AIRA Pilot – Customer Addendum

Between: Sharefox AS (“Sharefox”) and Customer (“Merchant”)

What is AIRA?

AIRA is an AI-powered tool integrated into the Sharefox platform that helps you draft replies to customer enquiries received by email. You ask AIRA for a draft, and you decide whether to send it.

What AIRA does – and does not do

AIRA does	AIRA does not
Reads only the specific email you actively request help responding to	Read or monitor your inbox
Generates a reply draft in your compose window	Send emails automatically – you always send yourself
Syncs publicly available content from your Sharefox page (products, terms, FAQ) to a knowledge base	Use your content to train AI models
Stores generated drafts and configuration data	Store full content of the customer’s email, only anonymised version after the draft has been generated
Helps staff write better replies faster	Replace your judgement – all drafts are suggestions only

Privacy and data processing

Merchant is the data controller for personal data processed via AIRA. Sharefox is the data processor. Sharefox’s existing Data Processing Agreement (DPA) also applies to AIRA.

When AIRA is used, the following data is processed:

Data	Stored?
Content of the selected customer email (when requesting a draft)	Processed to generate the draft. Anonymized copy retained – while AIRA is active
Generated reply drafts	Yes – while AIRA is active
Metadata (timestamp, status – not the email content itself)	Yes – while AIRA is active
Public content from your Sharefox page	Yes – until you delete or deactivate
Employee user information	Yes – while the account is active

Merchant responsibilities

Merchant is responsible for the content of all emails sent to customers, regardless of whether AIRA generated the draft. Merchant confirms that employees have been informed that selected emails are processed when requesting a draft.

Pilot terms

AIRA is free of charge during the pilot period
Either party may terminate participation with 14 days’ written notice
Any commercial terms following the pilot will be communicated with a minimum of 30 days’ notice

Acceptance

By activating AIRA, Merchant confirms they have read and agree to the terms above.

List of Sub-processors

The following sub-processors are used by AIRA, in addition to those already listed in your existing DPA with Sharefox:

AIRA resides on servers in the Netherlands as a part of Sharefox solutions. All sub-processors are subject to Standard Contractual Clauses (SCCs) or other transfer mechanisms in accordance with GDPR Article 46. Sharefox will provide a minimum of 30 days’ notice of any material changes to the sub-processor list.

Sub-processor	Purpose	Categories of data	Region
Google Cloud Platform	Cloud Run, Cloud SQL, Secret Manager, Artifact Registry, Cloud Logging	All application data, operational logs	EU (europe-north1)
Google Identity Platform	User authentication, tenant custom claims	Admin user email, name, auth UID	EU / Google global infra
Google Gemini	Draft generation, intent classification, personality generation at activation, optional draft anonymization	Email content (request-scoped), merchant config, knowledge chunks, generated drafts	EU
Google OAuth / Gmail API	Gmail add-on authentication and draft insertion	Google account identity; selected message content	Google global
OpenAI	Text embeddings for knowledge retrieval	Knowledge chunks, retrieval queries	USA
Cohere	Reranking retrieved knowledge chunks.	Retrieval query + candidate chunks	USA
Firecrawl	Public website scraping during activation onboarding	Public shop page HTML/text	USA
LlamaIndex (LlamaParse)	Document parsing for uploaded files, fallback option	Uploaded document content	USA
Microsoft	Outlook add-in host + auth (pending IdP cutover)	Selected email content when drafting	Microsoft 365 regions (EU available)
Sharefox Platform API	Site activation, merchant config, rental tool calls	Site metadata, integration tokens, booking lookups	(Netherlands — Sharefox infra)