Data Processing Addendum (DPA)

01 Definitions

• "Data Protection Laws" means all applicable data protection laws and regulations, including the EU GDPR, the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA ("CCPA").
• "Personal Data" means any information relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller.
• "Service Data" means first-party Amazon data exports, product specifications, delegated account data (where applicable), and other business data provided by or on behalf of the Controller.
• "Sub-processor" means any third party appointed by the Processor to process Personal Data on the Controller's behalf.

02 Subject Matter, Nature & Duration

Subject matter. Processing of application data, first-party Amazon data exports, product information, and — where the agreed scope requires it — delegated account data, for the purpose of delivering AI-readiness services.

Access model by service tier:

• Scoping Sprint: normally no Seller Central access; the Controller provides data exports directly. Where the agreed scope requires read access, it is granted as below.
• Embedded Sprint: access limited to what the agreed scope requires, inside the Controller’s own systems; any write to a live listing passes a human approval step.
• Ongoing work: may include continued delegated access granted exclusively through Amazon’s official mechanisms (Seller Central User Permissions and/or authorized SP-API connections), scoped to least privilege and revocable by the Controller at any time.

Duration. Processing continues for the duration of the engagement plus up to 12 months post-delivery (revision and follow-on support period), after which Personal Data is deleted or returned per Section 08.

03 Roles and Instructions

The Controller is the Amazon seller engaging the Services. The Processor is Scalerify Management LLC. The Processor processes Personal Data only on documented instructions from the Controller, as set out in the Terms of Service, the agreed engagement scope, and this DPA. Processing is limited to what is necessary to deliver the agreed deliverables.

Human-in-the-loop. No agent writes to a live listing without a human approving it. Engagements use automation only within guardrails the Controller has approved in writing; the Controller retains final authority over its account, and automated actions are supervised by the Processor on a weekly cadence.

04 Technical and Organizational Measures

• Access control: project files accessible only to personnel working on the specific engagement.
• Encryption: TLS encryption in transit; encrypted cloud infrastructure at rest.
• Data minimization: only data necessary for the engagement is collected and retained; only the minimum necessary data is submitted to AI model providers (Section 05).
• Credentials: Amazon Seller Central login credentials are never requested, transmitted, or stored. Where delegated SP-API access is used, tokens are held encrypted, scoped to least privilege, and revoked upon engagement termination.
• Confidentiality: persons authorized to process Personal Data are bound by confidentiality obligations.

05 Sub-processing

The Controller grants general authorization for the following categories of Sub-processors, as currently used:

The Processor: (a) imposes data-protection obligations on Sub-processors no less protective than this DPA; (b) restricts AI model providers from using Controller data for model training where the provider offers that control, and submits only the data necessary for the task; (c) remains liable for its Sub-processors' performance; and (d) will notify the Controller of any intended material change to Sub-processors, giving the Controller a reasonable opportunity to object.

06 Data Subject Rights

The Processor shall, insofar as possible, assist the Controller in fulfilling its obligations to respond to requests from individuals exercising their rights under Data Protection Laws (access, rectification, erasure, portability, restriction, objection). The Processor forwards to the Controller without undue delay any request it receives directly.

07 Personal Data Breach

The Processor shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach affecting Controller data, and shall provide reasonable information and cooperation to support the Controller's obligations under Data Protection Laws.

08 Deletion or Return of Data

Upon termination of the engagement or upon the Controller's written request, the Processor deletes or returns all Personal Data and Service Data within a reasonable timeframe, except where retention is required by law (e.g., billing records). Standard retention absent instructions: 12 months post-delivery. Any delegated access tokens are revoked at termination.

09 International Transfers

Personal Data is processed in the United States. Where the Controller is subject to the EU or UK GDPR, the parties rely on appropriate safeguards for transfers, including the European Commission's Standard Contractual Clauses (Module 2: controller-to-processor), which are incorporated by reference and executed upon the Controller's request, and equivalent UK transfer mechanisms.

10 Audit & Information

Upon reasonable written request (no more than once per year, absent a breach), the Processor will make available information reasonably necessary to demonstrate compliance with this DPA, which may be satisfied by written responses and summaries of security measures.

11 CCPA Specific Provisions

With respect to Personal Data of California residents, the Processor acts as a "Service Provider." The Processor shall not sell or share Personal Data, shall not retain, use, or disclose it for any purpose other than performing the Services, and certifies that it understands and will comply with these restrictions.

12 Governing Law

This DPA is governed by the laws of the State of Delaware, except where Data Protection Laws mandatorily require otherwise.