Legal

Data Processing Agreement

Rep's Data Processing Agreement

Last revised: October 28, 2026. Effective: for new customers, when they accept the Agreement; for existing customers, December 2, 2026.

This Data Processing Agreement (the "DPA") forms part of the Rep AI Terms of Service at https://www.hellorep.ai/terms-of-service---saas, or any other agreement between Rep AI Technologies, Inc. ("Rep AI") and the customer that uses the Services ("Customer") (in each case, the "Agreement"). It applies whenever Rep AI processes Customer Personal Data in providing the Services.

Customer accepts this DPA when it accepts the Agreement; no separate signature is needed. If Customer and Rep AI have signed a separate data processing agreement, that signed agreement applies in place of this DPA. If this DPA conflicts with the Agreement, this DPA controls with respect to the processing of Customer Personal Data. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses control.

Definitions

Capitalized terms not defined here have the meaning given in the Agreement.

"Applicable Data Protection Law" means all laws on privacy and the processing of personal data that apply to a party's processing of Customer Personal Data, which may include: the EU General Data Protection Regulation 2016/679 ("GDPR"); the GDPR as it forms part of UK law and the UK Data Protection Act 2018 ("UK GDPR"); the Swiss Federal Act on Data Protection ("FADP"); the California Consumer Privacy Act as amended, and its regulations ("CCPA"), and other U.S. state comprehensive privacy laws; and the Israeli Privacy Protection Law, 5741-1981 and its regulations.
"Customer Personal Data" means personal data (or personal information, as defined by Applicable Data Protection Law) contained in Customer Data that Rep AI processes on Customer's behalf in providing the Services, as described in Annex 1.
"Controller", "Processor", "Data Subject", "Processing", "Business", "Service Provider", "Sell" and "Share" have the meanings given in Applicable Data Protection Law. "Controller" includes a "Business", and "Processor" includes a "Service Provider".
"De-identified Data" means data derived from Customer Personal Data that does not identify, and cannot reasonably be used to identify or be linked to, a Data Subject or Customer, and that meets the de-identification standard of Applicable Data Protection Law.
"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by Rep AI or its Sub-processors.
"Shopper" means a visitor to, or customer of, Customer's online store who interacts with the Services.
"Standard Contractual Clauses" means the clauses annexed to European Commission Implementing Decision (EU) 2021/914; "UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.
"Sub-processor" means a third party that Rep AI engages to process Customer Personal Data on Customer's behalf.
"Privacy Policy" means the Rep AI Platform Privacy Policy at https://www.hellorep.ai/legal/platform-privacy-policy.

Roles and scope

Customer as controller. For Customer Personal Data, Customer is the Controller and Rep AI is its Processor. Where Customer acts as a processor on behalf of a third-party controller, Rep AI is Customer's sub-processor, and Customer is responsible for obtaining that controller's authorizations.

Rep AI as controller of account data. Rep AI processes the personal data of Customer's own users of the Console and Rep Inbox, and of Customer's business contacts, as a controller to run Customer's account, bill for the Services, provide support and keep the Services secure, as described in the Privacy Policy. That processing is not covered by this DPA.

Details of processing. The subject matter, nature, purpose and duration of the processing, and the categories of Data Subjects and personal data, are described in Annex 1.

Customer instructions

Rep AI will process Customer Personal Data only on Customer's documented instructions, unless the law requires otherwise, in which case Rep AI will tell Customer before processing unless the law prohibits it. Customer's instructions are: the Agreement and this DPA; Customer's configuration and use of the Services, including the integrations, channels and features it enables; and any other written instructions that the parties agree. Rep AI will tell Customer if, in its opinion, an instruction violates Applicable Data Protection Law.

Customer-directed disclosures. When Customer connects its own tools to the Services, such as its e-commerce platform, help desk, email marketing tool, messaging accounts or an AI assistant connected through Rep AI's connector, Rep AI sends Customer Personal Data to those tools on Customer's instruction. Those tools are Customer's own vendors, not Rep AI's Sub-processors, and their processing is governed by Customer's agreements with them.

Customer's responsibilities. Customer is responsible for the lawfulness of its instructions and of the Customer Personal Data it provides or makes available. Customer will give Shoppers the notices, and obtain the consents, that Applicable Data Protection Law and other applicable law require for the processing described in this DPA, including consent to the recording of their conversations and, where required, disclosure that they are interacting with an AI assistant.

U.S. state privacy law terms

Where the CCPA or another U.S. state privacy law applies, Rep AI acts as Customer's Service Provider (or Processor) and will not:

Sell or Share Customer Personal Data;
retain, use or disclose Customer Personal Data for any purpose, including any commercial purpose, other than the business purposes of providing the Services described in the Agreement and Annex 1, or as otherwise permitted by the CCPA for service providers;
retain, use or disclose Customer Personal Data outside the direct business relationship between Rep AI and Customer; or
combine Customer Personal Data with personal data Rep AI receives from or on behalf of another person, or collects from its own interactions with a consumer, except as the CCPA permits.

Rep AI will comply with the obligations that apply to it under the CCPA, provide the same level of privacy protection the CCPA requires of businesses, and notify Customer if it determines it can no longer meet those obligations. Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data, including under the Audits section. Rep AI certifies that it understands and will comply with the restrictions in this section.

De-identified data and AI models

Rep AI may create De-identified Data from Customer Personal Data and use it to operate, analyze, secure and improve the Services. Rep AI will maintain De-identified Data in de-identified form, will not attempt to re-identify it, and will contractually require any recipient of it to do the same. De-identified Data is not Customer Personal Data.

Rep AI does not use Customer Personal Data, including Shoppers' photos and videos, to train its own or third-party foundation models. Rep AI's agreements with its AI model Sub-processors prohibit them from using Customer Personal Data to train their models; those providers may keep a temporary copy for a limited period, as described in the Retention and deletion section, to detect abuse.

Confidentiality and personnel

Rep AI will keep Customer Personal Data confidential and will give access to it only to personnel and contractors who need it to provide the Services, who are bound by written confidentiality obligations, and who receive appropriate privacy and security training.

Sub-processors

Authorization. Customer gives Rep AI general authorization to engage Sub-processors. The Sub-processors in use on the date above are listed in Annex 3, and the current list is published in the Service providers section of the Privacy Policy.

Sub-processor terms. Rep AI will enter into a written agreement with each Sub-processor that imposes data protection obligations no less protective of Customer Personal Data than those in this DPA, to the extent appropriate to the service the Sub-processor provides. Rep AI remains responsible to Customer for its Sub-processors' performance of those obligations.

Changes. Rep AI will give Customer at least thirty (30) days' notice before a new or replacement Sub-processor begins processing Customer Personal Data, by email to Customer's account owner or by notice in the Console, stating the Sub-processor's name, location and the processing it will perform. Where a change is urgently needed to protect the security or continuity of the Services, Rep AI may make it sooner and will give notice as soon as practicable.

Objections. Customer may object to a new Sub-processor on reasonable data protection grounds by emailing dpo@hellorep.ai within fourteen (14) days after the notice. The parties will discuss the objection in good faith. If they cannot resolve it within thirty (30) days, Customer may terminate the affected Services by written notice, and Rep AI will refund any prepaid fees for the period after termination.

International transfers

Locations. Rep AI stores Customer Personal Data in the United States. Rep AI personnel and affiliates, including in Israel, and the Sub-processors listed in Annex 3 may access or process it from other countries.

EU transfers. To the extent Customer Personal Data subject to the GDPR is transferred to a country that has not received an adequacy decision, the Standard Contractual Clauses are incorporated into this DPA and apply as follows: Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor; Customer is the data exporter and Rep AI is the data importer; Clause 7 (docking clause) applies; in Clause 9, Option 2 (general written authorization) applies, with the notice period set out in the Sub-processors section; the optional language in Clause 11 does not apply; in Clause 13, the competent supervisory authority is the one determined under that clause; in Clauses 17 and 18, the clauses are governed by Irish law and disputes are resolved by the courts of Ireland; and Annexes I, II and III of the Standard Contractual Clauses are completed by Annexes 1, 2 and 3 of this DPA.

UK transfers. For transfers subject to the UK GDPR, the Standard Contractual Clauses apply as modified by the UK Addendum, which is incorporated into this DPA. Tables 1 to 3 of the UK Addendum are completed with the information in this DPA and its Annexes, and either party may end the UK Addendum as set out in its Section 19.

Swiss transfers. For transfers subject to the FADP, the Standard Contractual Clauses apply with these changes: references to the GDPR are to the FADP; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; and the term "member state" does not exclude Data Subjects in Switzerland from bringing claims in their place of habitual residence.

Israeli transfers. Transfers of Customer Personal Data subject to Israeli law are made in accordance with the Protection of Privacy Regulations (Transfer of Data to Databases Outside the Borders of the State), 5761-2001.

Adequacy. Transfers to a country covered by an adequacy decision under the applicable law, including Israel and, for certified recipients, the United States under the EU-U.S. Data Privacy Framework, may rely on that decision instead of the mechanisms above.

Government requests. If Rep AI receives a request from a public authority for Customer Personal Data, it will notify Customer unless the law prohibits it, will challenge the request where it has reasonable grounds to consider it unlawful, and will disclose only the minimum data required.

Security

Rep AI will implement and maintain the technical and organizational measures described in Annex 2, which are designed to protect Customer Personal Data against Security Incidents and are appropriate to the risk of the processing. Rep AI may update those measures from time to time, provided the updates do not materially reduce the overall protection of Customer Personal Data.

Security incidents

Rep AI will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Security Incident. The notice will describe, to the extent known, the nature of the incident, the categories and approximate number of Data Subjects and records affected, its likely consequences, and the measures taken or proposed to address it, and Rep AI will provide further information as it becomes available. Rep AI will take reasonable steps to contain and remediate the incident, cooperate with Customer's investigation, and give Customer the information it reasonably needs to meet its own notification obligations. Rep AI will not name Customer in any public statement about a Security Incident without Customer's approval, except as required by law. Notice of a Security Incident is not an acknowledgment of fault or liability.

Data Subject requests and assistance

The Services let Customer access, export and delete Customer Personal Data, including deleting all data about a specific Shopper. If Rep AI receives a request from a Data Subject that identifies Customer, it will forward the request to Customer or help Customer respond to it, and will not otherwise respond except to direct the Data Subject to Customer, unless Customer authorizes it or the law requires it. Taking into account the nature of the processing, Rep AI will provide reasonable assistance to Customer in responding to Data Subject requests, in carrying out data protection impact assessments, and in consultations with supervisory authorities, to the extent Customer cannot do so using the Services.

Retention and deletion

During the term. Rep AI retains Customer Personal Data for the periods described in the Privacy Policy, and deletes it earlier on Customer's instruction given through the Services or by email to dpo@hellorep.ai.

After termination. Within ninety (90) days after Customer's account is closed, Rep AI will delete Customer Personal Data, including Shopper conversations, the assistant's memory of Shoppers, and store data synced from Customer's e-commerce platform. Customer may export its data before its account closes. On Customer's written request, Rep AI will confirm the deletion in writing.

Copies that expire on a schedule. The following copies are not deleted individually and instead expire on the schedule below: backups, within fourteen (14) days; analytics copies, within one hundred (100) days for activity events, four hundred (400) days for session behavior summaries, and about thirteen (13) months for conversation archives; system logs and AI quality traces, within twelve (12) months; and temporary copies kept by AI model Sub-processors under their terms, generally up to thirty (30) days. Rep AI may also keep Customer Personal Data where the law requires it. Rep AI will continue to protect any retained copies under this DPA and will not actively process them for any other purpose.

Audits

Rep AI will make available to Customer the information reasonably necessary to demonstrate its compliance with this DPA, including responses to Customer's security and privacy questionnaires and any third-party audit reports or certifications Rep AI holds, no more than once in any twelve (12) month period unless a Security Incident or a supervisory authority requires otherwise. If that information is not sufficient to demonstrate compliance, or a supervisory authority requires it, Customer may, at its own expense, have an independent auditor reasonably acceptable to Rep AI and bound by confidentiality obligations audit Rep AI's compliance with this DPA, on at least thirty (30) days' notice, during business hours, without access to other customers' data, and no more than once in any twelve (12) month period. Audits under the Standard Contractual Clauses are carried out in accordance with this section.

Liability

Each party's liability arising out of or relating to this DPA, including under the Standard Contractual Clauses, is subject to the limitations and exclusions of liability in the Agreement, applied in the aggregate across the Agreement and this DPA. Nothing in this section limits a Data Subject's rights under the Standard Contractual Clauses or a party's liability where Applicable Data Protection Law does not allow it to be limited.

Term, changes and governing law

Term. This DPA applies for as long as Rep AI processes Customer Personal Data, and the sections on Confidentiality and personnel, Security, Security incidents, Retention and deletion and Liability survive until that data is deleted.

Changes. Rep AI may update this DPA in the same way, and with the same notice, as it may update the Agreement. An update will not materially reduce the protection of Customer Personal Data unless Applicable Data Protection Law requires it.

Governing law. This DPA is governed by the law and courts specified in the Agreement, except that the Standard Contractual Clauses and the UK Addendum are governed by the law and courts specified in them.

Contact. Rep AI's privacy contact is dpo@hellorep.ai, Rep AI Technologies, Inc., 85 Broad Street, New York, NY 10004, United States. Rep AI will send notices under this DPA to the email address of Customer's account owner.

Annex 1: Details of processing

Data exporter. Customer, as identified in its Rep AI account. Role: controller (or processor, where Customer processes on behalf of a third-party controller). Contact: the account owner's email address. Activities: use of the Services described in the Agreement.

Data importer. Rep AI Technologies, Inc., 85 Broad Street, New York, NY 10004, United States. Role: processor (or sub-processor). Contact: dpo@hellorep.ai. Activities: providing the Services described in the Agreement.

Categories of Data Subjects. Shoppers who interact with the Services, through Customer's website chat or through channels Customer connects, such as email, WhatsApp, Instagram and Facebook Messenger; and Customer's own staff, to the extent their names or messages appear in conversations and support tickets handled through the Services.

Categories of personal data.

Shopper messages and the assistant's replies, including voice notes and their text transcripts.
Photos, videos and files Shoppers send, and virtual try-on images created from Shoppers' photos.
Details Shoppers choose to share, such as name, email address, phone number, shipping address and order number.
Order and account data Customer's e-commerce platform makes available, such as order status, order history and loyalty status.
Shopping activity on Customer's store while the chat is available, such as pages and products viewed, items added to the cart, and counts of page interactions.
Technical data, such as browser and device type, language, IP address, approximate location (country or city), the current page and a chat session identifier.
The assistant's memory of each Shopper's earlier conversations with Customer's store.
Labels the Services assign to conversations, such as topic and the Shopper's apparent mood.
Support tickets, emails and attachments handled in Rep Inbox.
Any of the above that an AI assistant connected by Customer reads through Rep AI's connector, within the permissions Customer grants.

Sensitive data. The Services are not designed to process special categories of personal data or sensitive personal information, and Customer will not configure them to request it. Shoppers' photos are used only to fulfil their requests, such as virtual try-on, and are not used to identify individuals or to create biometric identifiers.

Frequency of transfer. Continuous, for as long as Customer uses the Services.

Nature of the processing. Collection, storage, retrieval, analysis by AI models (generating replies, understanding images, videos and voice notes, generating try-on images, and creating search embeddings), organization, transmission to Customer and to the tools Customer connects, and deletion.

Purposes of the processing. To provide the Services to Customer: answering Shoppers' questions, recommending products, helping with orders, returns and exchanges, creating try-on images, remembering earlier conversations with the same store, handing conversations over to Customer's support team, giving Customer conversation history, analytics and insights, and keeping the Services secure and measuring and improving the quality of their answers.

Duration and retention. For the term of the Agreement and the periods in the Retention and deletion section.

Transfers to Sub-processors. As described in Annex 3, for the same nature, purposes and duration as above.

Competent supervisory authority. As determined under Clause 13 of the Standard Contractual Clauses.

Annex 2: Technical and organizational security measures

Security program. Rep AI maintains a written information security program with a designated owner, aligned with recognized industry frameworks, and reviews it periodically.
Access control. Access to production systems and Customer Personal Data is limited to personnel who need it, through individual accounts. Multi-factor authentication is required for cloud console and administrative access. Access is reviewed periodically and removed promptly when a person leaves or changes role.
Encryption. Customer Personal Data is encrypted in transit over public networks using TLS and encrypted at rest using AES-256 in Rep AI's cloud storage and database services.
Shopper media. Photos, videos and files Shoppers send are stored in private storage and shown only through signed links that expire.
Environment separation. Production systems are separated from development and test environments, and network access to production is restricted by firewall rules and security groups.
Logging and monitoring. System, authentication and administrative activity is logged and monitored for errors and suspicious activity. Logs are kept for the periods in the Retention and deletion section.
Vulnerability management. Rep AI scans its code dependencies and systems for known vulnerabilities and applies security patches, prioritizing critical issues.
Backups and continuity. Databases are backed up automatically, backups are encrypted and expire within fourteen (14) days, and Rep AI maintains procedures to restore service.
Personnel. Personnel with access to Customer Personal Data are bound by confidentiality obligations and receive security and privacy training.
Sub-processor management. Rep AI reviews the security and privacy terms of its Sub-processors before engaging them.
Data subject rights and deletion. The Services provide tools for Customer to export Customer Personal Data and to delete all data about a specific Shopper.
Incident response. Rep AI maintains a procedure for investigating, containing and notifying Security Incidents, as set out in the Security incidents section.

Annex 3: Sub-processors

This list covers Sub-processors of Customer Personal Data. The Privacy Policy also lists providers that process only Customer's account data, such as Stripe for billing and Google Analytics for Console analytics; they do not process Customer Personal Data and are not listed here.

Amazon Web Services, Inc. (including Amazon Bedrock): Hosting, storage, email delivery, AI quality monitoring, and AI models for virtual try-on. Location: United States.
MongoDB, Inc. (MongoDB Atlas): Database hosting, on AWS. Location: United States.
Google LLC (Gemini API): AI models for replies, for understanding photos, videos and voice notes, and for virtual try-on. Location: United States; may process in other regions.
OpenAI, LLC: AI models for replies and virtual try-on. Location: United States; may process in other regions.
Microsoft Corporation (Azure OpenAI Service): AI models for replies. Location: United States.
Anthropic, PBC: AI models, as a backup provider. Location: United States; may process in other regions.
Cloudflare, Inc. (Workers AI): AI model that ranks product search results. Location: United States and other regions.
Cohere Inc.: Text embeddings for product and content search. Location: United States.
Logz.io Ltd.: System logs and monitoring. Location: United States.