Terms of Service and Data Processing Agreement: BOOX

1. The parties and acceptance

These terms (the “Terms”) are a binding agreement between Maor Baum (the “Operator”, “we”) and the owner of a Shopify store who installs or uses the BOOX app (the “Merchant”, “you”).

Installing or using the app is acceptance of the Terms, of the privacy policy and of the data processing agreement in section 11. A person who installs on behalf of a business represents that they are authorized to bind it. If you do not agree, do not install the app, or uninstall it.

2. The service

• BOOX shows shoppers, on the product pages you choose, a popup with questions and answers, under display rules you set, and shows you data on views, answers, closes and purchases that followed an answer.
• BOOX can draft questions and answers automatically from your product details and your store's policies.
• The service is provided as is (AS IS) and in an early stage. It may change, fail or stop, and we do not commit to continuous availability or to any business result.

3. Your responsibility for content and compliance

• You are responsible for everything the popup shows shoppers, including questions and answers that were written automatically. You must check that they are true, accurate and lawful before they go live, and whenever something in your store changes.
• Automatic writing can be wrong. The Operator is not liable for damage caused by content shown in the popup.
• You are responsible for complying with the consumer protection, advertising and privacy laws that apply to your store, including showing shoppers a privacy policy and obtaining their consent to data collection through Shopify's privacy tools. BOOX follows the decision the shopper made in those tools.

4. Prohibited use

You may not use BOOX to show unlawful, misleading, offensive or infringing content. You may not try to bypass limits, disrupt the service, reverse engineer it or access other stores' data.

5. Payment

BOOX is currently free of charge. If a price is set in the future, it will be shown and charged only through Shopify's billing, and only after you approve it there. We will not charge you in any other way.

6. Intellectual property

• The app, its code, design and marks belong to the Operator. You receive a personal, non-exclusive, non-transferable license to use it for as long as it is installed.
• Your content (your product details, and the questions and answers you edit) remains yours. You grant us permission to use it only to provide the service to you.
• We may use suggestions and feedback you send us to improve the service, without compensation.

7. Privacy

Information is collected and processed under the privacy policy, which is part of the Terms, and under the data processing agreement in section 11.

8. Limitation of liability

• To the fullest extent the law allows, the Operator is not liable for indirect, consequential or special damage, or for loss of profits, revenue, sales or data.
• The Operator's total liability to you, on any ground, is limited to the amount you paid the Operator in the 12 months before the event, or 100 US dollars, whichever is higher.
• Nothing in this section limits liability that the law does not allow to be limited.

9. Indemnity

You will indemnify the Operator against any third-party claim arising from content you showed in the popup, or from your breach of the Terms or of the law.

10. Termination

• You may stop at any time by uninstalling the app from your store.
• We may suspend or end the service for a store that breaches the Terms, or end the service entirely with reasonable prior notice on this page.
• After the app is uninstalled, the information is deleted as described in section 11.8.

11. Data processing agreement (DPA)

• 11.1 Roles: For personal data of the store's shoppers and visitors, the Merchant is the controller and the Operator is the processor, as those terms are used in the GDPR and in the applicable data protection laws, including Israel's Protection of Privacy Law, 5741-1981.
• 11.2 Subject matter, purpose and duration: showing the popup, measuring its use and showing the data to the Merchant, for as long as the app is installed and until deletion under section 11.8.
• 11.3 Types of data and data subjects: the store's shoppers and visitors. A random visit ID; the device type; the product; the popup being shown, the answer, clicks on its buttons and closing it; the text written in “Other”; and from the order, only when it came from a visit in which the popup was answered: the order number, the products, the total and the time. No name, email, phone, address or payment details. The IP address is used for a moment to protect against flooding and is not stored.
• 11.4 Instructions: the Operator processes the data only on the Merchant's instructions, which are the settings the Merchant makes in the app and these Terms, and for no other purpose. The Operator will not sell the data or use it for advertising. If an instruction appears to the Operator to infringe the law, the Operator will tell the Merchant.
• 11.5 Confidentiality and security: access to the data is limited to the Operator alone. All communication is encrypted (HTTPS). The database is kept with the hosting provider, encrypted at the storage level and reachable only by the server. Visit and purchase data is deleted automatically about 24 months after the month in which it was recorded.
• 11.6 Sub-processors: Shopify (the platform) and Railway (hosting of the server and the database, in the USA, in California). The Merchant authorizes these sub-processors. We will give at least 14 days' notice on this page before adding or replacing a sub-processor, and a Merchant who objects may uninstall the app. Where personal data is transferred from the European Economic Area, the United Kingdom or Switzerland to the USA, the transfer relies on appropriate safeguards under that sub-processor's data processing agreement, such as the European Commission's Standard Contractual Clauses. If the Merchant chooses a Google font for the popup, the shopper's browser loads it directly from Google.
• 11.7 Data subjects' rights: the Operator will help the Merchant answer access and deletion requests. A deletion request that arrives through Shopify is carried out automatically. An access request that arrives through Shopify is answered by sending the data to the Merchant within 30 days.
• 11.8 Deletion at the end: after the app is uninstalled, all of the store's data is deleted when Shopify's deletion request arrives, about 48 hours after the uninstall. Copies of the database kept for recovery are deleted within 30 days.
• 11.9 Security incidents: the Operator will notify the Merchant without undue delay, and no later than 72 hours after becoming aware of a breach of the store's personal data, and will give the Merchant the information needed to meet its obligations.
• 11.10 Information and audit: on reasonable request, the Operator will give the Merchant the information needed to show compliance with this section.

12. Changes to the Terms

If the Terms change, we will update this page and the date at its top. A material change takes effect 14 days after it is published. Continuing to use the app after that is acceptance of the updated Terms.

13. Governing law and jurisdiction

The Terms are governed by the laws of the State of Israel. The competent courts in Tel Aviv-Jaffa have exclusive jurisdiction.

14. General

• The Terms, the privacy policy and the data processing agreement are the entire agreement between the parties regarding BOOX.
• If a provision of the Terms is found invalid, the other provisions remain in force. Not enforcing a right is not a waiver of it.
• The Operator may assign its rights and obligations under the Terms as part of a sale or merger of the service.
• Shopify is not a party to these Terms. Your use of Shopify is governed by Shopify's terms.
• The Hebrew text is the binding version. The English text is a translation.

15. Contact

Questions, requests and notices: booxsupport@gmail.com.