Data Processing Agreement

This Data Processing Agreement ("DPA") governs the processing of Personal Data by Listomize ("Processor") on behalf of our customers ("Controller") in compliance with GDPR Article 28.

Processing is for the duration of your active subscription. Upon termination, data is deleted within 30 days unless legal obligations require retention.

• Operate the Listomize service for the Controller
• Provide AI-generated outputs (titles, tags, descriptions, etc.)
• Send transactional and account emails
• Support and security operations

• Identification: name, email address
• Account: hashed password, account preferences
• Usage: feature usage logs, IP addresses (anonymized after 30 days)
• Inputs: content submitted to AI tools (saved to the account for signed-in users; not stored for anonymous use)
• Etsy shop data: for connected shops, listings synced via Etsy's official API (deleted on disconnect)

End users of the Controller's account, typically Etsy sellers themselves.

We engage the following categories of sub-processors to operate the service. All providers are SOC 2 Type II compliant (or equivalent) and bound by data-protection agreements. Customers will be notified at least 30 days before any change.

• Edge hosting + CDN + WAF + DDoS protection — Cloudflare, Inc. (US)
• Managed database + authentication — Supabase, Inc. (US-hosted Postgres)
• Primary LLM API — Google LLC (Gemini API) — text generation for the AI tools
• Fallback LLM API — Groq, Inc. (US) — burst capacity & redundancy
• Transactional email — Resend (US email-delivery provider)
• Payments (merchant of record) — Lemon Squeezy, LLC (US) — billing & subscription processing

Note: Inputs you submit to the AI tools (and, for a connected shop, the relevant listing data) are sent to the LLM providers above to generate outputs; they do not train their models on this data on our behalf. We will notify customers at least 30 days before adding or changing a sub-processor. Questions: hello@listomize.com.

We implement appropriate technical and organizational measures including:

• HTTPS/TLS 1.3 encryption in transit
• Encryption at rest (AES-256) for the database
• Hashed passwords (bcrypt with appropriate cost factor)
• Strict access controls (least-privilege principle)
• Rate limiting and intrusion detection on all APIs
• Regular security audits and dependency updates

We will assist the Controller in fulfilling data subject requests (access, rectification, erasure, portability) within 30 days of a verified request.

We'll notify the Controller of any personal data breach without undue delay and within 72 hours of discovery, providing details of the breach, affected data, and mitigation steps.

Etsy data: where a breach affects data obtained via the Etsy API, we will notify the affected Etsy seller and Etsy (dpo@etsy.com) within 24 hours of discovery, as required by Etsy's API Terms.

For EU/UK users, transfers to the US rely on Standard Contractual Clauses (SCCs) approved by the European Commission and equivalent UK IDTA.

The Controller may request annual evidence of compliance (security certifications, audit reports). Physical audits require 30 days notice and may be subject to confidentiality agreements.

Upon termination, all Personal Data is permanently deleted within 30 days, except where retention is required by law. Backups are purged within 90 days.

To formally execute this DPA, email hello@listomize.com with your company details. We'll send a countersigned PDF within 5 business days.