on the storefront). | Anonymous usage events via an internal proxy. | EU |
| Sentry | Always | Error monitoring and crash diagnostics. | Technical error details (device type, path, error message). | US / EU |