Terms of Service

Pooch AI — Terms of Service

Effective date: 15 July 2026

These Terms govern your access to and use of Pooch AI, operated by VentureChefs LLC ("Pooch", "we", "us"), a limited liability company registered at 1021 E Lincolnway, Suite #10586, Cheyenne, Wyoming 82001, United States.

By installing the Pooch app, creating an account, or using the service, you ("Merchant", "you") agree to these Terms and to the Data Processing Addendum at Schedule 1. If you are agreeing on behalf of an entity, you represent that you have authority to bind it.

1. Definitions

• Service — the Pooch AI dashboard, the storefront chat widget and loader, the Shopify application and its extensions, and related APIs.
• Shopper — a visitor to your store who interacts with the chat widget.
• Shopper Data — personal data relating to Shoppers that we process on your behalf through the Service.
• Store Content — your products, collections, pages, policies, market settings, and other store data that we index in order to answer questions.
• Output — assistant responses generated by the Service.

2. The Service

Pooch provides an AI-powered chat assistant that you embed on your Shopify storefront. It answers Shopper questions using your Store Content and, where you enable it, Shopify order data.

We may improve, modify, or discontinue features. We will not make a change that materially degrades a core function of the Service without 30 days' notice, except where required for security, legal compliance, or by a change to a third-party platform outside our control.

3. Your account

You must have a Shopify store in good standing, provide accurate information, keep your credentials secure, and remain responsible for all activity under your account. You must be capable of forming a binding contract. Notify us promptly of any unauthorised use.

4. Fees

Plans. The Service is offered on the following plans:

Billing. Paid plans are billed through the Shopify Billing API. By selecting a paid plan you authorise Shopify to charge you on our behalf, and your subscription is governed additionally by Shopify's own billing terms. We do not receive or store your payment card details. Charges recur every 30 days until cancelled.

Taxes. Prices are exclusive of taxes. You are responsible for all taxes associated with your subscription, other than taxes based on our net income.

Cancellation. You may cancel at any time through the dashboard or by uninstalling the app. On cancellation, you will not be charged for any subsequent billing period, and you retain access to your paid plan until the end of the billing period you have already paid for. Your account then reverts to the Free plan.

Refunds. Fees already paid are non-refundable, except where a refund is required by law. We do not provide pro-rata refunds for a partially used billing period, because access continues for the remainder of that period.

Non-payment. If a charge fails or a subscription lapses, we may downgrade your account to the Free plan or suspend access to paid features until payment is resolved.

Price changes. We may change our prices on at least 30 days' notice. A price change takes effect at your next billing period after the notice period ends. If you do not accept it, you may cancel before it takes effect.

5. Your obligations

You represent, warrant, and agree that:

1. Authority. You have the right to give us access to your Store Content and Shopper Data and to instruct us to process it as described in these Terms and Schedule 1.
2. Your own notice. You maintain a privacy policy that accurately discloses your use of an AI chat assistant and the processing described in Schedule 1, and that meets the requirements of the law applicable to you.
3. Consent, cookies, and the analytics pixel. You are responsible for obtaining and honouring any consent required for the processing performed through the Service. This expressly includes: (a) the non-essential visitor identifier the widget stores on a Shopper's device; and (b) the storefront analytics pixel, which reports browsing and purchase events across your store, including completed checkouts and their value, as described in our Cookie Policy §5. Both are analytics and are not strictly necessary. You must ensure your consent-management banner governs the widget and the pixel, and you must not deploy either in a jurisdiction requiring prior consent without having obtained it. You are responsible for describing both in your own privacy and cookie policies.
4. Prohibited data. You will not configure or use the Service to process special categories of personal data (including health, biometric, genetic, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, sex life or sexual orientation data), payment card numbers, financial account numbers, or government identifiers.
5. Controller responsibilities. You will respond to Shopper privacy rights requests as the controller. We will assist you as set out in Schedule 1, §7.
6. Accuracy of configuration. You are responsible for how you configure the assistant and for reviewing how it represents your store.
7. Compliance. You will comply with applicable law, with Shopify's terms, and with any applicable AI transparency requirements in your markets.

6. Acceptable use

You will not, and will not permit anyone to:

• reverse engineer, decompile, or attempt to derive source code, model weights, or training data from the Service;
• use the Service to send unsolicited communications, to harass, or to unlawfully profile individuals;
• attempt to circumvent the identity verification in the order-lookup feature, or use the Service to obtain order data belonging to anyone other than the Shopper making the request;
• probe, scan, penetration-test, overload, or interfere with the Service or its infrastructure without our prior written consent;
• resell, sublicense, or make the Service available to a third party — no reseller or sublicensing rights are granted under these Terms;
• use the Service, or Output, to develop a competing product or model;
• configure the assistant to provide medical, legal, or financial advice, or to make representations you are not authorised to make;
• use the Service in violation of export control or sanctions law, or make it available to a sanctioned party or in a sanctioned territory.

7. Intellectual property

We own the Service and all intellectual property in it, excluding your content. You own your Store Content and your Shopper Data. You grant us a limited, non-exclusive, worldwide licence to host, index, process, transmit, and display that content solely to provide and support the Service for you, for the term.

As between you and us, you own the Output generated for your store, subject to our underlying rights in the Service and to our AI provider's terms.

We do not use your Store Content, Shopper Data, or conversations to train our own AI models, and we do not permit our AI sub-processors to train on them. We do not share your data with other Merchants.

Feedback you give us may be used without restriction or obligation to you.

8. Third-party services

The Service depends on Shopify and on third-party AI and infrastructure providers, listed at /legal/subprocessors and at Schedule 1, Annex III. We are not responsible for their acts, omissions, availability, or for changes to their APIs, models, pricing, or terms. A change by a third-party platform may require us to change the Service.

Your use of the Service is additionally subject to Shopify's own terms, and to your agreement with Shopify. Nothing in these Terms overrides them.

9. Confidentiality

Each party will protect the other's confidential information with at least reasonable care, use it only to perform these Terms, and disclose it only to personnel and advisers bound by equivalent obligations. This does not apply to information that is public through no breach, independently developed, or lawfully received from a third party. Disclosure compelled by law is permitted with notice where lawful.

10. Term, suspension, and termination

These Terms run until terminated. You may terminate at any time by uninstalling the app and closing your account. We may terminate for convenience on 30 days' notice.

Either party may terminate immediately for the other's material breach that remains uncured 30 days after written notice, or on the other's insolvency. We may suspend the Service immediately where necessary to prevent material harm to the Service, to other merchants, or to Shoppers, where you are materially in breach of §6, for non-payment, or where required by law or by Shopify — and we will restore it promptly once the cause is resolved.

On termination, we will delete or irreversibly anonymise Shopper Data within 30 days, except as required by law. You may export your data before termination takes effect.

Sections 1, 7, 9, 11, 12, 13, 14, and 17, and any accrued payment obligations, survive termination.

11. Warranties and disclaimers

We warrant that we will provide the Service with reasonable skill and care, and in accordance with Schedule 1.

Availability. We do not offer an uptime commitment or service credits for the Service. We use commercially reasonable efforts to keep it available, but it may be unavailable during maintenance, or as a result of factors outside our reasonable control, including changes or outages affecting Shopify or our other providers.

Except as expressly stated, and to the fullest extent permitted by law, the Service is provided "as is" and we disclaim all other warranties, express, implied, or statutory, including merchantability, fitness for a particular purpose, quiet enjoyment, and non-infringement.

AI Output. You acknowledge that the Service uses large language models, that Output is probabilistic, and that we do not warrant that Output will be accurate, complete, current, or fit for any purpose. Output is not advice. You are responsible for reviewing how the assistant represents your store and for any reliance placed on Output by you or your Shoppers.

Nothing in these Terms excludes or limits liability that cannot be excluded or limited under applicable law, including for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be limited. If you are a consumer, or if mandatory local law gives you rights that cannot be waived, nothing here affects those rights.

12. Limitation of liability

Excluded damages. To the fullest extent permitted by law, neither party is liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, business, goodwill, or data, however caused and on any theory of liability, whether or not that party was advised of the possibility.

Cap. To the fullest extent permitted by law, each party's total aggregate liability arising out of or relating to these Terms is limited to the total fees paid or payable by you for the Service in the twelve (12) months preceding the event giving rise to the claim.

Free plan. Where you use the Service on the Free plan and have paid no fees in the preceding twelve months, our total aggregate liability is limited to one hundred US dollars ($100).

Carve-outs. The cap and the excluded-damages exclusion do not apply to: your obligation to pay fees; your indemnity under §13; or either party's breach of §9 (Confidentiality).

For the avoidance of doubt, a party's breach of its data protection obligations under Schedule 1 sits inside the general cap in this section.

Nothing in this section limits liability that cannot be limited under applicable law. The parties agree that these limitations are a fundamental basis of the bargain and reflect the allocation of risk between them.

13. Indemnity

You will defend and indemnify us against third-party claims, and resulting losses, arising from your Store Content, your breach of §5 or §6, your configuration of the assistant, or your failure to meet your obligations as a data controller including your obligations under §5.3.

We do not indemnify you against third-party claims relating to the Service. Our liability in respect of any such claim is governed by §11 and §12.

14. Governing law and disputes

These Terms are governed by the laws of the State of Wyoming, United States, without regard to conflict of laws rules. The state and federal courts located in Laramie County, Wyoming have exclusive jurisdiction, and each party submits to that jurisdiction.

This section does not displace any mandatory consumer or data protection law of the jurisdiction in which you are established, and does not affect any right you have to bring proceedings before, or complain to, a supervisory authority.

The United Nations Convention on Contracts for the International Sale of Goods does not apply.

15. Changes to these Terms

We may update these Terms. We will give at least 30 days' notice of material changes by email or through the dashboard. Changes take effect at the end of that period, and continued use after that constitutes acceptance. If you do not accept a material change, your remedy is to terminate before it takes effect.

16. Notices

Notices to you are given by email to your account address or through the dashboard. Notices to us must be sent to legal@pooch-ai.com and to 1021 E Lincolnway, Suite #10586, Cheyenne, Wyoming 82001, United States.

17. General

These Terms, the Privacy Policy, and Schedule 1 are the entire agreement between us on this subject and supersede prior discussions. If any provision is held unenforceable, it is severed and the remainder stands. Failure to enforce is not a waiver. Neither party is liable for failure to perform due to events beyond its reasonable control. You may not assign without our prior written consent; we may assign to an affiliate or to a successor in a merger, acquisition, or sale of substantially all assets. There are no third-party beneficiaries. The parties are independent contractors.

Schedule 1 — Data Processing Addendum

This DPA forms part of the Terms and applies to Pooch's processing of Shopper Data on the Merchant's behalf. It applies where the GDPR, UK GDPR, Swiss FADP, the CCPA/CPRA or comparable US state law, the LGPD, PIPEDA, the Australian Privacy Act, or a comparable data protection law applies to that processing.

Capitalised terms not defined here have the meaning given in the applicable law.

1. Roles

The Merchant is the controller (or "business", controlador) of Shopper Data. Pooch is the processor (or "service provider", operador). Pooch processes Shopper Data only on the Merchant's documented instructions. The Terms, this DPA, the Privacy Policy, and the Merchant's configuration of the Service together constitute those instructions.

Pooch will inform the Merchant if, in its opinion, an instruction infringes applicable data protection law.

CCPA/CPRA. Pooch is a service provider. Pooch does not sell or share personal information, and does not retain, use, or disclose it for any purpose other than the specific purpose of performing the Service, or outside the direct business relationship with the Merchant, or for a commercial purpose other than performing the Service — except as permitted by the CCPA. Pooch will not combine personal information received from the Merchant with personal information from another source, except as permitted by the CCPA. Pooch certifies that it understands and will comply with these restrictions.

2. Pooch's obligations

Pooch will:

1. process Shopper Data only on the Merchant's documented instructions, including as to international transfers, unless required by law — in which case Pooch will inform the Merchant before processing, unless the law prohibits it on important grounds of public interest;
2. ensure that personnel authorised to process Shopper Data are bound by confidentiality;
3. implement and maintain the technical and organisational measures at Annex II;
4. respect the conditions on engaging sub-processors at §3;
5. assist the Merchant with data subject requests as set out at §7;
6. taking into account the nature of processing and the information available to Pooch, assist the Merchant in ensuring compliance with its obligations relating to security, breach notification, data protection impact assessments, and prior consultation with supervisory authorities;
7. delete or return Shopper Data at the end of the Service as set out at §8;
8. make available to the Merchant the information necessary to demonstrate compliance with these obligations, and allow for and contribute to audits as set out at §9.

3. Sub-processors

The Merchant gives general written authorisation for Pooch to engage the sub-processors listed at Annex III.

Pooch will give the Merchant at least 30 days' prior notice of the addition or replacement of a sub-processor processing Shopper Data. If the Merchant reasonably objects on data protection grounds within that period, the parties will discuss the objection in good faith. If it cannot be resolved, the Merchant may terminate the affected part of the Service without penalty and with a pro-rata refund of prepaid fees.

Pooch imposes on each sub-processor data protection obligations no less protective than those in this DPA, and remains fully liable to the Merchant for the performance of each sub-processor's obligations.

4. Security

Pooch implements and maintains the technical and organisational measures at Annex II, taking into account the state of the art, costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to data subjects. Pooch will not materially decrease the overall level of protection during the term.

5. Personal data breach

Pooch will notify the Merchant without undue delay, and in any event where feasible within 72 hours, after becoming aware of a personal data breach affecting Shopper Data.

The notification will describe, to the extent known and as it becomes known: the nature of the breach including, where possible, the categories and approximate number of data subjects and records concerned; the likely consequences; and the measures taken or proposed to address it and mitigate its effects. Where the information cannot be provided at once, it will be provided in phases without further undue delay.

Pooch will cooperate with, and provide reasonable assistance for, the Merchant's own notification obligations to supervisory authorities and data subjects. Pooch will not notify a supervisory authority or data subject on the Merchant's behalf without the Merchant's instruction, unless required by law.

6. Confidentiality

Section 9 of the Terms applies to Shopper Data.

7. Data subject requests

Because the Merchant is the controller, Shoppers should direct requests to the Merchant. Where Pooch receives a request directly from a Shopper, Pooch will not respond substantively other than to refer the Shopper to the Merchant, and will inform the Merchant promptly.

Taking into account the nature of the processing, Pooch will assist the Merchant by appropriate technical and organisational measures, insofar as possible, in fulfilling the Merchant's obligation to respond to requests to exercise rights of access, rectification, erasure, restriction, portability, and objection, and to withdraw consent.

Erasure requests. Pooch implements the commerce platform's customer redaction notifications. On receipt of a customer redaction notification, Pooch erases the Shopper Data associated with the identified individual from its systems automatically.

Access requests. On receipt of a customer data request notification, Pooch records the request and assists the Merchant in compiling the relevant data. The Merchant may also extract a Shopper's conversation history directly through the dashboard's export function at any time. Pooch will provide the assistance necessary for the Merchant to respond within the period required by applicable law and by the commerce platform.

8. Deletion and return

On termination or expiry, and at the Merchant's election, Pooch will delete or return all Shopper Data and delete existing copies within 30 days, unless law requires continued storage — in which case Pooch will inform the Merchant of that requirement and will continue to protect the data.

Pooch additionally implements the commerce platform's shop redaction notification: on receipt of that notification following an uninstall, Pooch erases the Shopper Data associated with that Merchant's store from its systems automatically.

Data residing in database backups is deleted on the ordinary backup rotation cycle, which is 7 days, during which it remains protected by the measures at Annex II and is not actively processed. The operational cache is not backed up.

9. Audit

Pooch will make available to the Merchant all information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by the Merchant or an auditor it mandates.

Audits are subject to: 30 days' prior written notice; no more than once in any 12-month period, save where required by a supervisory authority or following a personal data breach; conduct during business hours and in a manner that does not disrupt the Service or compromise the confidentiality of other merchants' data; and the auditor's execution of confidentiality obligations. Each party bears its own costs.

Where Pooch holds a current third-party security certification or audit report, it may provide that report in satisfaction of this clause in the first instance.

10. International transfers

Where Pooch processes Shopper Data outside the country of collection, and that transfer requires a safeguard under applicable law, the parties agree as follows.

(a) EEA. The EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (Controller to Processor), are incorporated by reference and deemed executed. The Merchant is the data exporter and Pooch the data importer. Clause 7 (docking) applies. Clause 9: Option 2 (general written authorisation), with the notice period at §3. Clause 11: the optional independent dispute resolution body does not apply. Clause 17: governed by the law of Ireland. Clause 18: the courts of Ireland. Annexes I, II and III of the SCCs are populated by Annexes I, II and III of this DPA.

(b) UK. The UK International Data Transfer Addendum to the EU SCCs (version B1.0) is incorporated, with Tables 1–4 populated by reference to the above.

(c) Switzerland. The SCCs apply with the amendments described by the Swiss Federal Data Protection and Information Commissioner, including that references to the GDPR are understood as references to the Swiss FADP and that the competent authority is the Federal Data Protection and Information Commissioner.

Pooch will conduct and document a transfer impact assessment where required, and will notify the Merchant if it becomes subject to a legal requirement that would prevent it from meeting its obligations under the applicable transfer mechanism.

11. Order of precedence

If this DPA conflicts with the Terms, this DPA prevails on data protection matters. If this DPA conflicts with the Standard Contractual Clauses or an equivalent transfer mechanism, that mechanism prevails.

Annex I — Description of the processing

Data exporter: the Merchant, acting as controller. Data importer: VentureChefs LLC, acting as processor.

Categories of data subjects: Shoppers — visitors to and customers of the Merchant's Shopify store.

Categories of personal data:

• Conversation content between the Shopper and the AI assistant, including any personal data a Shopper chooses to include in a message
• For signed-in Shoppers: Shopify customer ID and email address
• For order lookups: the order number and the email address or phone number the Shopper supplies; and, transiently and in volatile memory only, the contact email address, phone number, and postal address returned by the Shopify Admin API for the purpose of verifying that the order belongs to the requester
• Order summary data: order name and number, status, item names, quantities, images and prices, shipping city and country, tracking information
• Technical data: a first-party visitor identifier, device type, browser, operating system, locale, store market country and currency, page URL, title and type, timestamps, message counts, and AI token usage
• Storefront event data, where the Merchant enables the analytics pixel: for the events page viewed, product viewed, product added to cart, cart viewed, checkout started, and checkout completed — the visitor identifier; identifiers assigned by the commerce platform to the Shopper's browser, customer account, cart, checkout, and order; product and variant identifiers; the monetary value and currency of the event; and the event context and payload supplied by the commerce platform

Sensitive data: None. The Merchant is prohibited by Terms §5.4 from using the Service to process special categories of personal data. No additional restrictions or safeguards for sensitive data are therefore specified.

Nature and purpose of the processing: Provision of an AI customer-service chat assistant on the Merchant's storefront — answering Shopper questions about the Merchant's products, content and policies; retrieving order status after verifying the requester's identity; maintaining conversation continuity; and providing the Merchant with analytics concerning its own store.

Frequency of the transfer: Continuous, on Shopper interaction.

Duration of the processing: For the term of the Terms, plus the retention periods below.

Retention:

Sub-processor transfers: as set out at Annex III; subject matter, nature and duration as described above.

Competent supervisory authority: the supervisory authority of the EEA member state in which the Merchant is established. Where the Merchant is not established in the EEA but is subject to the GDPR under Art. 3(2), the supervisory authority of the member state in which the Merchant's Art. 27 representative is established. Failing either, the Irish Data Protection Commission, consistent with the choice of law at §10(a).

Annex II — Technical and organisational measures

Pooch implements and maintains at least the following measures. This Annex is a contractual commitment and is warranted as accurate as at the effective date.

Encryption

• Personal data transmitted over public networks is encrypted in transit using TLS.
• The primary database, in which conversation transcripts and session analytics are stored, is encrypted at rest.
• The operational cache, in which live session data is held, is encrypted at rest.
• Backups of the primary database are encrypted.

Data minimisation and pseudonymisation

• Contact details used to verify ownership of an order are processed only in volatile memory for the duration of a single request and are never written to persistent storage or to logs.
• Order data returned to a Shopper's browser and retained in session is reduced to a summary that excludes contact details and street address.
• Conversation transcripts archived for analytics do not include the Shopper's email address as a structured field.
• Internal log lines and analytics use a masked form of the order identifier rather than the full value.

Access control and identity

• Access to production personal data is restricted to a limited number of administrators on a least-privilege, role-based basis; not all production data is accessible even to those administrators.
• Authentication for both merchant accounts and Pooch's internal administrative tooling is provided by a managed identity service (Amazon Cognito).
• Authentication is passwordless. Accounts may register a passkey (WebAuthn/FIDO2), a phishing-resistant method requiring possession of a registered device together with a biometric or device PIN. Where no passkey is registered, authentication uses a one-time code sent to the account's registered email address. Reusable passwords are not used.

Environment separation

• Production and non-production environments are physically separate.
• Production personal data is not copied into development, test, or staging environments.

Resilience and recovery

• The primary database is backed up automatically, with a 7-day retention period, and backups are encrypted.
• The operational cache holds only transient session state and is not backed up; durable data is held in the primary database.

Logging

• Activity within our cloud infrastructure is recorded through our cloud provider's audit logging.
• Administrative actions performed through our internal tooling are recorded.

Erasure

• Automated erasure of a Shopper's data across all analytics stores on receipt of a customer redaction notification from the commerce platform.
• Automated erasure of a Merchant's Shopper Data across all analytics stores on receipt of a shop redaction notification from the commerce platform following an uninstall.
• Erasure operations record the number of records removed from each store, for audit purposes.

Governance

• Personnel with access to personal data are bound by written confidentiality obligations.
• Sub-processors are bound by data protection terms no less protective than this DPA.

Pooch reviews these measures periodically and may update them, provided the overall level of protection is not materially decreased.

Annex III — Approved sub-processors

Vector search is self-hosted within Pooch's own Amazon Web Services environment and is not a separate sub-processor. Embedding of store content is performed within Pooch's own infrastructure and is not sent to any third party.

The current list is maintained at /legal/subprocessors.