1. Parties and scope
This addendum ("DPA") is between the store that uses Ostia (the "Store") and Creste LLC, a Washington, USA limited liability company ("Creste"). It forms part of the Ostia terms of service, or of any other written agreement for Ostia, including an Enterprise order (the "Agreement").
It applies when Creste processes personal data for the Store under the EU GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (CCPA), Israel's Privacy Protection Law 5741-1981 and its regulations, or similar laws ("Data Protection Law"). If this DPA and the Agreement conflict, this DPA wins on data protection.
2. Roles
The Store is the controller (in CCPA terms, the business; in Israeli terms, the database owner). Creste is the processor (service provider; database holder). The Store is responsible for having a lawful basis for the processing, for its own privacy notice, and for any consent its visitors must give, including for cookies.
3. Details of the processing
| Item | Details |
|---|---|
| Subject matter | Classifying visits to the Store's site as AI agent or person using request and browser information, applying the Store's allow or block rules, and reporting agent visits, contact attempts and orders. |
| Duration | The term of the Agreement, plus the deletion period in section 11. |
| Data subjects | Visitors to the Store's site (people and the people on whose behalf AI agents act), and the Store's customers whose orders are linked to an AI agent. |
| Data processed in memory only | IP address, full user-agent string and request headers. Not stored. |
| Data stored | Event time and kind, store ID, visitor class label, daily session key (salted one-way hash of date, IP and user agent), cloud provider name, country code, a short technical summary of the request (yes/no flags and coded values describing the browser software, and the referring host or utm_source), page-use counts and timings, browser environment yes/no flags, page type and path, contact attempts by kind, holdout group, agent operator, rule result, agent offer code. For orders linked to an agent: order ID, total, currency, operator, agent code, holdout group. |
| Not processed | Customer names, email addresses, phone numbers, postal addresses, card or payment data, page content, typed text. No special categories of data are intended. |
| Nature and purpose | Collection, classification, storage, aggregation into reports, and deletion, only to provide Ostia to the Store. |
4. Creste's obligations (GDPR Art. 28(3))
- Instructions. Creste processes personal data only on the Store's documented instructions. The Agreement, this DPA and the Store's settings in Ostia are those instructions. If Creste thinks an instruction breaks Data Protection Law, it will tell the Store. If the law requires other processing, Creste will tell the Store first unless the law forbids it.
- Confidentiality. Anyone Creste allows to process the data is bound to confidentiality.
- Security. Creste applies the measures in section 7.
- Subprocessors. Creste follows section 6.
- Data subject requests. Creste helps the Store answer requests to access, correct, delete or export data, as far as it can. If a request reaches Creste directly, Creste passes it to the Store and does not answer it itself unless the Store asks. For Shopify stores, Creste answers Shopify's
customers/data_request,customers/redactandshop/redactrequests automatically. - Other help. Creste gives reasonable help with the Store's security duties, breach notices, data protection impact assessments and prior consultations, based on the information Creste has.
- End of processing. Creste follows section 11.
- Information and audits. Creste follows section 10.
5. CCPA terms
Creste will not sell or share personal information it processes for the Store, will not keep, use or disclose it for any purpose other than providing Ostia (or as the CCPA otherwise allows a service provider), will not use it outside the direct business relationship with the Store, and will not combine it with personal information from other sources except as the CCPA allows. Creste will tell the Store if it can no longer meet these duties.
6. Subprocessors
The Store gives general authorization for Creste to use subprocessors. The current list:
| Subprocessor | Purpose | Location | Status |
|---|---|---|---|
| Cloudflare, Inc. | Workers hosting, D1 database and the Shopify app (planned), service logs, report email sending | Global network, USA | In use |
For Shopify stores, Shopify is the Store's own platform provider, not a Creste subprocessor. Payment providers (Stripe, Shopify Billing) process billing data about the Store, not data about its visitors.
Creste will give at least 30 days' notice by email before adding or replacing a subprocessor. The Store may object on reasonable data protection grounds within that time. If the parties cannot resolve it, the Store may end the affected service and get a refund of prepaid fees for the unused period. Creste imposes data protection terms on each subprocessor that are no less protective than this DPA, and stays liable for them.
7. Security measures
These are the measures in place today:
- IP addresses and full user-agent strings are used in memory and never written to storage.
- Session keys are salted, one-way hashes that change every day. The salt is held as a secret.
- All traffic to Creste's services uses HTTPS.
- Store API keys are stored only as SHA-256 hashes and compared in constant time.
- Every report and dashboard query is limited to the authenticated store. Tests check that one store cannot read another's data.
- Secrets (salts, keys) are kept in Cloudflare's secret store, not in code.
- Shopify webhooks are verified with Shopify's HMAC signature and rejected when it fails.
- The WordPress order cookie is signed with the site's own secret and is HttpOnly.
- Incoming request bodies are size-limited and fields are trimmed to fixed lengths.
- Collection is fail-open: if Ostia is slow or down, the Store's site and checkout work as normal.
- Service logs (Cloudflare Workers Logs) hold only an event name, the service name and counts or error types. Cloudflare's automatic per-request logs, which would include request headers and the client IP, are turned off. Cloudflare keeps these logs for 3 days (Workers Free) or 7 days (Workers Paid).
- Production access is limited to Creste's owner.
- Data at rest is encrypted by Cloudflare as part of its D1 service.
Creste may change these measures if the overall level of protection does not go down.
8. Personal data breaches
Creste will notify the Store without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting the Store's data. The notice will say what happened, what data and how many people are likely affected, the likely effects, and what Creste is doing about it. Creste will add details as it learns them. Notice is not an admission of fault.
9. International transfers
Creste is in the United States. Where the Store transfers personal data from the EU or EEA to Creste, the parties enter into the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated by reference. For those clauses: clause 7 (docking) applies; clause 9 option 2 (general authorization, with the notice period in section 6); the optional wording in clause 11 does not apply; clauses 17 and 18 use the law and courts of Ireland; Annex I is section 3 of this DPA; Annex II is section 7; Annex III is section 6. For UK data, the UK International Data Transfer Addendum applies as well. For Swiss data, the clauses apply with the Swiss FDPIC as the competent authority. For Israeli data, Creste gives the written commitment required by Israel's transfer regulations: it will protect the data as this DPA says and will not transfer it onward except as this DPA allows.
10. Information and audits
Creste will make available the information needed to show it meets this DPA. Audits are done first by document: on request, no more than once a year, Creste will answer a reasonable security questionnaire and share relevant policies and its subprocessors' current security reports or certifications. If that is not enough, or a regulator requires it, the Store may run an on-site or remote audit, with at least 30 days' notice, during business hours, at its own cost, under confidentiality, and in a way that does not expose other stores' data.
11. Deletion or return at the end
While the Agreement runs, an automatic job deletes the Store's visit and business events once they are 13 months (395 days) old. When the Agreement ends, the Store may ask Creste for an export of its data. Without that request, Creste deletes the Store's personal data within 30 days after the end, unless the law requires Creste to keep it. For Shopify stores, data is deleted when Shopify sends shop/redact, which happens 48 hours after uninstall. Creste may keep anonymous, aggregated totals (for example counts of agent visits and orders) that do not identify the Store, its visitors or its customers; these are not personal data. On request, Creste will confirm deletion in writing.
12. Liability and term
Each party's liability under this DPA is subject to the limits in the Agreement, except where Data Protection Law does not allow a limit. This DPA lasts as long as Creste processes personal data for the Store.
13. Contact
Creste LLC, Washington, USA. Reach us through our contact page. See also our privacy policy.