Data Processing Addendum

Last updated: October 15, 2026

This Data Processing Addendum (“DPA”) forms part of, and is incorporated into, the Terms of Service between Rioco LLC, a Wyoming limited liability company doing business as Striveloom, 30 N Gould St STE R, Sheridan, WY 82801, United States (“Striveloom”, “we”, “us”), and the business customer that has accepted those Terms (“Customer”, “you”). It applies automatically, with no separate signature, whenever Striveloom processes Customer Personal Data in providing the Services. If you need a countersigned copy for your records, email hello@striveloom.com and we will send one.

If this DPA conflicts with the Terms, this DPA controls for the processing of Customer Personal Data. If the Standard Contractual Clauses or UK Addendum (Section 11) conflict with this DPA, they control.

1. Definitions

• Data Protection Laws means all laws that apply to the processing of Customer Personal Data under the Terms, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act as amended by the CPRA (“CCPA”).
• Customer Personal Data means personal data that Customer (or its end users) submits to, or collects through, the Services and that Striveloom processes on Customer's behalf.
• Sub-processor means a third party that Striveloom engages to process Customer Personal Data.
• Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• “Controller”, “processor”, “data subject”, “personal data”, “processing”, “business” and “service provider” have the meanings given in the applicable Data Protection Laws.

2. Roles of the parties

• For Customer Personal Data, Customer is the controller (or a processor acting for its own client, in which case Striveloom is a sub-processor) and Striveloom is the processor. Under the CCPA, Customer is the business and Striveloom is its service provider.
• Shopify apps: this DPA also applies to merchants who install Striveloom's Shopify apps (Striveloom AI and Striveloom COD Confirm AI); each such merchant is a “Customer”. For the shopper and customer personal data processed through those apps, the merchant is the controller and Striveloom is the processor. The data processed and the Sub-processors used by those apps are listed in Section 15 of our Privacy Policy.
• Striveloom is an independent controller of the personal data it processes for its own purposes, such as Customer's account and billing details and visitors to striveloom.com. That processing is described in our Privacy Policy and is not covered by this DPA.

3. Details of the processing

4. Customer instructions and responsibilities

• Striveloom processes Customer Personal Data only on Customer's documented instructions. The Terms, this DPA, and Customer's configuration and use of the Services (for example, which add-ons it enables, which numbers its agent calls, whether calls are recorded, and which services it connects) are Customer's complete instructions. Additional instructions require written agreement.
• If Striveloom must process Customer Personal Data to comply with law, it will tell Customer first unless the law prohibits it. Striveloom will tell Customer if, in its opinion, an instruction infringes Data Protection Laws.
• Customer is responsible for the lawfulness of the processing it instructs, including having a lawful basis, giving privacy notices to data subjects, obtaining any required consents (for example for call recording, AI disclosure, telemarketing and SMS), and honoring do-not-call and opt-out requests.

5. Confidentiality

Striveloom restricts access to Customer Personal Data to personnel who need it to provide, secure or support the Services and who are bound by confidentiality obligations. Staff access Customer Personal Data only to provide support Customer requests, to investigate security issues or abuse, or where required by law.

6. Security measures

Striveloom implements and maintains the following technical and organizational measures, which it may update as long as the overall level of protection is not reduced:

• Encryption in transit: all traffic to the Services and between Striveloom and its providers uses TLS (HTTPS).
• Encryption at rest: the primary database and file storage are hosted on Supabase, which encrypts data at rest. OAuth refresh tokens and third-party API secrets are additionally encrypted at the application level with AES-256-GCM.
• Tenant isolation: Postgres row-level security policies scope customer data to the organization it belongs to, and server code checks organization membership on access.
• Access controls: role-based access (owner, admin, team, client and read-only roles), with the administration console restricted to platform administrators. Multi-factor authentication is available for accounts and can be enforced for the administration console.
• Accountability: audit logging of administrative and sensitive actions, including account deletion requests and time-limited, logged support impersonation sessions.
• Abuse protection: rate limiting on public and paid endpoints, bot protection (hCaptcha) on sign-up and sign-in forms, and a restrictive security-header configuration.
• Retention controls: call recordings are kept for 30 days by default (configurable by Customer) and then purged; Customer can delete records it no longer needs.

Striveloom does not currently hold SOC 2, ISO 27001 or HIPAA attestations, and the Services are not designed for HIPAA-regulated data.

7. Sub-processors

Customer gives general authorization for Striveloom to engage the Sub-processors below. Striveloom imposes data-protection obligations on each Sub-processor that are no less protective than those in this DPA, to the extent applicable to the service the Sub-processor provides, and remains responsible for its Sub-processors' performance. Many Sub-processors are only involved if Customer uses the related feature.

• Changes: Striveloom will give at least 30 days' notice before a new Sub-processor begins processing Customer Personal Data, by updating this page and, for Customers who ask to be notified at hello@striveloom.com, by email.
• Objection: Customer may object on reasonable data-protection grounds within that notice period. The parties will discuss the concern in good faith; if Striveloom cannot offer a reasonable alternative, Customer may terminate the affected Services and receive a pro-rated refund of prepaid fees for the unused period.

8. Data subject requests and assistance

• If Striveloom receives a request from a data subject relating to Customer Personal Data, it will promptly forward it to Customer (where the request identifies Customer) and will not respond itself except to direct the person to Customer, unless Customer authorizes it.
• Taking into account the nature of the processing, Striveloom will provide reasonable assistance to help Customer respond to requests to access, correct, delete, restrict, port or object to the processing of Customer Personal Data, including through the Services' own tools (viewing and deleting records in the dashboard, account data export in Settings) and, where those are not enough, on request.
• Striveloom will provide reasonable information Customer needs to carry out data-protection impact assessments and prior consultations with supervisory authorities about the Services.

9. Security Incident notification

Striveloom will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data, aiming to do so within 72 hours, by email to the account owner. The notice will describe, as far as then known, the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Striveloom will take reasonable steps to contain and remedy the incident and will update Customer as more information becomes available. Notification is not an admission of fault. Report suspected incidents to security@striveloom.com.

10. Return and deletion

• During the term, Customer can export account data from Dashboard → Settings and can ask hello@striveloom.com for a copy of other Customer Personal Data (for example call transcripts or leads) in a commonly used, machine-readable format.
• When Customer deletes its account, the account is deactivated immediately and scheduled for permanent deletion after a 30-day grace period, during which Customer can ask us to restore it. After that, Customer Personal Data is deleted from production systems; copies in backups roll off on our providers' backup schedule and remain protected by this DPA until they do.
• Striveloom may keep Customer Personal Data longer only where required by law, in which case it will keep it confidential and process it only for that purpose.

11. International transfers

• Striveloom and most Sub-processors process data in the United States, and some in the other countries listed in Section 7.
• For transfers of Customer Personal Data from the EEA, the parties incorporate by reference the Standard Contractual Clauses adopted by European Commission Implementing Decision (EU) 2021/914: Module Two (controller to processor) where Customer is a controller and Module Three (processor to processor) where Customer is a processor. Customer is the data exporter and Striveloom the data importer. For those clauses: the Clause 7 docking clause applies; Clause 9 Option 2 (general written authorization, with the notice period in Section 7) applies; the optional wording in Clause 11 does not apply; Clauses 17 and 18 are governed by and resolved in the courts of Ireland; and Annexes I and II are completed by Sections 2, 3 and 6 of this DPA.
• For transfers from the United Kingdom, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) is incorporated by reference, with Table 1 to 3 completed using the information in this DPA and either party able to end it as allowed by its Section 19.
• For transfers from Switzerland, the Standard Contractual Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection and the competent supervisory authority being the Swiss Federal Data Protection and Information Commissioner.
• Where a Sub-processor is certified under the EU-U.S. Data Privacy Framework (or its UK and Swiss extensions), Striveloom may rely on that certification instead.

12. Audits and information

On Customer's reasonable written request, and no more than once a year (unless required by a supervisory authority or following a Security Incident), Striveloom will provide information reasonably necessary to demonstrate compliance with this DPA, such as written answers to a security questionnaire and descriptions of its security measures. Where that information is not sufficient for Customer to meet its obligations under Data Protection Laws, the parties will agree in good faith on the scope, timing and cost of any further audit, which must be conducted with reasonable notice, during business hours, without disrupting the Services and subject to confidentiality. Striveloom does not currently provide third-party audit reports such as SOC 2.

13. CCPA service-provider terms

Where the CCPA applies, Striveloom will not: sell or share Customer Personal Data; retain, use or disclose it for any purpose other than the business purposes set out in this DPA and the Terms, or outside the direct business relationship with Customer; or combine it with personal information Striveloom receives from other sources, except as the CCPA permits for service providers. Striveloom will notify Customer if it can no longer meet its CCPA obligations and lets Customer take reasonable steps to stop and remediate unauthorized use.

14. Liability, governing law and term

• Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability in the Terms (Section 14, “Limitation of liability”), except where Data Protection Laws or the Standard Contractual Clauses do not allow such limitation.
• This DPA is governed by the law that governs the Terms (Section 17, “Governing law and disputes”), except where the Standard Contractual Clauses or UK Addendum require otherwise.
• This DPA lasts as long as Striveloom processes Customer Personal Data. We may update it to reflect changes in law or in our Services; we will post the new version here and will not reduce the overall protection of Customer Personal Data without notice under the Terms.

15. Contact

Rioco LLC (dba Striveloom)
30 N Gould St STE R, Sheridan, WY 82801, United States
Privacy and DPA requests (including countersigned copies): hello@striveloom.com
Security and incident reports: security@striveloom.com

See also our Terms of Service, Privacy Policy and Cookie Policy.