1. Parties and formation of the contract

Valeria S.r.l., with registered office at Via Roma 38/A, 21018 Sesto Calende (VA), Italy, Italian tax and VAT number 04116360126, provides the Valeria service to the party operating the Shopify store identified in the agreement, referred to below as the “Merchant”. The service is intended for business use. The person accepting the contract must have authority to represent and bind the Merchant.

The contract is formed upon written acceptance, including electronic acceptance, of these Terms, version shopify_1.6-en dated 31/10/2026, and the “Personal Data Processing Agreement” (DPA), version shopify_5.0-en dated 31/10/2026, including Annexes A, B and C. The plan’s financial terms become part of the contract upon subsequent approval of the proposal presented in Shopify. The DPA takes precedence over these Terms on personal data protection matters.

Valeria makes the documents available to the Merchant before acceptance. The acceptance record identifies the Parties, store, accepting person, date and versions of the accepted documents. Installing the app, authorising access to Shopify data, approving a charge and acknowledging the privacy notice do not, by themselves, constitute acceptance of the Terms and DPA.

The agreement must be concluded before any processing on the Merchant’s behalf, including management of staff invitations, permissions and roles and store configurations. Copies of the documents identifying the Merchant may be requested from support@valeria.food.

2. Service and conditions of access

Valeria provides an AI assistant to answer customers’ questions, find, compare and suggest products, help customers build their cart and provide information about their orders. The Retailer Portal enables the Merchant to configure the service, manage staff, upload permitted business content, review store activity and manage personal data requests.

Within the permissions granted, the app accesses the Shopify data needed to provide the service: store and installation data, connection credentials, Merchant session data, plan, catalogue, order data specified in the DPA and personal data requests. Valeria also processes conversations and the other categories of data specified in the DPA. Shopping features do not request or read card numbers, card security codes (CVVs) or financial credentials.

Order support allows authenticated customers, with the consent specified in Chapter 3, to consult their own orders and request information about products, amounts, payments, cancellations, fulfilment, shipments, tracking, delivery, returns and refunds, to the extent such data is available. Consultation covers Shopify orders from the last 60 days, including searches by order identifier. The assistant does not modify orders or carry out cancellations, returns or refunds.

The Merchant maintains the necessary permissions, protects credentials and grants access only to authorised staff. Revoking an essential permission may prevent the relevant feature from operating. The Merchant is responsible for the accuracy of its catalogue, prices, availability and terms of sale.

The assistant’s responses may contain errors. Information published by the store and presented at Shopify checkout governs purchases. The service does not provide healthcare services.

3. Data protection and permitted use

Before activation, the Merchant publishes a privacy notice for customers and visitors, identifies the controller and the contact for exercising rights, provides Valeria with the notice’s address and version, and documents the legal bases for processing.

The full standard service requires the Merchant to complete its own data protection impact assessment (DPIA). A different conclusion on the need for a DPIA requires a documented assessment and an effective reduction in the features and processing activated. Valeria provides standard privacy wording and supporting documentation; that documentation does not replace the Merchant’s assessment and conclusion.

The service is restricted to users who declare they are at least 18 years old. Optional features for authenticated customers are off by default and require withdrawable consents: memory across conversations, personalisation and order support, intentional use of health information and measurement of purchases following use of the assistant.

Consent to “Personalisation and order support” authorises consultation of the customer’s orders to tailor suggestions and responses to their purchases and answer questions about their orders. Refusal or withdrawal prevents such consultation without preventing use of essential chat. The other consents remain separate. Intentional use of health information, including information revealed by products purchased, requires separate explicit consent and the conditions specified in the DPA.

Even without consent to intentional use of health information, the check intended to identify and reject such information may involve processing of text and images by one of Valeria’s providers. For dictated messages, audio transcription takes place before the text check. The Parties verify the legal conditions applicable to these processing activities before activation.

Unlawful use of the service, circumvention of controls and deliberate submission of excluded data are prohibited. The Merchant may upload business documents, catalogues, answers to frequently asked questions and commercial terms. Staff files, customer lists, identity documents, clinical documents and data relating to criminal convictions and offences are excluded. The service does not include continuous voice conversation or adopt automated decisions producing legal or similarly significant effects for individuals.

4. Fees, term and support

The plan, price, currency, billing cycle, term, renewal and cancellation arrangements are set out in the proposal presented in Shopify before approval. These conditions take effect upon the Merchant’s specific approval, recorded in connection with the contract. No free trial is provided. Statutory refunds and other legal remedies remain applicable.

Communications, support requests and document requests are addressed to support@valeria.food and the Merchant’s authorised contact. Valeria communicates proposed contractual changes to that contact. Service levels and contractual changes require written agreement, including electronic agreement, specifying their effective date. Publication of a new version does not amend existing agreements or, by itself, suspend the service. New purposes or data categories and appointment or replacement of sub-processors remain subject to the prior agreements and authorisations specified in the DPA.

5. Data, confidentiality and termination

The Merchant retains control of its data. Valeria processes it as processor under the DPA. For management of staff identity and platform authentication, account security, the commercial relationship, aggregate measurement of service use for billing purposes, billing and its own legal obligations, Valeria instead acts as controller under the app privacy notice. Management of staff permissions and authorisations for the Merchant remains processing on the Merchant’s behalf.

Valeria does not use the Merchant’s data to train, adapt or improve AI models, develop or improve products for its own purposes, create datasets across customers, perform competitive comparisons or pursue other purposes of its own. This prohibition covers use of derived or aggregated data and anonymisation carried out to enable such uses. The Parties protect confidential information. Rights in technology and content remain with their respective holders.

On termination, the Merchant chooses return or deletion of the data. Valeria deletes originals, copies and reproductions, including backups and records relating to processing, within 30 days of uninstallation or the other applicable events specified in the DPA, unless the law prohibits deletion or varies the deadline.

Files prepared in the Retailer Portal for personal data access requests are downloaded by authorised staff, who verify completion of the download and confirm secure custody. Confirmation starts deletion of the copy held by the service. The Merchant arranges delivery of the data to the individual.

6. Liability and relationship with Shopify

Valeria is solely responsible for the app. Shopify is not responsible for defects or damage arising from its installation or use and, unless it expressly states otherwise, does not provide app support.

Under the Shopify API Terms, Valeria bears sole responsibility for any liability arising from access to or use of the app, including its development, use, marketing, distribution, access and support, and access to, use, distribution and storage of the Merchant’s data classified as “Merchant Data” in those terms.

The Parties’ liabilities under applicable law, including the GDPR, remain applicable.