⚠️ Independent tool, not affiliated with Shopify, Inc. It uses an internal Shopify Email endpoint that isn't officially documented: it can stop working without notice if Shopify changes it. Read the details in the terms of use.
MailVex not affiliated with Shopify, Inc.

Data Processing Agreement (DPA)

Version: 2026-11-05 · Between: the merchant subscribing to the MailVex Pro plan (the "Controller") and AutomatLabs, a trading name of Víctor Gutiérrez Nogués (Spanish tax ID / NIF 09087078P), based at Vía Complutense 62, 28805 Alcalá de Henares, Madrid, Spain (the "Processor"), regarding the use of the MailVex web platform (app.mail-vex.com).

1. Subject matter and duration

This agreement governs the processing of personal data that the Processor carries out on behalf of the Controller, solely to provide the MailVex Pro platform service: storing the email history and metrics the Controller imports, computing additional analytics, and generating AI-assisted email drafts. It lasts as long as the Pro subscription relationship between the Controller and AutomatLabs, and ends with it, without prejudice to point 7 (what happens to the data when it ends).

2. Nature and purpose of the processing

  • Nature: storage, indexing, metrics computation and AI-assisted text generation, over content the Controller itself imports (a file exported by the extension).
  • Purpose: providing the platform features the Controller has subscribed to — centralized analytics and email draft generation — and nothing else. In particular, the Processor never uses the Controller's content to train or improve any AI model, its own or a third party's, nor for any feature that combines data across different Controllers.

3. Types of data and data subjects

  • Data categories: marketing email content (text and HTML), performance metrics (sent, delivered, opens, clicks, unsubscribes, complaints, attributed sales), import metadata, aggregated voice profile, AI-generated drafts.
  • Incidental personal data that content may contain: names, phone numbers or emails of people mentioned in the content itself (store phone/email in footers, names in testimonials, segment names). The Processor automatically masks detected email addresses and phone numbers before any content reaches an AI provider.
  • Data never processed: the Controller's store subscribers as a group. The extension's export format does not include them.
  • Data subject categories: the Controller itself (as account holder) and, incidentally, the people mentioned in its content described above.

4. Processor's obligations

The Processor:

  1. Processes data only on the Controller's documented instructions (providing the subscribed service), unless required otherwise by Union or Member State law, in which case it informs the Controller beforehand unless that law prohibits it.
  2. Ensures that persons authorized to process the data are bound by confidentiality.
  3. Implements the Article 32 GDPR security measures described in point 6 of this agreement.
  4. Does not engage any sub-processor without the Controller's general authorization, granted upon accepting this agreement with respect to the sub-processor list in force at any given time, informing the Controller of any change with reasonable notice so it can object.
  5. Assists the Controller, to a reasonable extent, in responding to data subject rights requests and in meeting its obligations under Articles 32 to 36 GDPR (security, breach notification, DPIA and prior consultation), taking into account the nature of the processing and the information available to the Processor.
  6. Notifies the Controller without undue delay of any personal data breach it becomes aware of, with the information available at that time, expanding it as the investigation progresses (see procedure in point 8).
  7. Makes available to the Controller the information necessary to demonstrate compliance with these obligations and allows reasonable audits, including inspections, upon prior notice.
  8. Upon termination of the service, deletes or returns all personal data, as the Controller decides, unless the law requires its retention (see point 7).

5. Sub-processors

The full list, with each one's role, lives on the sub-processors page, incorporated into this agreement by reference. In summary: Hetzner (infrastructure, Nuremberg, Germany/EU) and OpenAI (AI-assisted text generation, US, under standard contractual clauses — see the sub-processors page §2). Stripe processes subscription payments as AutomatLabs' data processor for the charge, and, for its own legal purposes (fraud prevention and regulatory compliance), may also act as an independent controller of that same data — it is not a sub-processor under this agreement, because payment data is not the Controller's content. Amazon SES processes the Controller's own account transactional emails (sign-in link, payment or retention notices), never the content of its marketing campaigns.

6. Security measures (Article 32 GDPR)

  • Isolation of each Controller's data through forced row-level security (FORCE ROW LEVEL SECURITY) in the database, with the tenant context set per transaction and an automated test checking for no cross-account leakage.
  • The application role that accesses the database does not own the tables.
  • Automatic masking of email addresses and phone numbers before any call to an AI provider.
  • HTML uploaded by the Controller is treated as untrusted content: it is shown only inside an isolated frame, never inserted directly into the application.
  • Encryption in transit (TLS) on all connections to the platform.
  • Logging of access, deletions and administrative actions (who, what and when — never the content itself).
  • Deletion of content 30 days after non-payment or subscription cancellation (see the retention policy in the platform section of the privacy policy), and immediate deletion on the Controller's request via "Delete my account and my data."

7. Data at the end of the relationship

  • While the subscription is active, the Controller keeps full access.
  • If the subscription falls behind on payment, the Controller keeps full access for a 14-day grace period from the non-payment and, after that, read-only and download access until 30 days from the non-payment have passed.
  • If the subscription is cancelled directly (with no prior non-payment), read-only and download access lasts the 30 days following the cancellation.
  • In both cases, on day 30 the Processor deletes all content: emails, HTML, metrics, drafts and files.
  • The Controller may request immediate deletion at any time, without waiting those 30 days.
  • Only billing data required by applicable tax law is retained, with the Controller already acting as controller of its own billing data for that purpose where applicable.

8. Security breach notification

If the Processor detects a breach affecting the Controller's personal data, it notifies the Controller without undue delay, with what is known at that time (nature of the breach, categories and approximate volume of affected data, measures already taken), so the Controller can meet, if applicable, its own 72-hour deadline to its supervisory authority (Article 33 GDPR).

9. International transfers

See the detail per sub-processor on the sub-processors page §2 and §3. In summary: infrastructure (Hetzner) stays in an EU region (Nuremberg); AI text generation (OpenAI) and transactional email (Amazon SES) involve data processed by US-based companies, under standard contractual clauses as the transfer mechanism. The Controller accepts these transfers by accepting this agreement.

10. Governing law

This agreement is governed by Regulation (EU) 2016/679 (GDPR) and, where not in conflict, by Spanish law.