Data Processing Agreement

1. Parties and scope

This Data Processing Agreement (“DPA”) forms part of the Beta Terms between the Customer and Xploriz Digital FZ-LLC, as identified in Annex I (“we”, “us”). It applies when we process Personal Data in Customer Content on the Customer’s behalf. Words defined in the Beta Terms have the same meaning here. Data Protection Law means, as applicable, the EU GDPR, the UK GDPR and UK Data Protection Act 2018, the UAE’s Federal Decree-Law No. 45 of 2021 (“PDPL”), and, where it applies, India’s Digital Personal Data Protection Act, 2023 and its Rules (“DPDP Act”). Controller, processor, data subject, personal data breach and processing have their GDPR meanings, and under the DPDP Act mean the closest equivalent (Data Fiduciary, Data Processor, Data Principal).

2. Roles and instructions

2.1 The Customer is the controller of Customer Personal Data, or a processor acting for its client (such as an agency acting for a brand). We are its processor or sub-processor. For our own account, usage and support data, we are a controller, as the Privacy Policy explains.

2.2 We process Customer Personal Data only on the Customer’s documented instructions. These are the Beta Terms, this DPA, and the Customer’s use of the Service, unless the law requires otherwise, in which case we will tell the Customer first if we legally can. If we think an instruction breaks Data Protection Law, we will say so.

2.3 The Customer is responsible for having a lawful basis and giving the required notices for the Personal Data it puts into the Service, including permissions for people’s photos, reviews and customer handles, and for checking the Service’s measures meet its needs. An agency confirms that it has its client’s authority to use the Service and these Sub-processors.

2.4 Annex I describes the processing. The Customer must not upload special categories of data, or Personal Data of its subscribers or customers, beyond what the Beta Terms allow.

3. People and confidentiality

Anyone we allow to process Customer Personal Data is bound by confidentiality. Today, that is one administrator.

4. Security

We keep in place the technical and organisational measures in Annex II. We may improve them, but will not materially reduce overall protection.

5. Sub-processors

5.1 The Customer gives us general authorisation to use the Sub-processors in Annex III. We have a written contract with each, with data protection duties comparable to those in this DPA. We remain responsible for their performance, as Data Protection Law requires.

5.2 We will give at least 14 days’ notice by email or in the Service before adding or replacing a Sub-processor, and we will update Annex III. If an urgent replacement is needed to keep the Service running or secure, we may give shorter notice, and will explain why. The Customer may object on reasonable data protection grounds within 14 days. We will then try to find a solution. If we cannot, the Customer may stop using the affected part of the Service or end this agreement, as its only remedy.

6. International transfers

6.1 We are based in the United Arab Emirates, and our administrator works there. Some Sub-processors are in the United States and other countries. The Customer authorises these transfers, as described in Annex III.

6.2 EU. Where the Customer’s transfer to us is subject to the EU GDPR and is not covered by an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated into this DPA and apply, completed as stated in Annex IV: Module Two when the Customer is a controller, and Module Three when it is a processor. Accepting the Beta Terms has the same effect as signing them and their annexes.

6.3 UK. Where the transfer is subject to the UK GDPR, the same clauses apply as amended by the UK International Data Transfer Addendum (version B1.0), as stated in Annex IV.

6.4 Onward transfers. We transfer Customer Personal Data to Sub-processors outside the EEA or UK only under an adequacy decision, or the Standard Contractual Clauses (Module Three) or equivalent safeguards, in the terms of their data processing agreements.

6.5 Government requests. If a public authority asks us for Customer Personal Data, we will check that the request is lawful, challenge it where there are reasonable grounds to, disclose the minimum, and tell the Customer if we legally can. We have not received any such request to date.

7. Helping the Customer

7.1 Data subject requests. We will pass on any request we receive about Customer Personal Data, without responding ourselves unless authorised. We will give reasonable help so the Customer can respond. Most requests can be handled in the Service by editing or deleting the content.

7.2 Other help. On request, we will give reasonable help with data protection impact assessments, consultations with authorities, and security, as far as our role and the information we hold allow.

8. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we will tell the Customer without undue delay, and where feasible within 48 hours, at the email address on the account. We will give what we know then: the nature of the breach, the data and people affected, the likely consequences and what we are doing, and will add details as we learn them. Telling the Customer is not an admission of fault. The Customer decides whether to notify authorities and individuals, except where the law places that duty on us.

9. Deleting and returning data

During the term, the Customer can delete Customer Personal Data in the Service, including by deleting a brand. When this agreement ends, we will delete or return Customer Personal Data as the Customer chooses, within 30 days of its request or, if it makes no request, when we close the account. This excludes copies in backups, kept up to 7 days, and provider logs, which expire within their stated periods, unless the law requires us to keep them longer. Those copies stay protected and are not otherwise used.

10. Information and audits

We will make available the information reasonably needed to show compliance with this DPA, including this document and answers to reasonable written questions, once a year or after a breach. If that is not enough, or a regulator requires it, the Customer may audit us, on reasonable notice, during business hours, and at its own cost, subject to confidentiality. We have no independent certifications of our own, though many of our Sub-processors do.

11. Liability

Each party’s liability under this DPA is subject to the limits in the Beta Terms. This does not limit a data subject’s rights or remedies, or either party’s liability to a data subject or authority, under Data Protection Law or the Standard Contractual Clauses.

12. India

Where the DPDP Act applies to Customer Personal Data, the Customer is the Data Fiduciary and we are its Data Processor under a valid contract, as required by section 8(2) of that Act. We keep the safeguards in Annex II, and will help the Customer meet its duties as reasonably needed. Where we process data of people outside India under a contract with a person outside India, section 17(1)(d) of the DPDP Act may apply.

13. Duration and order

This DPA lasts as long as we process Customer Personal Data. If it conflicts with the Beta Terms it prevails, and the Standard Contractual Clauses prevail over both. Version changes follow section 18 of the Beta Terms.

Annex I: Description of the processing

Annex II: Technical and organisational measures

These reflect the Service as it is today.

Access and separation

• Row Level Security on every database table: each brand’s data is reachable only by its members, by role (owner, editor, viewer), and the database itself checks this.
• Invite-only access. Sign-ups need a valid invitation, checked by the login system and again in the database.
• Login sessions are checked live, so an ended session cannot read data. Suspended accounts lose access at once.
• Two-step login (TOTP) is available to all users, and is required for the admin area. Admin rights are set in server configuration, not in the database. Admin pages are hidden from others and checked on the server.
• Admin actions are logged.
• A bot check (Cloudflare Turnstile) on the login, sign-up and password reset forms, checked again by the login system; rate limits on logins, forms and AI actions, stored only as fingerprints.
• Security headers on every page, including a strict Content Security Policy; forms and actions accept requests only from our own pages.
• Secrets are held only in server environment variables, with separate keys for staging and production. Test and production environments are separate.

Encryption

• TLS for data in transit. Supabase states TLS 1.2 or later, and AES-256 encryption at rest, including backups.
• Per-brand secrets such as Klaviyo keys are additionally encrypted with AES-256-GCM, with a key held only on the server, are tied to the brand, and are never sent to the browser or logged.

Data handling

• Hosting of the main database and files in the EU (Frankfurt).
• Data minimisation: no subscriber or shop-customer details are taken from Klaviyo or Shopify. Only aggregated analytics are planned.
• Error reports exclude IP addresses, cookies, headers, request bodies and query strings, and are scrubbed before sending.
• AI calls run only on the server, on our accounts, with providers whose terms exclude training (Photoroom subject to confirmation), and with cost and usage logs per brand.
• Uploads are checked: images are re-encoded, SVG files are cleaned and refused when too costly to draw, and ZIP files have size and count limits.
• Text imported from websites, documents and reviews is passed to AI as material, never as instructions.
• Automatic clean-up: feedback screenshots after 90 days, feedback text and the admin log after 2 years, unused invitations 90 days after they expire. Usage and acceptance records are kept as stated in our Privacy Policy. Deleting a brand removes its database rows and stored files, including late files from jobs still running. Leftover files are counted and shown to the administrator.

Availability and incidents

• Daily database backups kept for 7 days. Stored files are held in Supabase Storage, not in those backups.
• Automatic error tracking, with alerts to the operator. Daily spending caps on AI use, for the whole Service and for each account.
• A written incident response and breach notification plan, and a written backup and restore procedure.
• A documented release process with automated tests, and staging before production.

Annex III: Sub-processors

Current as of the date of this version. Planned and not yet in use: Paddle (payments, as an independent controller, after the beta).

Annex IV: Completing the Standard Contractual Clauses