unkrypt Amend — Data Processing Addendum
Version 1.2 — 25 October 2026.
This Addendum (“DPA”) forms part of the accepted Terms between the merchant identified in the acceptance record (“Merchant”) and Ryohei Mizuno, trading as unkrypt, at 3-7-3 Azuma, Kashiwa-shi, Chiba 277-0014, Japan (see Operator notice) (“Provider”). Effective date: 25 October 2026. Privacy contact: support@unkrypt.com.
1. Scope and instructions
This DPA applies to personal data entrusted by Merchant for the Service (“Entrusted Data”). Merchant is controller, or an authorized processor acting for its controller, and Provider is processor or subprocessor as applicable. It does not govern Provider’s independently determined account-administration or legal processing, described separately in the Privacy Policy.
Provider processes Entrusted Data only on Merchant’s documented lawful instructions, including the agreement, enabled settings and authorized support requests, unless law requires otherwise. Provider will inform Merchant of a legal requirement before processing unless prohibited, and will promptly identify an instruction it reasonably believes violates applicable data-protection law. Merchant is responsible for authority, required notices and an appropriate legal basis, without relieving Provider of its own duties. Provider will not sell Entrusted Data, use it for advertising or general-purpose model training, or repurpose it for unrelated product development.
2. People and security
Provider will bind authorized personnel to confidentiality, limit access to need, and maintain risk-appropriate technical and organizational measures. Schedule B describes the measures maintained for this offering. Provider will review their effectiveness and will not materially reduce overall protection during the agreement. Merchant manages its users and instructions and cooperates on account security.
3. Subprocessors
Merchant authorizes only the subprocessors and purposes disclosed in the Schedule C. Provider will impose written protections substantially equivalent to this DPA and remains responsible for their performance of delegated obligations. An independently acting platform is identified as such rather than automatically described as Provider’s subprocessor.
Provider will normally give at least 30 days’ prior notice before adding or replacing a directly selected subprocessor. For changes to an existing provider’s onward subprocessors, Provider will pass on relevant notice promptly on receipt and support a reasonable data-protection objection within the provider’s applicable window (Railway currently provides ten days). An urgent security replacement receives as much prior notice as practicable and an explanation. Provider will not begin an unlawful transfer because a shorter notice was received. The parties will seek a reasonable alternative; if protection cannot be maintained, affected processing is suspended and Merchant may terminate the affected Service with unused prepaid fees returned. Silence is not authority for a prohibited transfer.
4. Rights requests and assistance
Provider will promptly forward a request concerning Entrusted Data to Merchant and reasonably assist with search, access, correction, export, restriction or deletion. Provider will not independently respond substantively except on instructions or where legally required. The search scope must consider uploaded documents and derived records, not only API customer identifiers.
Taking account of the nature of processing and available information, Provider will assist with security obligations, impact assessments, regulator consultations and evidence needed for Merchant’s compliance. Ordinary assistance necessary to remedy Provider’s breach is included. Any exceptional assistance fee must be proportionate and agreed in advance and must not prevent legally required action within its deadline.
5. Personal-data incidents
After becoming aware of a personal-data breach affecting Entrusted Data, Provider will notify Merchant without undue delay, give then-available information about affected data and people, likely consequences, mitigation and a contact, and supply further information as it becomes available. Provider will preserve appropriate evidence and cooperate in containment and lawful notifications. Notice is not an admission of liability. Merchant normally decides notifications to its data subjects and regulators; neither party is prevented from fulfilling its own mandatory duties.
6. Return, deletion and backups
During the agreement Provider supports disclosed exports. At termination or Merchant’s lawful request, Provider will return or delete Entrusted Data as Merchant chooses, subject to the retention schedule in Schedule A and mandatory law. Any permitted backup delay must be finite, access-restricted and used only for recovery, with previously required deletions reapplied before restored data returns to ordinary use. Legally retained data is isolated to the necessary purpose and deleted when that obligation ends. Provider will supply reasonable confirmation of completion on request.
7. Evidence and audits
Provider will supply information reasonably needed to demonstrate this DPA’s compliance. Merchant or an independent confidential auditor may inspect relevant controls on reasonable notice, normally through documentation first and without access to other merchants’ data. Routine audits should minimize disruption and occur no more than annually unless an incident, credible non-compliance concern or legal requirement justifies more. These arrangements must not obstruct a competent authority or a mandatory audit right. Costs are reasonable and agreed in advance; Provider bears its remediation costs for its own non-compliance.
8. International transfers
Schedule C identifies recipients and locations. The initial service excludes EEA/UK businesses and processing related to targeting or monitoring people there, as stated in the Terms. That scope is not an exemption from duties that apply to actual processing. Before a restricted transfer that requires a separate instrument, the parties will complete the required mechanism and safeguards; affected processing will not begin until that is done. The executed Railway DPA governs its processor/subprocessor role and includes applicable transfer provisions. This merchant DPA does not itself execute a separate transfer instrument between Merchant and Provider. Mandatory law and valid mandatory transfer terms prevail over conflicting provisions.
9. California and comparable service-provider obligations
Where applicable, Provider receives Entrusted Data solely for the specified business purposes and will provide the same level of privacy protection required by applicable law. It will not sell or share the data, retain, use or disclose it outside the specified purposes or direct business relationship, or combine it with other sources except as expressly allowed by applicable service-provider law. Provider certifies that it understands these restrictions and will comply with them, and will notify Merchant if it can no longer meet these obligations. Merchant may take reasonable and appropriate steps to verify compliance and stop or remediate unauthorized use. These restrictions flow down to applicable subcontractors. No label in this DPA exempts either party from obligations arising from its actual activities.
10. Responsibility and priority
The Terms’ lawful liability allocation applies between the parties, but does not limit data subjects’ statutory rights, supervisory powers, non-excludable liabilities or required transfer-clause protections. Nothing shifts Provider’s own duties entirely to Merchant. This DPA prevails on entrusted-data processing; mandatory law and any applicable mandatory transfer instrument prevail over both. Contact: support@unkrypt.com. English and Japanese versions are intended to be equivalent; mandatory language and statutory protections prevail over conflicting language-priority provisions.
Schedule A — Processing description
| Item | Description |
|---|---|
| Parties | Acceptance records identify the Merchant’s submitted legal business name and service-notice email, Shopify shop domain and authenticated actor, accepted version, content hash and timestamp, and retain the accepted document bundle. A postal address or additional particulars needed for a separate transfer instrument are exchanged and confirmed before the affected transfer. Provider: Ryohei Mizuno, 3-7-3 Azuma, Kashiwa-shi, Chiba 277-0014, Japan (see Operator notice) |
| Purpose | Supplier-document ingestion, extraction, product mapping, permitted reference-cost/product and separately approved selling-price changes, purchase evidence and receipt matching, records, export, security and requested support |
| Operations | Collection/receipt, storage, OCR/parsing, structuring, review/correction, comparison, authorized API transmission, export and deletion |
| People | Merchant staff, supplier representatives and sole traders; other individuals incidentally identified in submitted business documents |
| Data | Identifiers and business contact details, staff action identifiers, document contents and business records to the extent they identify people, support and audit information |
| Sensitive data | Not intentionally required or permitted for ordinary supplier processing; unexpected inclusion is assessed, restricted and removed as appropriate, not ignored |
| Frequency | On upload, configured source retrieval, authorized processing and support; periodic tasks while enabled |
| Duration | Contract period and the data-specific periods in section 6 of the Privacy Policy, including uninstallation deletion and six-day backup retention. Support correspondence is manually deleted 90 days after the final response, subject to shorter entrusted-data deletion obligations and justified limited legal holds. In-app support/usage metadata follows the store-record rules. Original-file rules and bounded pending-work holds: up to 30 additional days, followed by cancellation and original deletion after short active leases end |
| Contact and instructions | Authorized Merchant administrators through authenticated settings and verified support. Provider privacy contact: support@unkrypt.com |
Schedule B — Security measures and verification
Provider maintains: authenticated Shopify access and per-store authorization; least-privilege operator access with MFA/passkeys or Google SSO protected by MFA; encrypted operator disks, screen-lock password protection and security updates; HTTPS for external connections and private database networking; AES-256-GCM for stored Shopify sessions with secrets separated from source control; authenticated original/export routes; time-limited, scoped and revocable support grants with audit records; validated upload/source sizes, types and destinations; non-root runtime; worker heartbeats and failure handling; payload-minimized logs; dependency/security updates; incident and rights-request procedures; and daily six-day volume backups.
Railway's executed DPA specifies database encryption at rest and infrastructure access, monitoring, transport and recovery controls. We rely on those provider controls in addition to application controls; we do not claim exclusive merchant key custody, zero operator access, a dedicated tenancy, or a security certification for Amend. Optional Z.AI OCR may receive only individually confirmed non-personal price lists and has a server-side stop switch.
Restoration takes place offline or in an isolated environment. The current independent deletion journal is reapplied, referenced originals checked, deleted originals removed, prior sessions invalidated and updates disabled before reauthentication and explicit reactivation. Recovery is tested after material changes; no guaranteed RPO/RTO or 24-hour human response is sold. Failures are contained and required incident notifications are not delayed by ordinary support hours.
Schedule C — Recipients and transfers
The Service providers and processing locations notice forms this Schedule. Railway Corporation is the authorized production subprocessor for entrusted documents and related app data. Configured resources are in Singapore, operator access is from Japan, and Railway operations/onward processing can involve the United States and its disclosed providers. A DPA signed by both parties is in force; details and a suitably redacted summary can be requested from support@unkrypt.com.
Z.AI is authorized only for non-personal price-list content, not Entrusted Personal Data. Google Workspace Gmail is used for minimal direct correspondence through support@unkrypt.com and mizunoryohei@unkrypt.com, and is not authorized to receive entrusted documents, extracted content or support credentials. Shopify's role follows its independent merchant/platform relationship. Document support uses the audited in-app grant process. Unexpected entrusted-data disclosure to another channel is contained, assessed and handled under applicable deletion and notification duties; these limitations do not waive Provider's responsibility.