MirutoLegal
Data Processing Agreement
This Data Processing Agreement (“DPA”) is part of the Terms of Service between the Merchant (controller) and random forest OÜ (processor, “Miruto”). It applies to all personal data that Miruto processes for the Merchant and meets the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”). It takes effect when the Merchant connects a store to the Miruto console, without a separate signature.
1. Roles
The Merchant is the controller of its shoppers’ personal data. Miruto is the processor and processes the data only on the Merchant’s documented instructions. The Terms, this DPA and the Merchant’s settings in the plugin and console (for example which flows and channels are switched on, the Playbook and the discount limits) are the Merchant’s instructions. Miruto tells the Merchant if it thinks an instruction breaks data protection law.
2. Details of the processing
| Subject matter | Recording and analysing cart and checkout sessions, contacting shoppers who did not finish an order, answering their questions, and preparing fixes for website errors. |
|---|---|
| Duration | While the store is connected to Miruto, plus the deletion period in section 10. |
| Nature | Collection, storage, analysis, generation of messages with AI, sending and receiving messages, deletion. |
| Data subjects | Shoppers and customers of the Merchant’s store; the Merchant’s staff who use Miruto. |
| Personal data | First and last name, email address, phone number, country and city; cart contents and value; the checkout step and field where the shopper stopped and errors they saw; payment and shipping method chosen; language, device type, operating system and browser; traffic source (UTM values, referrer, landing page); order status; consent or legal basis for messages; content of messages exchanged with the shopper; staff names and email addresses. |
| Special categories | None intended. The Merchant must not configure Miruto to collect special categories of data. |
| Where the data is | Session data stays in the Merchant’s WordPress database. Data needed for the agent is sent to the Miruto console on Cloudflare. AI text generation is done by the sub-processor listed for AI. |
3. Confidentiality
Everyone at Miruto who can access personal data is bound by confidentiality and only accesses it when needed to provide the service or support the Merchant.
4. Security measures
Miruto implements at least these technical and organisational measures (Annex II):
- Encryption in transit (HTTPS/TLS) for all traffic between the store, the console, channels and sub-processors; encryption at rest by the hosting provider.
- HMAC-SHA256 signatures with a store-specific secret on every request between the store and the console; replay protection with timestamps.
- Isolation: each conversation is stored in its own Durable Object; the agent’s prompt is built only from the data of the store it works for and is checked by guard rules so other stores’ data cannot appear.
- Phone numbers that opted out are stored as one-way hashes on a suppression list.
- Access control: the superadmin area is behind Cloudflare Access with one-time codes; merchants only see their own stores; WordPress capabilities protect the plugin.
- Data minimisation: the AI fixer receives code excerpts and technical details only, never shopper data; robots and link previews are filtered out of reports.
- Logging of errors and sign-in requests, and rate limits on sign-in links and AI requests.
5. Sub-processors
The Merchant gives general authorisation for Miruto to use the sub-processors on the Sub-processors page. Miruto informs the Merchant at least 30 days before adding or replacing a sub-processor, by email or in the console. The Merchant may object on reasonable data protection grounds; if no solution is found, the Merchant may stop using the affected feature or end the service. Miruto imposes the same data protection obligations on each sub-processor and remains responsible for them.
6. International transfers
Where personal data is transferred outside the EEA, Miruto ensures an adequate safeguard: an adequacy decision (including the EU–US Data Privacy Framework for certified providers) or the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, together with supplementary measures where needed.
7. Help with data subject requests
Miruto helps the Merchant answer requests from shoppers. Shoppers can stop messages at once by replying STOP. Conversations can be viewed and exported as CSV in the console. On request, Miruto deletes a shopper’s console data within 30 days, or sooner when needed to meet a legal deadline. If a shopper contacts Miruto directly, Miruto forwards the request to the Merchant.
8. Personal data breaches
Miruto notifies the Merchant without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting the Merchant’s data, with the information available at that time: what happened, which data and how many people are affected, likely consequences and what Miruto has done. Miruto provides further information as it becomes available.
9. Other assistance
Miruto gives the Merchant reasonable help with data protection impact assessments and consultations with supervisory authorities, to the extent they concern Miruto’s processing.
10. Deletion at the end
When the store is disconnected or the account is closed, Miruto deletes the Merchant’s personal data in the console within 30 days, unless the law requires it to be kept. Before that, the Merchant can export conversations and messages as CSV. Data in the Merchant’s WordPress database is under the Merchant’s control.
11. Audits
Miruto makes available the information needed to show compliance with Article 28 GDPR. The Merchant may request an audit once a year with 30 days’ notice, at its own cost, carried out by a qualified auditor bound by confidentiality, or more often if a supervisory authority requires it or after a breach. Requests go to hello@miruto.app.
12. Liability and precedence
Liability under this DPA follows the Terms of Service, as far as the GDPR allows. If this DPA and the Terms conflict on personal data, this DPA applies. The Standard Contractual Clauses, where used, take precedence over both.