%202.png)
Face Age Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the agreement between Face Age and each business that uses the Services (the "Business"). It governs Shopper Data, as defined below. Face Age is the processor; the Business is the controller.
Definitions. "Business" means the company that uses Face Age through the SDK, the API, or the Shopify application. "Shopper" means a customer or website visitor of the Business who uses the Face Age widget. "Shopper Data" means personal data about Shoppers that Face Age processes on the Business's behalf.
1. Scope and Roles
1.1 This DPA applies to all Shopper Data that Face Age processes for the Business through the SDK, the API, or the Shopify application.
1.2 The Business is the controller of Shopper Data. Face Age is the processor and processes it only on the Business's documented instructions.
1.3 The Business's instructions consist of the agreement and this DPA, the settings the Business chooses in its Face Age customization settings, and the requests the Business or its storefront sends to the API.
2. Details of Processing
| Item | Description |
|---|---|
| Subject matter | AI skin and face analysis, reports, and related features provided to the Business |
| Duration | The term of the agreement, plus the deletion period in Section 10 |
| Nature | Collection, analysis, storage (only where enabled), transmission, and deletion |
| Purpose | To analyze Shopper photos and quiz answers and return results, reports, and product recommendations to the Business's storefront |
| Data subjects | Shoppers (customers and website visitors of the Business who use the Face Age widget) |
| Categories of data | Photos; facial geometry used during analysis; derived skin and face metrics (apparent age, wrinkles, dark circles, pores, pigmentation, acne, redness, oiliness, dryness, sagginess); quiz answers; email and phone where the widget collects them; Shopify customer ID, name and tags; IP address and device data; usage events such as product views and add-to-cart |
| Special category data | Photos and facial geometry may be biometric data; skin metrics may be health-related data |
3. Business Obligations
The Business is responsible for:
- Having a lawful basis for the processing, and obtaining each Shopper's explicit consent before the camera or upload feature activates, using the Face Age consent step or its own equivalent;
- Giving Shoppers a privacy notice that describes the analysis. Face Age provides a template (the Merchant Privacy Supplement);
- Where US biometric laws apply (for example Illinois, Texas, or Washington), obtaining any written release and giving any notice those laws require;
- Applying age checks and parental consent where Shoppers may be minors;
- Presenting any cookie or tracking consent required for features it enables, such as History, analytics, or advertising scripts;
- Ensuring it has a lawful basis, and any needed contract, for each third-party integration or webhook it connects.
4. Face Age Obligations
Face Age will:
- Process Shopper Data only on the Business's instructions, and tell the Business if it believes an instruction breaks data protection law;
- Not use Shopper Data for its own purposes. This includes not selling it, not using it to train or improve models, not combining it across Businesses, and not using it for marketing;
- Ensure everyone authorized to process it is bound by confidentiality;
- Apply the security measures in Section 8.
5. Default Handling and Configurable Features
| Feature | Default | When enabled by the Business |
|---|---|---|
| Photo storage | The photo is deleted once the analysis is complete | Not applicable |
| History | Off. No photo or result is kept on Face Age servers or in the Shopper's browser | Up to 5 recent analyses (photo and metrics) are kept in the Shopper's browser for up to 365 days and, for Shopify stores, in the Business's Shopify customer metafields until deleted. They are not stored on Face Age servers |
| Analytics and advertising scripts (Google Analytics, Tag Manager, Meta Pixel) | Off | Run under the Business's own tracking IDs and consent tools |
| Integrations (Klaviyo, Omnisend, Mailchimp, HubSpot, ReCharge, Zapier) and webhooks | Off | Face Age sends the fields the integration requires to the recipient the Business chooses. The Business is the controller of that transfer |
6. Sub-processors
6.1 The Business authorizes Face Age to use the sub-processors listed on its Sub-processors page.
6.2 Face Age will give at least 30 days' notice before adding or replacing a sub-processor. The Business may object on reasonable data protection grounds; if the parties cannot resolve the objection, the Business may end the affected Services.
6.3 Face Age imposes data protection terms on each sub-processor that are no less protective than this DPA, and remains responsible for their performance.
7. International Transfers
Shopper Data is hosted in the European Union (Hetzner Online GmbH, Germany; AWS, Stockholm). Where Shopper Data from the EEA, UK, or Switzerland is transferred to a country without an adequacy decision, including remote access by Face Age personnel and transfers to US sub-processors, the Standard Contractual Clauses (Module 2 or 3, as applicable) and the UK Addendum apply.
8. Security
Face Age maintains appropriate technical and organizational measures, including encryption in transit (HTTPS/TLS), encryption at rest for files stored with AWS, hashing of passwords and one-time codes, encryption of integration credentials, role-based access controls, and logging of access to systems that hold Shopper Data.
9. Assistance
9.1 Shopper requests. If Face Age receives a request from a Shopper, it will not respond directly except to confirm receipt. It will forward the request to the Business within 10 business days and help the Business respond.
9.2 Business requests. Face Age will provide, correct, or delete Shopper Data on the Business's request, including requests received through Shopify's customer data request and redaction webhooks, within 30 days.
9.3 Other assistance. Face Age will provide reasonable information to help the Business carry out data protection impact assessments and consult supervisory authorities.
10. Personal Data Breaches
Face Age will notify the Business without undue delay, and in any event within 48 hours, after becoming aware of a breach affecting Shopper Data. The notice will describe the breach, the data and Shoppers affected, likely consequences, and the measures taken.
11. Deletion and Return
When the agreement ends or the Shopify app is uninstalled, Face Age will delete Shopper Data under its control, including analysis records, Shopify metafields it created, usage logs, and access tokens, within 30 days. The Business may export its data before then. Face Age may keep data only where the law requires.
12. Audits
Face Age will make available the information reasonably needed to show compliance with this DPA. The Business may audit once a year, on 30 days' notice, during business hours, at its own cost, and under confidentiality.
13. General
Liability under this DPA is subject to the limits in the agreement. If this DPA conflicts with the agreement, this DPA prevails for data protection matters. The Standard Contractual Clauses prevail over both.