Iris Cloud data processing addendum

This addendum is part of the Iris Cloud terms of service. It applies when Iris Cloud handles personal information about your visitors, customers or staff for you. "We" and "you" mean what they mean in those terms.

What this covers, and what it does not

This addendum covers the personal information of your visitors, customers and staff that Iris holds or handles for you ("your personal information"):

• what your websites keep on Iris hosting: orders, customer accounts, form messages, emails to your store and your Inbox, and assistant chats, in your website's own database and files on Cloudflare's network;
• your stores' email, which is sent and received through Amazon Web Services (Amazon SES) under our account;
• Stripe's payment notices for your store, which pass through our Stripe connection service until they reach your store;
• visitors' messages to the website assistant on your sites, with the page they asked from and a reference your site's server makes from their connection;
• personal information in your AI work: anything you put in a brief, page, edit or question, and customers' words in an inbox message you ask Iris to draft a reply to; and
• people you add to your account, and the activity log about them.

It does not cover data in your own accounts with Stripe, Shippo and other services you connect. That stays with them, under your agreement with them.

1. Roles

You decide why and how your personal information is used. We process it only for you, as your service provider or processor. Where a state privacy law requires a contract between a business and its service provider, this addendum is that contract. These laws apply to each of us only as far as their terms and size limits say.

2. What we do with it, and what we will not do

We process your personal information only to run Iris for you: to host your websites and their data, send and receive your stores' email, deliver payment notices to your store, do the AI work you ask for and count usage. This is a limited and specified business purpose, on your instructions in these terms and in your settings.

We will not:

• sell or share it, including for cross-context behavioral advertising;
• use, keep or disclose it for any other purpose, including our own commercial purposes or training AI models, except as the law allows a service provider to do;
• combine it with personal information from other sources, except as the law allows.

If we conclude we can no longer meet our duties under a privacy law that applies, we tell you, and you may stop the processing by turning the feature off.

3. How long we keep it

We keep what your websites, Inbox and store email hold while your account is open and until you delete it. After a plan ends or an account closes, it is kept offline for 30 days and then deleted, after we tell you, as the Privacy policy describes. Backup copies are replaced in the ordinary course of our backups.

Our AI gateway passes the content of AI requests through its memory and does not write it to its database or logs. Records it keeps about a request hold no message content. Anthropic keeps requests under its policy, as section 3.1 of the Privacy policy describes.

4. Subprocessors

You allow us to use the subprocessors on the Subprocessors page. For this data they are Anthropic, PBC (under its Commercial Terms and Data Processing Addendum), Cloudflare, Google Cloud, Amazon Web Services and Resend. We bind subprocessors in writing to protect the data, and we answer for how they perform their part. We update that page before adding one. If you object to a new one, tell us, and you may stop using the feature it affects or cancel.

5. Security

We use encrypted connections, keep access limited, give each website its own database, keep keys for the services you connect encrypted, and keep sign-in codes and session tokens only as hashes.

6. Helping you

You can see, export and delete your customers' records yourself in Iris, so requests from your visitors or customers to see or delete their information are yours to answer. If someone sends such a request to us, we pass it to you where we can tell who you are, or tell them to contact the website they used. We give you the information we reasonably can so you can meet your own duties, including answers to reasonable questions about this addendum.

7. If something goes wrong

If we confirm unauthorized access to your personal information in our systems, we tell you without unreasonable delay at your account's email address, with what we know, so you can meet your own duties.

8. Your responsibilities

• You tell your visitors and customers what you do with their information, and you have any consent you need. Iris's assistant says it is an AI and that messages are sent to Anthropic, and your privacy page draft lists it; keep both.
• You do not use the assistant to collect sensitive information, such as health or payment details, or from children under 13.
• You follow the Acceptable use policy, which passes on Anthropic's Usage Policy.

9. Checking our work

If a privacy law gives you the right, you may ask us to show how we meet this addendum, and to stop and fix anything unauthorized. Tell us what you need at [email protected] and we will answer in a reasonable time. We do this in writing unless the law requires more.

10. When it ends

This addendum lasts as long as we handle your personal information. When your plan ends or you close your account, we delete it as section 3 says, apart from what Anthropic holds until its period ends and what the law requires us to keep.

11. Order of documents

Where this addendum and the Iris Cloud terms differ about your personal information, this addendum applies. The liability limits in the Iris Cloud terms apply to it.

All policies