Legal & Compliance Documentation

Realify Data Processing Addendum (DPA)

Legal agreement governing the processing of customer personal data, sub-processor authorizations, incident notifications, and platform compliance.

Effective: June 1st, 2026

Controller / EntityRealify.ai Inc (Delaware File No. 10409872)

Address28 Geary St STE 650 494, San Francisco, CA 94108

Development CenterRealify AI India Pvt Ltd

Legal Contactlegal@realify.ai

DPA Scope & Precedence

This DPA is incorporated into and forms part of the Realify Terms of Service between Realify.ai, a Delaware corporation (File No. 10409872) with its principal business address at 28 Geary St STE 650 494, San Francisco, CA 94108 ("Processor"), and the Customer ("Controller"). It governs Realify's processing of personal data on the Controller's behalf, including data accessed through Connected Platforms. In any conflict with the Terms of Service regarding personal data processing, this DPA controls.

01Roles and Scope

Controller / Business: Customer is the data controller (GDPR) and business (CCPA/CPRA) for Customer Personal Data.

Processor / Service Provider: Realify processes Customer Personal Data solely on Customer's documented instructions to provide the Services.

"Customer Personal Data": The subset of Customer Data (as defined in the Terms of Service) that constitutes personal information under applicable law.

Purpose & Duration: Providing unified commerce analytics, AI-driven recommendations, and multi-channel automation through the Services. Processing continues for the Services term and up to 30 days thereafter.

02Processing Instructions

Realify processes Customer Personal Data only: (a) per Customer's documented instructions (Terms of Service, Order Form); (b) as necessary to provide the Services; (c) as required by applicable law (with notice to Customer to the extent permitted). Customer is responsible for ensuring instructions are lawful and that Customer has a valid legal basis for processing.

03CCPA Service Provider Certification

This section constitutes Realify's service provider certification for personal information of California residents processed on Customer's behalf under CCPA / CPRA.

Realify certifies that it:

(a) Processes personal information only for the Services described in the Terms of Service and this DPA
(b) Does not sell or share Customer Personal Data for cross-context behavioral advertising
(c) Does not use Customer Personal Data outside the direct business relationship with Customer
(d) Understands and complies with CCPA/CPRA service provider restrictions
(e) Will notify Customer if it can no longer meet these obligations and will cooperate with remediation

Realify will assist Customer in fulfilling consumer rights requests (know, delete, correct, opt-out) for Customer Personal Data stored in the Services.

04GDPR and International Transfer Obligations

US-Only Customer Base: Realify currently serves customers exclusively in the United States and does not actively process personal data of EEA, UK, or Swiss data subjects. This section is documented for regulatory completeness and future use, and will become operative if and when Realify expands to serve EU, UK, or Swiss customers.

For future processing of EEA, UK, or Swiss personal data: EU-US DPF framework (dataprivacyframework.gov), EU SCCs (Module 2), UK Addendum, Swiss adaptations, and Schrems II safeguards. Contact legal@realify.ai.

05Security

Realify implements the technical and organizational measures set out in Privacy Policy Section 7, incorporated here by reference. These measures — encryption, access controls, password policy, audit logging, DLP, network security, vulnerability management, secure coding, incident response, and backup/DR — apply to all Customer Personal Data. Enterprise customers may request the penetration test executive summary under NDA.

With respect to cross-border access by personnel of Realify technical affiliate, Realify AI India Private Limited, the mandatory controls governing that access — including VDI requirements, DLP enforcement, PII masking, and immutable audit logging — are set out in Privacy Policy Section 5.1 (Security) and are incorporated into this DPA in full.

06Sub-Processors

Customer authorises Realify to engage the subprocessors listed in Privacy Policy Section 6 (realify.ai/privacy#section-06). All sub-processors are bound by DPAs no less protective than this DPA. Realify provides 30 days' advance notice of new sub-processors; Customer may object in writing. Unresolved objections within 30 days allow Customer to terminate affected Services without penalty.

Pre-Onboarding: Documented security assessment covering SOC 2, ISO 27001, data residency, breach commitments & Amazon DPP §4.7 compliance.

Annual Reviews: Risk assessments available under NDA and to Amazon for Amazon Info sub-processors.

Remediation: Material non-compliance triggers remediation timeline or sub-processor suspension.

07Data Subject Rights and Confidentiality

Realify provides reasonable assistance to help Customer respond to data subject rights requests under GDPR, CCPA/CPRA, and applicable state privacy laws, forwarding direct requests from individuals to Customer within 5 business days. All Realify personnel with access to Customer Personal Data are bound by confidentiality obligations by contract or professional duty. Realify conducts background checks on such employees to the extent permitted by applicable law.

08Security Incident Notification

Amazon SP-API Information: Realify notifies Amazon at security@amazon.com within 24 hours of detection, before any public disclosure (Amazon DPP §1.6). Affected sellers notified simultaneously.

Amazon Advertising API data: Realify notifies affected Customers within 24 hours of detection and cooperates with Amazon's advertising compliance review process.

Google Ads API data: Realify notifies affected Customers within 24 hours of detection and cooperates with Google's compliance review process.

Meta Marketing API data: Realify notifies affected Customers within 24 hours of detection and cooperates with Meta's data-incident review process.

Shopify API data: Realify notifies the affected Merchant and Shopify within 72 hours of confirmed discovery under Partner Program Agreement breach notification requirements.

All Customer Personal Data: Realify notifies Customer within 72 hours of confirmed discovery (or 24h for platform data).

Notification content & Cooperation: Notice states nature, scope, records affected, likely consequences, measures taken, and IR contact. Realify preserves forensic evidence and maintains incident records available on request.

09Audit Rights

On 30 days' prior written notice, Realify makes available information necessary to demonstrate DPA compliance, including certifications, audit reports, and third-party assessments. Realify supports audits by Customer or a designated auditor subject to reasonable confidentiality protections and agreed scope. Audit costs are borne by Customer.

10Return and Deletion

On termination, Realify deletes or returns Customer Personal Data within 30 days at Customer's election. For Amazon Information, deletion follows Privacy Policy Section 5.1 (live systems: 7 business days; backups: 30 days; certificate: 35 days; NIST SP 800-88 Rev. 1). Non-Amazon backup copies purged within 90 days. Written confirmation on request.

11Amazon SP-API — Consolidated Compliance Reference

This section provides a consolidated reference for Amazon's review. All obligations are required by the Amazon SP-API Developer Agreement, Data Protection Policy, and Acceptable Use Policy. In any conflict, the more restrictive obligation governs.

Obligation	Standard
Authorized use only	Amazon Information used solely to provide the Services to the authorizing seller.
No AI/ML training	Absolute prohibition — any form, identifiable, de-identified, or aggregated.
No cross-seller aggregation	Absolute prohibition.
No Amazon business insights	AUP §4.5.
Retention — PII	30-day hard limit.
Retention — Non-PII live	30-day hard limit.
Retention — Non-PII archive	18-month hard limit.
Deletion	NIST SP 800-88 Rev. 1; written certificates; on-demand deletion within 35 days.
Encryption	AES-256 at rest; TLS 1.2+ in transit; AWS KMS.
Access	RBAC; least privilege; mandatory MFA; quarterly reviews; comprehensive audit logging.
Breach notification	Amazon at security@amazon.com within 24 hours.
Suspected violations	Amazon at spapi-abuse@amazon.com; customer access may be suspended (AUP §1.3).
Sub-processor diligence	Per Section 6; documentation available to Amazon on request.

12Priority

This DPA prevails over the Terms of Service in the event of any conflict regarding Customer Personal Data processing.

Obligation

Standard

Authorized use only

Amazon Information used solely to provide the Services to the authorizing seller.

No AI/ML training

Absolute prohibition — any form, identifiable, de-identified, or aggregated.

No cross-seller aggregation

Absolute prohibition.

No Amazon business insights

AUP §4.5.

Retention — PII

30-day hard limit.

Retention — Non-PII live

30-day hard limit.

Retention — Non-PII archive

18-month hard limit.

Deletion

NIST SP 800-88 Rev. 1; written certificates; on-demand deletion within 35 days.

Encryption

AES-256 at rest; TLS 1.2+ in transit; AWS KMS.

Access

RBAC; least privilege; mandatory MFA; quarterly reviews; comprehensive audit logging.

Breach notification

Amazon at security@amazon.com within 24 hours.

Suspected violations

Amazon at spapi-abuse@amazon.com; customer access may be suspended (AUP §1.3).

Sub-processor diligence

Per Section 6; documentation available to Amazon on request.