Shopify
WooCommerce
APIData Processing Agreement
Effective Date: October 17, 2026
This is an archived version. See the current version.
Version: October 17, 2026. This version supersedes all previous versions of this DPA. The current subprocessor list is maintained in Annex 3.
Between: (1) The Merchant — the store owner or business that installs or uses a Genlook application, plugin, or API on any platform (Shopify, WooCommerce/WordPress, PrestaShop, Shopline, the Try-On API, or in-store/retail try-on) (the "Controller"); and (2) Parakeet Labs SASU, operating as Genlook, 4 Rue de la République, 69001 Lyon, France, RCS Lyon SIREN 105 375 349 (the "Processor").
This DPA forms part of, and is incorporated into, the Genlook Terms of Service. It governs the Processor's processing of personal data on behalf of the Controller and reflects the parties' obligations under Regulation (EU) 2016/679 (GDPR), the UK GDPR, and equivalent data protection laws applicable to the Controller (including US state privacy laws, under which the Processor acts as a "service provider").
This is a starting-point DPA prepared for review. Have it checked by counsel before relying on it contractually.
1. Definitions
Terms such as "personal data", "processing", "controller", "processor", "data subject", and "personal data breach" have the meanings given in the GDPR. "Subprocessor" means any third party engaged by the Processor to process personal data.
2. Roles & subject matter
The Controller is the controller and the Processor is the processor of the Customer Personal Data described in Annex 1. The Processor processes Customer Personal Data only to provide the Genlook virtual try-on service and only on the Controller's documented instructions (including via use of the App), unless required to do otherwise by EU or Member State law.
3. Duration
This DPA applies for as long as the Processor processes Customer Personal Data on behalf of the Controller (i.e. while the App is installed and during any agreed retention period).
4. Processor obligations
The Processor shall:
- process Customer Personal Data only on the Controller's documented instructions;
- ensure persons authorized to process the data are bound by confidentiality;
- implement appropriate technical and organizational measures (Annex 2);
- respect the conditions in Sections 6–7 for engaging subprocessors;
- assist the Controller, by appropriate measures, in responding to data-subject requests (access, rectification, erasure, restriction, portability, objection);
- assist the Controller in ensuring compliance with Articles 32–36 GDPR (security, breach notification, DPIAs), taking into account the nature of processing and information available;
- at the Controller's choice, delete or return all Customer Personal Data at the end of the services and delete existing copies, unless storage is required by law;
- make available information necessary to demonstrate compliance and allow for and contribute to audits, including inspections, as set out in Section 8.
5. Security
The Processor implements and maintains the technical and organizational measures described in its Information Security Policy, summarized in Annex 2, including encryption in transit and at rest, access controls, automatic deletion of shopper photos, vulnerability management, and incident response.
6. Personal data breach
The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provide information reasonably available to assist the Controller in meeting its own notification obligations (GDPR Arts. 33–34).
7. Subprocessors
The Controller grants general authorization for the Processor to engage the subprocessors listed in Annex 3. The Processor shall impose data-protection obligations on each subprocessor no less protective than those in this DPA and remains liable for their performance.
The current subprocessor list is set out in Annex 3, dated, and mirrored in the Merchant Privacy Policy at genlook.app/privacy. The Processor shall give the Controller at least 30 days' prior notice of any intended addition or replacement of a subprocessor, by email where the Processor holds a contact address for the Controller and in any case by updating Annex 3 and the published list. The Controller may object within that period on reasonable data-protection grounds; if the parties cannot resolve the objection, the Controller may terminate the affected service and stop using the App.
8. Audits
The Processor shall make available, on reasonable request and no more than once per year (unless required by a supervisory authority), the information necessary to demonstrate compliance with this DPA, including its Information Security Policy and relevant subprocessor terms.
9. International transfers
Where the Processor transfers Customer Personal Data outside the EEA (notably AI image generation on Google Cloud Vertex AI, which uses Google's global serving endpoint, and on Comfy Cloud, operated from the United States), such transfers are made under appropriate safeguards pursuant to Chapter V GDPR, primarily the European Commission's Standard Contractual Clauses included in the relevant provider's data-processing terms.
10. Liability & governing law
Each party's liability under this DPA is subject to the limitations in the Genlook Terms of Service. This DPA is governed by French law, and the courts of Lyon, France have jurisdiction, without prejudice to the data subject's rights under the GDPR.
Annex 1 — Details of processing
- Subject matter: provision of the Genlook virtual try-on service.
- Nature & purpose: receiving shopper photos, running automated safety screening on them (blocking inappropriate content and photos of children; scores only, no biometric templates), generating virtual try-on images via AI, computing hashed anti-abuse signals (image fingerprints, hashed IP and device signals) to protect the service, and (where enabled by the Controller) collecting shopper email addresses and forwarding marketing events to the Controller's connected tools (e.g. Klaviyo), and (where enabled by the Controller) answering shoppers' questions through an AI shopping assistant and keeping the conversations so the Controller can read them.
- Categories of data subjects: the Controller's customers/shoppers.
- Types of personal data: shopper-uploaded photos, generated try-on images, optional email addresses, pseudonymous usage events (random browser identifier, session, country, device characteristics), hashed security signals, and shopping assistant conversations (the messages shoppers write and the replies, tied to the random browser identifier).
- Special categories: none intended. Photos may contain facial images but are processed only to render the try-on and are not used to uniquely identify individuals.
- Duration of processing: photos and generated images are deleted automatically after the configured retention window (default 7 days); shopping assistant conversations are deleted 13 months after their last message; other data per the Merchant Privacy Policy.
Annex 2 — Technical & organizational measures
As described in the Genlook Information Security Policy: encryption in transit (TLS 1.2+) and at rest (AES-256); least-privilege access limited to the Founder with MFA; automatic deletion of shopper photos; secrets stored in encrypted environment variables; dependency scanning (Dependabot) and error monitoring (Sentry); vulnerability remediation SLAs (critical 2 days, high 7 days); incident response with 72-hour breach-notification process; managed daily database backups; hardened company devices (full-disk encryption, anti-malware, host firewall, screen-lock, restricted admin privileges).
Annex 3 — Authorized subprocessors
Last updated: October 17, 2026. This list is mirrored in the Merchant Privacy Policy at genlook.app/privacy; changes are notified as described in Section 7._
| Subprocessor | Purpose | Region |
|---|---|---|
| Shopify / Shopline | App platform & billing | Global |
| Google Cloud — Vertex AI & Gemini | AI image generation | Global (Google-managed regions) |
| Google Cloud — Storage & BigQuery | Image storage & analytics | EU |
| Comfy Cloud | AI image generation (specialized engine) | United States |
| RunPod | GPU hosting for AI image generation | EU (Netherlands) |
| Decart | Realtime AI video try-on (live sessions) | United States |
| Anthropic | AI shopping assistant (chat replies; size recommendations, with the shopper's photo only when they allow it) | United States |
| Render | Application, database & ML-service hosting | EU (Frankfurt) |
| Vercel | Website & retail try-on page hosting | United States |
| Clerk | Dashboard authentication | United States |
| Stripe | Payments (API & consumer credits) | United States |
| Polar | Merchant-of-record billing (WooCommerce/PrestaShop) | United States |
| PostHog | Product analytics | EU |
| Sentry | Error monitoring | EU (Germany) |
| Crisp | Support chat | EU (France) |
| Customer.io | Merchant email communications | EU |
| Klaviyo | Marketing events (merchant-enabled) | United States |
| Discord | Internal operations alerts (shop domain & tool usage) | United States |
| Cloudflare | CDN for widget files (no personal data) | Global |
Agreed by the Processor: Parakeet Labs SASU — Thibault Mathian, Founder. The Controller accepts this DPA by installing a Genlook app or plugin, accepting the Terms of Service during onboarding, using a Genlook API key, or otherwise using the Service.