Effective September 18, 2026. This agreement forms part of the Terms between you (the controller) and Moss Systems LLC, a Tennessee limited liability company (the processor), and governs personal data that Store MCP processes on your behalf. It applies automatically when you connect a store; no signature is required. Questions: support@store-mcp.com.

Roles and subject matter

You are the controller of personal data in your commerce accounts, including data about your customers. We process it only to provide the service you have asked for: connecting your store to an AI client you choose, and performing the reads and writes you or that client request. The processing lasts as long as your store is connected.

Categories of data and data subjects

Data subjects are you, your staff who use the workspace, and your customers. Account data covers your email and workspace settings. Merchant data covers encrypted provider credentials, store identifiers and canonical products you create. Customer personal data — name, email address, telephone number and shipping address — is returned only by the orders.get operation, only when a request explicitly asks for buyer details, and only when the calling credential holds the sensitive permission.

No storage of customer personal data

Store MCP is a pass-through. Customer personal data is read from your provider when a request asks for it and returned to the client that asked. It is not written to our storage. There is no orders table and no customers table. Commerce event records and activity records contain identifiers, outcomes and timings only, never buyer data or provider payloads.

Our obligations

We process personal data only on your documented instructions, which are the requests you and your authorized clients make through the service, and as required by law. We do not use it for our own purposes, for advertising, for profiling, or to train models. We keep it confidential and restrict access to the personnel who need it to operate the service. We implement the technical and organisational measures described in our published security and data protection document, including encryption in transit and at rest, separation of test and production environments, and an access log recording every call that returned customer personal data.

Sub-processors

We use Cloudflare for hosting, storage, queues and email delivery, and Stripe for billing. The commerce platform you connect and the AI client you authorize receive data because you have directed us to exchange data with them; their own terms apply to what they do with it. We will give notice before adding a sub-processor that processes customer personal data, and you may object by disconnecting your stores.

Assistance, breach and audit

Because we store no customer personal data, a data subject request about a customer is answered from your provider rather than from us; we will assist you promptly with any request that concerns data we do hold. We will notify you without undue delay, and within 72 hours of becoming aware, of any personal data breach affecting your data, with the information you need to meet your own obligations. We will make available the information reasonably necessary to demonstrate compliance with this agreement.

Deletion and return

Disconnecting a store deletes its stored credentials. Requesting workspace deletion disables access promptly and erases workspace data within 30 days, subject to limited retention required to prevent fraud, resolve disputes or comply with law. Customer personal data requires no deletion step because none is retained. A provider account-deletion notification deletes the corresponding store record on receipt.

International transfers and law

Processing takes place on Cloudflare's global network. Where personal data originating in the European Economic Area or the United Kingdom is transferred, the parties rely on the applicable standard contractual clauses, which are incorporated by reference. This agreement is governed by Tennessee law, and in the event of a conflict with the Terms, this agreement prevails for personal data processed on your behalf.