MCPify for WooCommerce

Data processing agreement

Last updated 2026-11-02

This data processing agreement ("DPA") under Art. 28 GDPR is part of the terms of service between the merchant who connects a WooCommerce store to MCPify for WooCommerce ("controller") and MCPify, Emsdettener Straße 10, 48268 Greven, Deutschland ("processor", "we"). It applies as soon as the merchant uses MCPify with personal data from their store.

1. Subject, duration and purpose

We process personal data on the controller's behalf to provide MCPify: passing data between the controller's WooCommerce store and the AI clients the controller connects, enforcing the controller's connection rules and keeping the audit log. Processing lasts as long as the store is connected, followed by the deletion described in section 9.

2. Type of data and data subjects

  • Customers of the controller's store: customer and order IDs and, only if the controller switches customer data on for a connection, names, email addresses, phone numbers, addresses, IP addresses and order details, passed through to the AI client.
  • WordPress users of the controller who use MCPify or connect an AI client: name, email address, WordPress user ID and role.

Customer names, email addresses, phone numbers and addresses are not stored: they are removed before request arguments are written to the audit log. Responses kept for safe retries are deleted after 24 hours.

3. Instructions

We process personal data only on the controller's documented instructions. The connection settings in MCPify (permissions, limits, customer data switch, raw REST API grants) and the requests of the AI clients the controller connects are such instructions. We inform the controller if we believe an instruction violates data protection law.

4. Confidentiality

Everyone we authorise to process the data is bound to confidentiality.

5. Security

We take the technical and organisational measures described on our security page, which forms part of this DPA. We may adapt them to the state of the art as long as the level of protection does not decrease.

6. Sub-processors

The controller approves the following sub-processors:

  • Render Services, Inc. (region Frankfurt, EU): hosting of the service and its database, region Frankfurt (EU).

We inform the controller of intended changes by email at least 30 days in advance; the controller may object for important data protection reasons. The controller's hosting provider and the AI client providers the controller chooses are not our sub-processors: the controller has its own agreements with them.

7. Support for the controller

We help the controller answer requests from data subjects and meet its obligations under Art. 32–36 GDPR, as far as our part of the processing allows.

8. Personal data breaches

We notify the controller without undue delay, and at the latest within 48 hours after becoming aware of a breach affecting its data, with the information available at that time, so that the controller can meet its own 72-hour deadline. The procedure is described on the security page.

9. Deletion

Audit log entries are deleted after 7 days (Free), 30 days (Starter) or 365 days (Pro and Agency). When the controller disconnects the store or deactivates the plugin, AI client access ends immediately and the REST API key is deleted; all other data of the store is deleted 30 days later unless the store is connected again, or earlier on request. Database backups are overwritten within 3 days.

10. Audits

We provide the information needed to demonstrate compliance with Art. 28 GDPR on request and allow audits by the controller or an auditor it appoints, with reasonable notice, during business hours and without disclosing other customers' data.

11. Final provisions

Liability follows the terms of service. If this DPA conflicts with the terms of service, this DPA prevails for the processing of personal data. Questions: Legal@getmcpify.app.