Data Processing Agreement

Draft document, to be reviewed by a lawyer before publication.

Effective date: [EFFECTIVE DATE]

Version: 2026-11-09.2 (the version the site owner accepts in the settings)

The parties

This agreement is entered into between:

• [PUBLISHING COMPANY], [LEGAL FORM AND SHARE CAPITAL], with its registered office at [ADDRESS], registered under number [RCS/SIREN], which publishes the Loupsio service ("Loupsio" or "the processor");
• the business that uses the Loupsio service and accepts this agreement online ("the Merchant" or "the controller").

This agreement supplements the Loupsio Terms of Use and Sale ("the Terms"). If they conflict on the protection of personal data, this agreement prevails.

This English version is a translation of the French version. If they differ, the French version prevails.

Note for legal review. Decide whether the English version should be binding for merchants established outside France.

1. Purpose

The Merchant uses Loupsio to analyse how visitors behave on its online shop. To do so, Loupsio processes personal data on behalf of the Merchant.

This agreement sets out the terms of that processing, in accordance with Article 28 of Regulation (EU) 2016/679 ("GDPR") and French Law No. 78-17 of 6 January 1978 (the "French Data Protection Act").

It does not cover the data that Loupsio processes on its own behalf: the accounts of the Merchant's users and billing. For that data, Loupsio is the controller. It is described in the Loupsio Privacy Policy.

2. Definitions

The terms "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "data protection impact assessment" have the meaning given to them in the GDPR. In addition:

• Visitor: any person who visits a site on which the Merchant has installed the Loupsio script (loupsio.js), or who answers a Loupsio survey of the Merchant.
• Merchant Data: the personal data of Visitors that Loupsio processes on behalf of the Merchant. It is described in Annex 1.
• Sub-processor: a service provider engaged by Loupsio that processes Merchant Data.
• Application: the Loupsio online interface, where the Merchant configures and uses the service.

3. Term

This agreement takes effect when the Merchant accepts it online. It remains in force for as long as the Terms.

The obligations of confidentiality, security and deletion continue to apply for as long as Loupsio holds Merchant Data.

4. Description of the processing

The nature and purpose of the processing, the categories of data, the categories of data subjects and the retention periods are described in Annex 1.

5. The Merchant's instructions

5.1 Loupsio processes Merchant Data only on documented instructions from the Merchant, including with regard to transfers outside the European Union. The only exception is an obligation under EU or French law. In that case, Loupsio informs the Merchant before the processing, unless the law prohibits it.

5.2 The following are documented instructions:

• this agreement and the Terms;
• the settings the Merchant chooses in the Application or in the script: retention period, consent mode, masking, share of visits recorded, pages not to record, "Recognise returning visitors", "Identify logged-in customers" and loupsio('identify', …) calls, "Failed requests and console errors", surveys, feedback button, the "answers written by Claude", "Visit summaries by Claude" and "Comment themes by Claude" options, the Shopify app and its pixel, alerts, exports, connected tools (Google Analytics 4, Segment, Klaviyo, Jira, Linear, Trello, data warehouse), API keys, share links, team members.

5.3 If Loupsio considers that an instruction infringes the GDPR or another data protection rule, it informs the Merchant immediately. It may suspend that instruction until the Merchant confirms or changes it.

5.4 Loupsio does not use Merchant Data for its own purposes. In particular, it does not sell it, does not use it for advertising, does not combine it with other customers' data and does not use it to train artificial intelligence models.

Note for legal review. Section 5.4 sets out the most protective commitment. If Loupsio wishes to use anonymised statistics to improve the service, this must be provided for here, and the anonymisation must be genuine and irreversible.

6. Loupsio's obligations

Loupsio undertakes to:

1. process the data only for the purposes described in Annex 1;
2. ensure the confidentiality of the data: the persons authorised to process it are bound by confidentiality, by contract or by law, and only access it when necessary (support requested by the Merchant, security, maintenance);
3. implement the security measures described in Annex 2 (Article 32 GDPR) and keep them up to date;
4. comply with the conditions for engaging Sub-processors (section 8);
5. help the Merchant respond to requests from data subjects (section 9);
6. help the Merchant comply with its obligations regarding security, breach notification, data protection impact assessments and prior consultation (sections 10 and 11);
7. delete or return the data at the end of the agreement (section 12);
8. provide the Merchant with the information needed to demonstrate compliance with its obligations, and allow audits (section 13);
9. keep a record of the categories of processing activities carried out on behalf of the Merchant (Article 30(2) GDPR);
10. provide the Merchant with the contact details of its data protection officer, if one has been appointed: [DPO CONTACT DETAILS OR "not appointed"].

7. The Merchant's obligations

The Merchant, as controller:

1. determines the purposes and means of the processing, and ensures that it has a legal basis;
2. obtains the Visitors' prior consent before any recording. Loupsio takes the view that session recording (session replay) is not exempt from consent under Article 82 of the French Data Protection Act and the CNIL's recommendations on trackers. The Merchant therefore enables consent mode (data-consent="required") and connects its cookie banner to Loupsio;
3. informs Visitors clearly and fully (Articles 13 and 14 GDPR), in particular in its privacy policy and its consent management tool;
4. masks (data-loupsio-mask) or excludes (data-loupsio-block) the elements of its pages that display personal data. For example: a name or an address on a "my account" or order confirmation page. Input in form fields is masked automatically, but text displayed on the page is recorded unless it is masked;
5. does not install the script on pages likely to reveal special categories of data within the meaning of Article 9 GDPR (health, opinions, sex life, etc.), or excludes the relevant elements;
6. does not send directly identifying data (email address, name, customer number, etc.) in events, A/B test variants or survey questions. To link visits to a customer, it only uses loupsio('identify', …) or the automatic pick-up provided by the "Identify logged-in customers" setting, with an internal identifier such as a customer number, never an email address or a name. If it leaves the pick-up of the Segment user turned on, it checks that this identifier is not an email address;
7. chooses a retention period suited to its purposes;
8. responds to requests from Visitors who exercise their rights;
9. ensures that the recipients it chooses process the data lawfully: members of its team, people to whom it sends a share link, tools it connects through alerts, webhooks, exports, the API, sending of frictions (Google Analytics 4, Segment, Klaviyo), tickets (Jira, Linear, Trello) or a data warehouse. These recipients are not Sub-processors of Loupsio. In particular, the Merchant ensures that transfers outside the European Union to these recipients are covered by appropriate safeguards (section 14.5);
10. assesses whether it must carry out a data protection impact assessment (Article 35 GDPR);
11. itself erases, in the tools and data warehouse it has connected, the data sent to them when a Visitor exercises their rights: erasure in Loupsio does not reach that data.

Note for legal review. The position taken in point 2 (consent required for session recording) is the most cautious one. To be confirmed against current CNIL guidance: the conditions of the exemption for audience measurement do not appear to be met by session recording.

Note for legal review. The "Identify logged-in customers" setting is on by default. It picks up the number of the customer logged in on Shopify or the Segment user identifier, which the site chooses freely; the script discards a Segment identifier that contains "@", so as not to pick up an email address. Decide whether this setting should be off by default (data protection by default, Article 25 GDPR) or whether only the Shopify identifier should be picked up.

8. Sub-processors

8.1 The Merchant authorises Loupsio to engage the Sub-processors listed in Annex 3. This general authorisation is subject to the conditions below.

8.2 Loupsio informs the Merchant of any intended addition or replacement of a Sub-processor at least 30 days before the change, by email to the users with the owner role and in the Application. The notice states the identity of the provider, the processing entrusted to it and where the processing takes place.

8.3 The Merchant may object to the change within that period, by email to [PRIVACY EMAIL], giving its reasons relating to data protection. Loupsio then looks for a solution: dropping the change or offering an alternative. If no solution is found before the planned date, the Merchant may terminate the Terms and this agreement free of charge, with immediate effect. Loupsio then refunds the share of the current period already paid, pro rata.

8.4 Loupsio imposes on each Sub-processor, by written contract, the same data protection obligations as those in this agreement, including sufficient security guarantees. Loupsio remains fully liable to the Merchant for the performance of those obligations by its Sub-processors.

8.5 Anthropic PBC is only involved for the Claude options that the Merchant enables for a site, each separately: "answers written by Claude" in the assistant, "Visit summaries by Claude" and "Comment themes by Claude". All of them are disabled by default. Enabling an option is an instruction for that site and for the data that this option sends (Annex 1, section 6). The Merchant can disable it at any time; the sending then stops.

8.6 The tools that the Merchant connects to Loupsio itself, with its own credentials (Google Analytics 4, Segment, Klaviyo, Jira, Linear, Trello, S3-compatible storage, BigQuery, Snowflake), are not Sub-processors of Loupsio (section 7, point 9). On the Merchant's instruction, Loupsio sends them the data described in Annex 1, section 10, for as long as the tool remains connected.

Note for legal review. The "Visit summaries by Claude" and "Comment themes by Claude" options entrust Anthropic, a Sub-processor already authorised, with new processing that concerns data which is not aggregated (the timeline of a visit, free-text comments). Check whether the notice provided for in section 8.2, 30 days before the change, applies to this extension, in addition to merchants accepting the agreement again.

9. Data subjects' rights

9.1 If Loupsio receives a request directly from a Visitor (access, rectification, erasure, restriction, objection, portability, withdrawal of consent), it forwards it to the Merchant without delay and within 3 working days at the latest. It does not answer the request on the merits itself, unless the Merchant instructs it to. It may tell the Visitor that the request has been forwarded to the Merchant.

9.2 The Application allows the Merchant to delete a session, a Visitor's data or an entire site. To find a Visitor's visits, it can in particular search by customer identifier, if the visits are linked to a customer (section 9.3). Deleting a visit also erases its recording, the survey answers, feedback and orders linked to it, the summary written by Claude and the site's comment themes. On request, Loupsio also helps the Merchant find, extract or delete a Visitor's data, to the extent the information provided allows.

9.3 By default, the script does not give Visitors a persistent identifier: the session identifier is cleared when the tab is closed. Two settings change this. "Identify logged-in customers" links the visits of a logged-in customer to their customer identifier (Annex 1, section 4); the Merchant can also send this identifier with loupsio('identify', …). "Recognise returning visitors" keeps a random identifier in the Visitor's browser for 13 months at most (Annex 1, section 5); the Application does not allow searching for visits by this identifier. Without a customer identifier, finding a Visitor's data therefore often requires details such as the date, time, pages visited, device used or the text of a survey answer or feedback.

9.4 This assistance is included in the price of the service.

9.5 For a Shopify shop connected through the Loupsio app, Loupsio processes the compliance messages that Shopify sends, after checking their signature:

• request to erase a customer's data (customers/redact): Loupsio erases the visits linked to that customer by the identifier shopify-<customer number>, with the data described in section 9.2;
• a customer's access request (customers/data_request): Loupsio sends the users with the owner role an email stating the number of visits linked to that customer and a link to find them. The Merchant answers the customer;
• request to erase the shop's data, after the app is uninstalled (shop/redact): Loupsio deletes the link between the shop and the site. The site and its data remain in the Merchant's account, and the Merchant can delete them (section 12.2).

9.6 Erasure in Loupsio does not reach data already sent to the tools that the Merchant has connected (Annex 1, section 10). The Merchant erases it in those tools (section 7, point 11).

Note for legal review. Article 11 GDPR (processing which does not require identification) may apply when the Merchant cannot link a session to a person. It hardly applies to visits linked to a customer or visitor identifier. The wording nevertheless provides for active help with the search, which is more protective for Visitors.

Note for legal review. Section 9.5 describes the current behaviour: on receiving shop/redact, Loupsio only deletes the link with the shop, not the Loupsio site or its data. Check what Shopify requires for this message (in principle, erasure of the shop's data) and decide with the technical team whether the linked site or its data should then be deleted; adapt the section accordingly.

10. Personal data breaches

10.1 Loupsio notifies the Merchant of any personal data breach affecting Merchant Data within 48 hours at the latest after becoming aware of it. The notice is sent by email to the users with the owner role and shown in the Application.

10.2 The notice includes, where possible:

• the nature of the breach;
• the categories and approximate number of data subjects and records concerned;
• the name and contact details of a contact person at Loupsio;
• the likely consequences;
• the measures taken or proposed to address the breach and mitigate its effects.

If not all the information is available at once, Loupsio provides it in stages, without waiting.

10.3 Loupsio takes the necessary measures without delay to contain the breach and limit its consequences. It documents each breach: facts, effects, measures taken.

10.4 The Merchant, as controller, notifies the breach to the CNIL (the French data protection authority) and, where necessary, to the data subjects. Loupsio helps it do so and provides the information it has.

Note for legal review. The 48-hour deadline leaves the Merchant time to notify the CNIL within the 72 hours required by Article 33 GDPR. A 24-hour deadline would be more protective, but must be achievable for the team. Also decide whether Loupsio may notify the CNIL on the Merchant's behalf, on written request.

11. Data protection impact assessments and prior consultation

On request, Loupsio provides the Merchant with the information needed to carry out a data protection impact assessment and, where necessary, to consult the CNIL: description of the processing, security measures, Sub-processors, places of processing.

Note for legal review. Session recording may meet several criteria that make an impact assessment mandatory (systematic monitoring of behaviour, large scale, innovative technology). It would be prudent to recommend that merchants carry one out, and to consider Loupsio providing a pre-filled template.

12. End of the agreement: what happens to the data

12.1 Before the agreement ends, the Merchant can retrieve its data using the exports available in the Application. It can also ask Loupsio, in writing, to return the data in a commonly used, machine-readable format.

12.2 The Merchant can delete its sites or its account itself at any time from the Application.

12.3 No later than 30 days after the end of the agreement, Loupsio deletes all Merchant Data from its database and storage, including recordings.

12.4 Copies held in backups are deleted no later than 30 days after they were made. They are only used to restore the service after an incident. If a backup has to be restored, Loupsio deletes again any data that had been erased since the backup was made.

12.5 On request, Loupsio confirms the deletion in writing.

12.6 Loupsio keeps no copy, unless EU or French law requires it. In that case, it informs the Merchant.

13. Documentation and audits

13.1 Loupsio makes available to the Merchant the information needed to demonstrate compliance with this agreement: this agreement and its annexes, the description of the security measures, the list of Sub-processors and its answers to the Merchant's reasonable questionnaires.

13.2 The Merchant may have an audit carried out, including an inspection, by itself or by an independent auditor it appoints. The auditor is bound by confidentiality and is not a competitor of Loupsio. The Merchant notifies Loupsio at least 30 days in advance and states the scope of the audit. The audit must not disrupt the service or compromise the security or confidentiality of other customers' data.

13.3 The Merchant may have no more than one audit carried out per year, except in the event of a data breach, a serious breach of this agreement or a request from a supervisory authority.

13.4 Each party bears its own costs. If the audit reveals a material breach by Loupsio, Loupsio bears the reasonable cost of the audit and remedies the breach without delay.

13.5 These limits do not apply to inspections by the CNIL or another competent authority.

14. Transfers outside the European Union

14.1 Merchant Data is hosted in the European Union, at Scaleway SAS: the server and its database in the Netherlands (Amsterdam region), object storage (recordings, database backups) and email sending in France (Paris region).

14.2 Loupsio does not transfer Merchant Data outside the European Economic Area without the Merchant's instruction. The only planned cases are the Claude options, if the Merchant enables them (see Annex 1, section 6, and Annex 3). The data is then sent to Anthropic PBC, in the United States: the question asked and totals calculated from sessions for "answers written by Claude"; the timeline of a visit for "Visit summaries by Claude"; the text of comments left in surveys or the feedback button for "Comment themes by Claude". None of these options sends a session recording or input typed into the shop's form fields.

14.3 Any transfer provided for in section 14.2 is covered by a mechanism provided for in Chapter V GDPR: the European Commission's adequacy decision on the EU–US Data Privacy Framework if the recipient is certified under it, or failing that the standard contractual clauses adopted by the European Commission, supplemented by additional measures where necessary.

Note for legal review. Check, at the date of publication: Anthropic PBC's certification under the Data Privacy Framework, the data processing agreement offered by Anthropic and its standard contractual clauses, its commitments not to reuse the data it receives, how long Anthropic keeps it, and the status of legal challenges to the Data Privacy Framework. The totals sent by the assistant may include page paths, button labels or error messages: as a precaution, the wording treats them as personal data. Visit summaries and comment themes concern data that is not aggregated, including free text written by Visitors.

14.4 If Loupsio receives a request from a public authority for access to Merchant Data, it informs the Merchant without delay, unless the law prohibits it. It challenges requests it considers unlawful and discloses only the minimum required.

14.5 The tools that the Merchant connects itself (Annex 1, section 10) may process the data outside the European Economic Area, depending on the tool and the Merchant's choices: region of the Segment workspace, location of the Klaviyo, Jira, Linear or Trello account, region of the data warehouse. Loupsio sends the data to them on the Merchant's instruction. The Merchant checks that these transfers are covered by a mechanism provided for in Chapter V GDPR. For Google Analytics 4, Loupsio sends the data to Google's European collection endpoint (region1.google-analytics.com); this does not determine where Google processes it afterwards.

Note for legal review. Characterise the sending of data to the tools connected by the Merchant: Loupsio does it on the Merchant's behalf, but it is the technical sender. Decide who puts the Chapter V safeguards in place (for example for a Segment workspace in the US region, or for Klaviyo) and whether Loupsio must check anything before turning the sending on. Tickets created in Jira, Linear or Trello contain a share link that gives anyone who can read the ticket access, for 30 days, to the friction and to an example replay.

15. Liability

Each party is liable to data subjects under the conditions of Article 82 GDPR. Between the parties, the limitations of liability in the Terms apply, to the extent permitted by law. They do not limit the rights of data subjects in any way.

Note for legal review. Check how this fits with the liability clause in the Terms (cap, exclusions), in particular for a data breach attributable to Loupsio. A specific, higher cap for data protection breaches is common.

16. Cooperation with authorities

Loupsio cooperates with the CNIL and other competent supervisory authorities. It informs the Merchant without delay of any request from a supervisory authority concerning Merchant Data.

17. Governing law and disputes

This agreement is governed by French law. Disputes are settled in the manner set out in the Terms, before the competent courts of [COURT CITY].

18. Contacts

• Loupsio: [PRIVACY EMAIL].
• Merchant: the users with the owner role, at the email address of their account. The Merchant keeps these addresses up to date.

Annex 1: Description of the processing

1. Nature of the processing

Collection by the loupsio.js script installed on the Merchant's site and, for Shopify shops, by the Loupsio pixel; encrypted transmission, storage, automated analysis (friction detection, form analysis, statistics and estimates of lost sales), viewing by the Merchant's users, including while the visit is happening; texts written by Claude if the Merchant enables the corresponding options; transmission to recipients chosen by the Merchant; deletion.

2. Purposes

Helping the Merchant understand how Visitors use its shop and improve it:

• watching session replays, including while they are happening ("Live" view);
• producing click and scroll heatmaps;
• detecting friction: repeated clicks, dead clicks, JavaScript errors, quick returns to the previous page, frantic scrolling, input errors, slow pages;
• showing, next to the replay, failed or slow requests and console errors;
• analysing how forms are used: time spent per field, fields filled in again, refused fields, abandonment;
• measuring funnels, journeys, page speed and A/B test results;
• measuring how many Visitors come back (Retention screen);
• estimating what a friction costs in sales, from order amounts;
• finding and erasing a customer's visits;
• showing surveys and a feedback button, and analysing the answers;
• sending the Merchant a weekly report and alerts;
• answering the Merchant's questions with the assistant, summarising a visit and grouping comments by theme;
• sending data to the tools that the Merchant connects (section 10).

The processing is not used for advertising, for tracking Visitors across sites, or for automated individual decisions producing legal effects. It is not intended to identify Visitors: it only links a visit to a customer through the identifier that the Merchant's site provides (section 4), and only links the visits of the same Visitor if the Merchant turns on the recognition of returning visitors (section 5).

3. Data subjects

• Visitors to the sites on which the Merchant has installed the script, including customers logged in to their account on those sites.
• People who answer a survey of the Merchant, on its site or through a link.
• Any person whose data is displayed on the recorded pages, if the Merchant does not mask it.

4. Categories of data

Data that is not collected or not kept:

• Form input: everything the Visitor types into the page's form fields (email addresses, passwords, cards, addresses, etc.) is masked in their browser before anything is sent. Only the answers they choose to send through a survey or the feedback button are transmitted.
• IP address: used transiently to rate-limit requests. It is not stored in the database.
• URL parameters: removed by the script and by the server.
• Content of requests: neither the content nor the headers of the page's requests and responses are collected.
• Excluded pages and visits not picked: nothing is recorded on the pages that the Merchant chooses not to record, or during visits that are not part of the share of visits recorded. Surveys and the feedback button still work on those pages and during those visits.

Special categories of data: the service is not designed to process special categories of data within the meaning of Article 9 GDPR. The Merchant excludes the relevant pages or elements (section 7, point 5).

Note for legal review. The "Failed requests and console errors" setting is on by default. Filtering removes email addresses and long numbers, but a request address or a console message may contain other personal data (a name in an address, a token, the text of an error). Decide whether having it on by default is compatible with data protection by default (Article 25 GDPR) or whether it should be off by default. The order identifier lets the Merchant link a visit to an order, and so to a customer, in its Shopify admin.

5. Storage in the Visitor's browser

No cookie is set on the shop. The script uses:

If the Merchant connects Google Analytics 4, Segment or Klaviyo (section 10), the script reads during recording, for those tools only and without changing it, the identifier they have already given the Visitor: Google Analytics's _ga cookie; Segment's anonymous identifier, read through Segment's interface in the page or in ajs_anonymous_id; Klaviyo's __kla_id cookie. For the automatic identification of customers, it reads in the page the number of the logged-in customer that Shopify makes available, or the Segment user identifier.

In consent mode (data-consent="required"), the script records nothing, sends no data about the visit, shows no survey or feedback button and writes nothing in the Visitor's browser until loupsio('consent', true) is called. It only reads the site settings from the Loupsio server, without keeping them. A customer identifier passed with loupsio('identify', …) before consent stays in memory and is only written to loupsio:user after consent. Calling loupsio('consent', false) stops the recording.

6. Claude options (Anthropic PBC)

Each option is disabled by default and enabled separately, for a site, by a user with the owner role, in the privacy settings. Data is only sent to Anthropic PBC, in the United States, when one of the Merchant's users asks for it in the Application.

"Answers written by Claude" (assistant). Loupsio sends the question asked by the Merchant's user and totals calculated from sessions: site name, session counts, breakdown by device type, rates, page paths, button or field labels and error messages related to friction, traffic sources, breakdown of answers to closed survey questions, average rating from the feedback button. Never sent: session recordings, form input, free-text comments, session, customer or visitor identifiers.

"Visit summaries by Claude". When a user asks for it on a replay, Loupsio sends the timeline of that visit: device type, traffic source, number of pages, duration, amount ordered or goal reached; paths of the pages visited; friction titles, with the label of the clicked element or refused field and the message of JavaScript errors; names of forms and of the last field used, number of input errors; event names; the fact that a survey was answered or feedback left; the time of each step. Never sent: the recording, form input, the content of survey answers and feedback, session, customer or visitor identifiers.

"Comment themes by Claude". When a user asks for it, Loupsio sends the text of the free-text comments left in one survey or in the feedback button over the chosen period: the 300 most recent at most, each cut to 400 characters. Each comment comes with an internal number, without the session, page, date or any identifier. These texts may contain whatever Visitors chose to write, including personal data.

Texts produced. The assistant's answers are not kept. Visit summaries and themes are kept in the Loupsio database so they can be shown again. A summary is deleted with its visit and, at the latest, at the end of the site's retention period. Themes are deleted at the end of the retention period, and whenever a visit is erased in the Application or at Shopify's request (section 9); they can then be computed again on request. A comment erased in the meantime is no longer shown with its theme.

7. Retention period

• Set per site by the Merchant, from 30 days to 2 years (90 days by default).
• A session is deleted when its last activity is older than this period. The same period applies, from their creation, to survey answers, feedback, orders and texts written by Claude.
• Automatic purge every night, including recordings.
• Deletion possible at any time from the Application: a session, a Visitor's data, a site, an account.
• The visitor identifier kept in the browser expires after 13 months (section 5).
• Data sent to the tools connected by the Merchant follows the rules of those tools (section 10).
• Database backups kept for 30 days at most, then deleted.

8. Place of processing

European Union: server in the Netherlands (Amsterdam region), storage and backups in France (Paris region), at Scaleway SAS. Exceptions: the options described in section 6, if the Merchant enables them (United States); the tools connected by the Merchant (section 10), whose location depends on the tool and on the Merchant's choices.

9. Duration of the processing

The term of the agreement, then the time needed for the deletion provided for in section 12.

10. Recipients chosen by the Merchant

These recipients are not Sub-processors of Loupsio (section 8.6). The Merchant connects them itself in the Application, with its own credentials, which Loupsio checks with the tool and then keeps encrypted. Sending stops as soon as the Merchant disconnects the tool.

In the labels and messages sent to Google Analytics 4, Segment and Klaviyo, email addresses and long numbers are removed. Data already sent remains in these tools under their own rules: purges and erasure in Loupsio do not reach it.

Note for legal review. Klaviyo and Segment are often used for marketing: the Merchant may use the frictions it receives, for example to follow up with a customer by email. Check that the sentence in section 2 on advertising and the purpose announced to Visitors ("Session analysis") remain accurate, and whether separate consent is needed for this sending and for reading the _ga and __kla_id cookies.

Annex 2: Security measures

Data minimisation, starting in the Visitor's browser

• Everything the Visitor types into form fields is masked in the browser before anything is sent. Automated tests check this masking.
• Masking (data-loupsio-mask) and exclusion (data-loupsio-block) tools available to the Merchant, and a “Mask all text on the pages” setting that replaces, in the browser, every displayed text, the page title and readable attributes (alt, title, aria-label, placeholder) with asterisks before anything is sent.
• URL parameters removed by the script and by the server.
• Share of visits recorded (from 1 to 100%) and pages not to record, set by the Merchant: nothing is recorded on those pages or during visits that are not picked.
• Form analysis without the values typed: only the field names, entering and leaving fields, refusals and sending are collected.
• Requests and console: neither content nor headers, addresses without parameters, email addresses and long numbers replaced in the browser, 50 of each per page at most; a setting the Merchant can turn off.
• No cookie set on the shop; session identifier limited to the tab; 13-month visitor identifier only if the Merchant turns it on.
• Identifiers of other tools read only for the tools the Merchant has connected; a visit that a tool cannot link to anyone is not sent to it; email addresses and long numbers removed from the labels sent to Google Analytics 4, Segment and Klaviyo.
• Claude options disabled by default; data sent limited to what is described in Annex 1, section 6.
• IP address not stored in the database.
• Consent mode: no recording before the Visitor agrees.

Transmission and access

• HTTPS encryption of all exchanges.
• Users' passwords hashed with scrypt.
• Tokens (sessions, invitations, share links, API keys) stored as hashes, never in plain text.
• HttpOnly session cookie.
• Cross-site request protection: the origin of every change is checked.
• Request rate limits.
• Data separated by site and role-based access control (owner, member).
• Friction share links that expire after 30 days.
• Credentials of the tools connected by the Merchant (tokens, keys) checked with the tool, encrypted with AES-256-GCM before storage and never shown again; access token of Shopify shops encrypted and deleted when the app is uninstalled.
• Signature (HMAC-SHA256) checked on messages received from Shopify.

Availability and deletion

• Daily database backups, kept for 30 days at most.
• Automatic nightly purge according to the chosen retention period.
• Hosting in the European Union, at Scaleway SAS: server in the Netherlands (Amsterdam region), storage and backups in France (Paris region).
• Each component of the service (application, visit collection, recording storage, scheduled jobs) checked every minute; results and incidents published on a public status page (/status), which contains no personal data.

Organisation

• Access to data limited to people who need it, bound by confidentiality.
• Personal data breach procedure (section 10).
• [TO BE COMPLETED: internal measures actually in place, for example two-factor authentication on the hosting provider's admin accounts, access management, logging of admin actions, periodic review of measures.]

Note for legal review. Do not mention encryption at rest or any certification (ISO 27001, SOC 2, etc.) until they are in place and documented. Have the technical team complete the "Organisation" part with real measures only.

Annex 3: Sub-processors

For information: providers that do not process Visitor data

For information: recipients chosen by the Merchant

These tools are connected by the Merchant with its own credentials and receive the data on its instruction. They are not Sub-processors of Loupsio (section 8.6).