DATA PROCESSING AGREEMENT

Last updated 7 October 2026

This Data Processing Agreement (“DPA”) is entered into between the parties to the Master Subscription & Professional Services Agreement or the End User License Agreement (“EULA”), as applicable (the “Principal Agreement”), and applies where the services provided under the Principal Agreement involve the processing of Personal Data by merchi.ai on behalf of Customer. It forms part of the agreement between Customer and merchi.ai Limited (company number 16246476) (“merchi.ai”) and is incorporated by reference into the Principal Agreement. Capitalised terms used but not defined in this DPA have the meanings given in the Principal Agreement. References to “Customer” in this DPA include “User” as defined in the EULA, where the DPA is incorporated into the EULA. Where this DPA is incorporated into the EULA: (a) references to the “Application Services” mean the Service as defined in the EULA; (b) references to the “Subscription Term” include any Free Trial Period; (c) references to a “Commercial Agreement” do not apply; and (d) references to “Affiliates” mean any entity that directly or indirectly controls, is controlled by, or is under common control with merchi.ai.

Effective date: This DPA is effective from the Effective Date of the Principal Agreement (or from the date of signature of this DPA if later) and continues for the duration of the Principal Agreement and until all Personal Data has been returned or deleted in accordance with this DPA.

1. Definitions

“Controller” means the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of Personal Data; for the purposes of this DPA, Customer is the Controller.

“Data Protection Laws” means all laws relating to the processing of personal data and privacy that apply to a party in connection with this DPA, including: (a) the UK GDPR (as defined in section 3(10) of the Data Protection Act 2018), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426), each as amended (including by the Data (Use and Access) Act 2025); (b) where applicable, Regulation (EU) 2016/679 (the “EU GDPR”), Directive 2002/58/EC and national laws implementing or supplementing them; and (c) to the extent applicable, guidance and codes of practice issued by the UK Information Commissioner or any other relevant Supervisory Authority; in each case as amended, replaced or superseded from time to time.

“Data Subject” means an identified or identifiable natural person to whom Personal Data relates.

“Personal Data” means any information relating to a Data Subject that Customer submits to the Application Services or that is processed by merchi.ai on behalf of Customer in connection with the Application Services, and which is subject to Data Protection Laws. For the avoidance of doubt, Personal Data may form part of Customer Data and/or be processed to produce Output Data.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.

“Processing” and “Process” have the meanings given in Data Protection Laws (and “Processed” shall be construed accordingly).

“Processor” means the natural or legal person which processes Personal Data on behalf of the Controller; for the purposes of this DPA, merchi.ai is the Processor.

“Subprocessor” means any third party (including merchi.ai Affiliates) appointed by merchi.ai to Process Personal Data on behalf of Customer in connection with the Application Services.

“Supervisory Authority” means an independent public authority established to monitor the application of Data Protection Laws (including the UK Information Commissioner’s Office and EU/EEA data protection authorities).

2. Roles and scope

2.1 Controller and Processor. The parties acknowledge that, in respect of Personal Data Processed in connection with the Application Services, Customer is the Controller and merchi.ai is the Processor. merchi.ai shall Process Personal Data only on documented instructions from Customer (including instructions set out in the Principal Agreement, any applicable Commercial Agreement, and this DPA), unless required to do so by applicable law (in which case merchi.ai shall inform Customer of that legal requirement before Processing, unless the law prohibits such information on important grounds of public interest). merchi.ai shall immediately inform Customer if, in merchi.ai’s opinion, an instruction from Customer infringes Data Protection Laws.

2.2 Scope. This DPA applies to all Processing of Personal Data by merchi.ai (and its Subprocessors) in the course of providing the Application Services to Customer. It does not apply to processing where merchi.ai acts as a separate Controller (e.g. for its own account management, billing, or marketing), which shall be governed by merchi.ai’s privacy notice and applicable law. merchi.ai also acts as an independent Controller when it anonymises Customer Data and Output Data under Section 2.3, and shall carry out that anonymisation in accordance with Data Protection Laws.

2.3 Processing details. The subject matter, duration, nature and purpose of Processing, the types of Personal Data, and the categories of Data Subjects are set out in Annex A (Processing Details). merchi.ai shall not Process Personal Data for any other purpose or in any way that is incompatible with Annex A or Customer’s documented instructions, except that merchi.ai may anonymise and aggregate Customer Data and Output Data and use the resulting Aggregated Data in accordance with the licence granted by Customer in the Principal Agreement (Section 5.3 of the MSA or Section 7.3(b) of the EULA). Aggregated Data is not Personal Data. merchi.ai does not currently use Aggregated Data to train machine learning models and shall give Customer at least 30 days’ notice before it first does so. Customer may opt out of this use by written notice to privacy@merchi.ai, in which case merchi.ai shall cease such use within 30 days of receiving that notice.

3. Processor obligations

3.1 Confidentiality. merchi.ai shall ensure that persons authorised to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.2 Security. merchi.ai shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including as appropriate: (a) the pseudonymisation and encryption of Personal Data; (b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; (c) the ability to restore the availability and access to Personal Data in a timely manner in the event of an incident; and (d) a process for regularly testing, assessing and evaluating the effectiveness of those measures. merchi.ai shall take into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing, as well as the risk to the rights and freedoms of Data Subjects. The measures merchi.ai has implemented as at the date of this DPA are described in Annex C (Security Measures). merchi.ai may update those measures from time to time, provided that the overall level of security is not reduced.

3.3 Subprocessors. (a) Customer generally authorises merchi.ai to appoint Subprocessors to Process Personal Data, provided that merchi.ai: (i) ensures that each Subprocessor is bound by contractually binding obligations that are substantially no less protective of Personal Data than those in this DPA (including in relation to confidentiality, security, international transfers, and Data Subject rights); and (ii) remains liable to Customer for the performance of each Subprocessor’s obligations. (b) A list of current Subprocessor categories and, where applicable, named Subprocessors is set out in Annex B (Subprocessors). merchi.ai shall maintain an up-to-date list of Subprocessors and shall notify Customer of any intended addition or replacement of a Subprocessor by email or via the Application Services (e.g. in a dedicated page or by email to Customer’s account contact) at least 30 days in advance, where reasonably practicable. Customer may object to a new Subprocessor on reasonable grounds relating to the protection of Personal Data by notifying merchi.ai in writing within 30 days of the notice. If Customer objects, the parties shall discuss in good faith whether the Processing can be achieved by other means (e.g. different Subprocessor or configuration). If no alternative is agreed within a reasonable period, merchi.ai may continue to use the Subprocessor; Customer shall not be entitled to terminate the Principal Agreement solely on the basis of that objection unless the objection relates to a fundamental incompatibility with Data Protection Laws. (c) Where a Subprocessor fails to fulfil its data protection obligations, merchi.ai shall remain fully liable to Customer for the performance of that Subprocessor’s obligations.

3.4 Assistance. merchi.ai shall, taking into account the nature of the Processing and the information available to merchi.ai, assist Customer in ensuring compliance with Customer’s obligations under Data Protection Laws in respect of: (a) responses to Data Subject requests (e.g. access, rectification, erasure, restriction, portability, objection); (b) security of Processing and notification of Personal Data Breaches to the Supervisory Authority and to Data Subjects; (c) data protection impact assessments where the Processing is likely to result in a high risk to the rights and freedoms of Data Subjects; and (d) prior consultation with the Supervisory Authority where required. merchi.ai shall provide such assistance to the extent reasonably required and at Customer’s cost (except where the need for assistance arises from merchi.ai’s breach of this DPA). Customer is responsible for verifying the identity of Data Subjects and for the legality of instructions; merchi.ai may rely on Customer’s instructions unless they are manifestly unlawful.

3.5 Personal Data Breach. merchi.ai shall notify Customer without undue delay (and in any event within 48 hours) after becoming aware of a Personal Data Breach affecting Customer’s Personal Data. The notification shall include, to the extent then known: (a) a description of the nature of the breach; (b) the categories and approximate number of Data Subjects and data records concerned; (c) the likely consequences of the breach; and (d) the measures taken or proposed to be taken to address the breach and mitigate its effects. merchi.ai shall provide such further information as Customer reasonably requests to enable Customer to meet its obligations to notify the Supervisory Authority and/or Data Subjects under Data Protection Laws. merchi.ai shall not notify Data Subjects or the Supervisory Authority on Customer’s behalf unless Customer expressly requests it in writing and, where applicable, in accordance with Customer’s instructions.

3.6 Return and deletion of Personal Data. Customer may export Customer Data and Output Data at any time during the Subscription Term using the Application Services’ export functionality. Upon termination or expiry of the Principal Agreement (or of the Application Services that involve Processing of Personal Data), merchi.ai shall, at Customer’s choice, return or delete all Personal Data Processed on behalf of Customer within a reasonable period, and shall delete existing copies (including copies held in backups, as those backups expire in the ordinary course) unless applicable law requires storage. Customer may make its choice, or request earlier deletion, by written notice to privacy@merchi.ai. Until deletion or return is complete, merchi.ai shall continue to comply with this DPA and shall Process Personal Data only as necessary for the deletion or return process. On request, merchi.ai shall confirm in writing when deletion is complete.

4. International transfers

4.1 Permitted locations. merchi.ai hosts Personal Data in the European Economic Area. Personal Data may be transferred to the United States for AI processing and customer support, and may be accessed remotely from the United States for technical support purposes, by the Subprocessors set out in Annex B. Where merchi.ai or a Subprocessor transfers Personal Data outside the UK or EEA, merchi.ai shall ensure that appropriate transfer safeguards are in place in accordance with Data Protection Laws prior to any such transfer, including as applicable: the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses; EU Standard Contractual Clauses (using the appropriate module for the nature of the transfer, including Module 3 for processor-to-processor transfers); adequacy decisions; or such other mechanisms as are recognised under applicable Data Protection Laws. merchi.ai shall make available, upon Customer’s written request, a summary of the transfer mechanisms in place for each relevant Subprocessor.

4.2 Subprocessor transfers. merchi.ai shall ensure that any Subprocessor that receives Personal Data in a third country is bound by transfer mechanisms that comply with Data Protection Laws (e.g. adequacy decision, Standard Contractual Clauses, or UK equivalent). Upon request, merchi.ai shall provide Customer with information about the transfer safeguards in place for each relevant Subprocessor.

4.3 Disclosure to authorities. If a government or regulatory authority in a third country requests access to Personal Data Processed by merchi.ai or a Subprocessor, merchi.ai shall (unless prohibited by law) promptly notify Customer and shall not provide access until Customer has had a reasonable opportunity to object or to seek a protective order, to the extent permitted by applicable law.

5. Audit and compliance

5.1 Audit rights. merchi.ai shall make available to Customer all information necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by Customer or an independent auditor mandated by Customer, subject to: (a) Customer giving merchi.ai reasonable notice (at least 30 days unless a shorter period is required by a Supervisory Authority); (b) audits being conducted during normal business hours and no more than once per calendar year (unless required by a Supervisory Authority or following a Personal Data Breach); (c) Customer and the auditor complying with merchi.ai’s reasonable security and confidentiality requirements; and (d) Customer bearing the cost of the audit unless the audit reveals a material breach by merchi.ai of this DPA, in which case merchi.ai shall reimburse Customer for the reasonable cost of the audit.

6. Liability and limitations

6.1 Liability under this DPA. Each party’s liability arising out of or related to this DPA (including breaches of Data Protection Laws in connection with the Processing described herein) shall be subject to the limitations and exclusions of liability set out in the Principal Agreement, and shall count towards (and not be in addition to) the aggregate liability caps in the Principal Agreement. Nothing in this DPA or the Principal Agreement shall limit or exclude either party’s liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot be limited or excluded under applicable law.

6.2 Fines and claims. Where a Supervisory Authority imposes a fine or penalty on Customer that is attributable to merchi.ai’s failure to comply with its obligations under this DPA, or to merchi.ai’s Processing of Personal Data outside or contrary to Customer’s lawful documented instructions, merchi.ai shall be liable to Customer for the amount of the fine or penalty to the extent that it is determined (by a court or the Supervisory Authority) to be merchi.ai’s responsibility, subject to the limitations of liability in the Principal Agreement.

7. Term and survival

7.1 This DPA remains in effect for so long as merchi.ai Processes Personal Data on behalf of Customer under the Principal Agreement, and thereafter until all Personal Data has been returned or deleted in accordance with Section 3.6.

7.2 Provisions that by their nature should survive (including Sections 3.6, 5, 6, and 7) shall survive termination or expiry of this DPA or the Principal Agreement.

8. Governing law and jurisdiction

This DPA is governed by the laws of England and Wales. The courts of England and Wales shall have exclusive jurisdiction to settle any dispute arising out of or in connection with this DPA, subject to the same exceptions (e.g. injunctive relief in other territories for confidentiality or IP) as set out in the Principal Agreement.

9. Order of precedence

In the event of any conflict or inconsistency between this DPA and the Principal Agreement in respect of the processing of Personal Data, this DPA shall prevail. In the event of any conflict between this DPA and any Standard Contractual Clauses or UK transfer addendum incorporated for international transfers, the clauses required by such transfer mechanism shall prevail in respect of that transfer.

10. Updates

merchi.ai may update this DPA from time to time on not less than 30 days’ notice to Customer, provided that no update shall materially reduce the protection of Personal Data.

ANNEX A – Processing details

Item	Description
Subject matter of Processing	Processing of Personal Data necessary to provide the Application Services (AI-powered product content generation, product data management, user authentication, configuration, support, and related functionality) as described in the Principal Agreement and User Guide.
Duration	For the duration of the Subscription Term and until return or deletion in accordance with the DPA.
Nature and purpose of Processing	Storage, hosting, transmission, analysis, and generation of content; user authentication and access control; support and troubleshooting; backup and disaster recovery; security and monitoring; and such other processing as is strictly necessary to perform the Application Services in accordance with Customer’s instructions.
Types of Personal Data	(a) Account and user data: name, email address, login credentials (passwords are hashed and stored by Supabase Auth; SSO account identifiers), IP address, and usage/log data in connection with the Application Services. (b) Product and content data: where Customer submits product data, spreadsheets, or URLs that contain or refer to individuals (e.g. contact names, endorsements), such data may constitute Personal Data. (c) URLs provided for scraping: URLs submitted by Customer for web scraping (e.g. product or brand pages) are processed to fetch and analyse content. The URLs themselves may in some cases constitute or reveal Personal Data (e.g. profile or account URLs); moreover, content scraped from those URLs may contain Personal Data (e.g. names, contact details, or endorsements on the scraped pages). Such URLs and the resulting scraped content are treated as Customer Data and, where they relate to identified or identifiable individuals, as Personal Data in accordance with this DPA. (d) Configuration and integration data: contact details, API keys or integration settings that identify individuals where applicable. The extent of Personal Data depends on what Customer submits; merchi.ai does not require Personal Data beyond what is necessary for account and access management and for providing the Application Services.
Categories of Data Subjects	(a) Customer’s authorised users (employees, contractors) who access the Application Services. (b) Any individuals whose Personal Data is included in Customer Data (e.g. contacts in product data, spreadsheets, or scraped content) where Customer has chosen to submit such data.
Sensitive or special category data	The Application Services are not intended for the processing of special category data (e.g. health, race, political opinions) or criminal offence data as defined in Data Protection Laws. Customer shall not submit such data unless separately agreed in writing and appropriate additional safeguards are in place.

ANNEX B – Subprocessors

merchi.ai uses the following named Subprocessors to provide the Application Services. This list may be updated from time to time; merchi.ai will notify Customer of material changes in accordance with Section 3.3(b).

Category	Purpose	Named Subprocessor	Location	Transfer mechanism (UK/EU → third country)
Cloud database & storage	Application database and storage	Supabase Inc. (Supabase Pte. Ltd.)	EU (AWS eu-central-1, Frankfurt)	EU SCCs (Module 3: Processor to Processor) incorporated into Supabase DPA; UK Addendum applies for UK GDPR. Supabase Inc. is a US entity and may access data remotely for support purposes; SCCs cover that access.
Application hosting	Web application hosting and serverless function execution	Vercel Inc.	EU (serverless functions); edge network global	EU SCCs (Module 3) + UK IDTA/Addendum; both included in Vercel Data Processing Addendum, available to Pro and Enterprise customers. Edge CDN nodes do not store Personal Data beyond transient request handling.
Authentication	User authentication and session management	Supabase Inc.	As per database row	As per database row
AI / content generation	Generative AI for product titles, descriptions, images and related content	OpenRouter Inc. (AI gateway); underlying model providers include Google LLC, Anthropic PBC and OpenAI Inc.	US	EU SCCs and UK Addendum incorporated into OpenRouter DPA (effective 26 August 2026). Zero Data Retention (ZDR) routing is enabled: prompts and completions are not stored by OpenRouter and are not transmitted to model providers for training. Underlying model providers each publish API-specific DPAs with SCCs/UK IDTA; merchi.ai accesses them via API only under those terms.
Background job processing	Asynchronous task orchestration (upload processing, AI calls, notifications)	Trigger.dev (API Hero Ltd)	UK company; data processed in AWS eu-central-1 (Frankfurt)	No restricted transfer for hosting: data is processed in the EEA, which has UK adequacy. Access by Trigger.dev from the UK is covered by the EU adequacy decision for the UK. Trigger.dev DPA applies on signup.
Web scraping	Retrieval of content from URLs provided by Customer	Bright Data Ltd	Israel (adequacy decision); infrastructure may include US and other regions	EU SCCs available under Bright Data DPA; adequacy decision applies for Israel as primary jurisdiction.
Email delivery	Transactional and notification emails to Customer users	Google Workspace (Gmail / Google SMTP)	EU (Google data centres); may route globally	EU SCCs incorporated into Google Workspace Data Processing Amendment; UK IDTA addendum available. Google acts as processor for email content sent on merchi.ai’s behalf.
Customer support	Support ticket management and customer communications; Customer users may submit personal data in support tickets	ClickUp Inc.	US	EU SCCs + UK Addendum incorporated into ClickUp Data Processing Agreement.

AI model data retention: merchi.ai accesses all AI model providers via API only, with Zero Data Retention routing enabled through OpenRouter. Customer Data and Output Data submitted via API are not used by model providers to train their foundation models, in accordance with each provider’s API-specific terms and OpenRouter’s ZDR policy. merchi.ai shall not configure the Application Services in a manner that would permit such training use.

Notes:

Vercel’s global edge network means end-user requests may be served from any region; no Personal Data other than IP addresses and request headers transits the CDN layer.
The DPA for each provider listed applies by virtue of account creation or the provider’s standard terms.
merchi.ai will notify Customer of any addition or replacement of a named Subprocessor in accordance with Section 3.3(b). Customer may request a copy of any provider’s DPA or transfer mechanism documentation by contacting privacy@merchi.ai.

ANNEX C – Security measures

merchi.ai has implemented the following technical and organisational measures in accordance with Section 3.2. merchi.ai may update these measures from time to time, provided that the overall level of security is not reduced.

Area	Measure
Encryption	All data is encrypted in transit using TLS. Data stored in the application database and storage is encrypted at rest using industry-standard encryption (AES-256).
Customer data isolation	Database row-level security ensures that each customer’s users can access only that customer’s data.
User authentication	Sign-in is handled by Supabase Auth using single sign-on (Google or Microsoft) or email and password. Passwords are stored only as one-way hashes.
Administrative access	Access to production systems and provider consoles (including database, hosting, source control and email) is restricted to authorised personnel on a least-privilege basis and protected by multi-factor authentication. Access is removed promptly when no longer required.
Logging and monitoring	Access to production systems is logged, and logs are reviewed as required, including following any suspected incident.
Backups and recovery	Automated daily backups of the application database are taken and retained in accordance with the database provider’s backup policy.
AI processing	AI requests are routed through OpenRouter with Zero Data Retention routing enabled. Model providers do not retain request data or use it to train their models.
Payment data	Card data is collected and processed directly by Stripe and is never stored on merchi.ai systems.
Subprocessors	Each Subprocessor is bound by a data processing agreement in accordance with Section 3.3.
Personnel	Everyone with access to Personal Data is bound by confidentiality obligations.
Incident response	Personal Data Breaches are handled and notified in accordance with Section 3.5.
Insurance	merchi.ai maintains cyber liability insurance.