1. Roles
For personal data about visitors to the Customer's store or website, the Customer is the controller and NextIntent is the processor, acting only on the Customer's documented instructions: the features of the service as the Customer configures them, this agreement and the Privacy policy.
For the Customer's own account data (the people who use the app or console, the summary recipient, billing contacts), NextIntent is the controller, as described in the Privacy policy.
2. Subject matter, duration, nature and purpose
Subject matter: the behaviour of visitors on the Customer's store or website, and the Customer's orders where the Customer's platform shares them. Duration: the term of the Customer's use of the service plus the deletion period in section 9. Nature: automated reading of visitor movement and cart state, an automated decision whether and what to say, delivery of one sentence or a hand-off to the Customer's own tool, and reporting. Purpose: to help a visitor who is stuck with a fact from the Customer's store, to measure whether that helped, and to report to the Customer.
3. Categories of data and data subjects
Data subjects: visitors to the Customer's store or website.
Data: a random visitor identifier held in a NextIntent frame; page paths and titles; timing, scroll, click and hover measurements; device type and screen size; field names and one-way hashes of submitted form values; scrubbed validation messages; cart item handles, variant ids, quantities, prices, total, country and whether a discount code applied (the code hashed); checkout steps with order total, currency and reference; for orders, the order id, name and number, time, currency, totals, status, discount codes, line items, the cart attribute carrying the visitor identifier, and a one-way hash of the customer's platform id.
Excluded by design: names, email addresses, phone numbers, postal addresses, payment details, the text of form fields, the text of discount codes, chat messages, order notes, and the visitor's IP address on the records kept about a visit. Visitor identification (reading an email address a visitor typed, attaching a name and company) is off by default, off on every Shopify store, and turned on only on the Customer's written instruction where the Customer has the legal basis for it.
4. Instructions and limits
NextIntent processes personal data only for the purposes in section 2, never for its own advertising, never to build profiles across Customers, and never to sell or share it. NextIntent tells the Customer if it believes an instruction infringes data protection law.
5. Confidentiality and staff
NextIntent staff with access to personal data are bound by confidentiality. Access is limited to those who need it to operate or support the service, and is logged.
6. Security
NextIntent maintains measures appropriate to the risk: encryption in transit; one-way hashing of identifiers that could point at a person and of submitted values, on the visitor's own browser before anything is sent; credentials stored hashed or encrypted; separate test and production environments; least-privilege access with logging; an audit log of authenticated API calls; monitoring; and an incident response process. A summary is available on request.
7. Sub-processors
The Customer authorizes these sub-processors, all processing in the United States:
- Railway: hosting and databases.
- Cloudflare: the network in front of the service, nextintent.ai, and the archive storage for moment records.
- Anthropic: model inference over a snapshot of a visit that contains no name, email, phone or address.
- Shopify: the platform and billing, for Customers on Shopify.
- Resend: delivery of the weekly summary email to the Customer's chosen address.
- Clerk: sign-in for the NextIntent console.
- Slack: only when the Customer adds a Slack webhook, for the weekly summary.
Tools the Customer chooses to receive the moment (Klaviyo, OptiMonk, Justuno, Privy, Wisepops) are the Customer's own processors, instructed by the Customer through the app's settings; NextIntent hands them the moment on the visitor's own browser and holds no account with them on the Customer's behalf.
NextIntent gives at least 30 days' notice of additions on the Privacy policy page. The Customer may object in writing and, if the objection cannot be resolved, end the affected service. NextIntent remains responsible for its sub-processors.
8. Data subject requests
NextIntent assists the Customer in responding to requests to access, correct, delete or restrict personal data. Requests relayed through Shopify's customer data request, customer redact and shop redact webhooks are handled automatically, with retries until they succeed; other requests are completed within 30 days of the Customer's instruction. The Customer can confirm the result on request.
9. Retention and deletion
The live picture of a visit expires minutes after the visit ends. The visitor record is kept for 90 days from the last visit. Moment records are archived for the life of the Customer's account so reports can be rebuilt, and erased visitors are excluded from every report and export by a deletion marker. The order ledger is kept for the life of the Customer's account, minus erasures.
When the Customer uninstalls the app or closes the account, messages to visitors stop at once. On Shopify, erasure runs when Shopify's shop redact request arrives 48 hours after uninstall. For console accounts, personal data for the Customer's sites is deleted within 30 days of closure, except where law requires retention. Backups age out within a further 30 days.
10. Personal data breach
NextIntent notifies the Customer without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting the Customer's data, with the information reasonably available at the time, and cooperates with the Customer's response.
11. Audits and information
On reasonable written request, at most once a year unless required by a supervisory authority or following an incident, NextIntent provides the information necessary to demonstrate compliance with this agreement and allows an audit by the Customer or an independent auditor bound by confidentiality, at the Customer's cost, with reasonable notice and during business hours.
12. International transfers
Processing takes place in the United States. For personal data from the European Economic Area, the United Kingdom or Switzerland, the parties incorporate the European Commission's Standard Contractual Clauses (module two, controller to processor) and the UK Addendum, with NextIntent as data importer; the annexes are completed by sections 3, 6 and 7 of this agreement.
13. General
This agreement prevails over conflicting terms regarding personal data. Liability is governed by the Terms of service. Each party bears its own costs of compliance. This agreement is governed by the law of the Terms of service.
See also: Privacy policy · Terms of service · What the script measures
Reviewed by counsel: pending.