Data Processing Addendum

1. Scope and roles

This DPA supplements the Terms when a customer subject to data-protection law uses SellerPilot to process Etsy shop data. The customer is the controller/business and SellerPilot is the processor/service provider for that data. SellerPilot remains controller for its own account, security and consented website analytics data.

2. Instructions and purpose

SellerPilot processes shop, listing, receipt, transaction, settlement and seller-cost information only to provide, secure, support and maintain the requested service, and only for the duration of the customer’s use and legally required retention. The Terms, product settings and documented support requests are the customer’s instructions.

3. Confidentiality and security

Persons authorized to process customer data are subject to confidentiality. Measures include encrypted Etsy credentials, hashed authentication tokens, workspace-scoped access, secure cookies, provider access controls, backups and incident/error minimization.

4. Subprocessors

• Vercel — hosting, application delivery and coarse request country metadata.
• Neon — managed PostgreSQL database infrastructure.
• Resend — requested authentication and service email delivery.
• A future payment provider is not active and will be added before paid processing begins.

5. Assistance and incidents

Taking account of the processing, SellerPilot will reasonably assist with data-subject requests, security obligations and required assessments. SellerPilot will notify affected customers without undue delay after becoming aware of a confirmed personal-data breach, providing available information needed for legal obligations.

6. Deletion, return and audits

On termination or verified request, SellerPilot will delete or return customer data unless law requires retention, subject to ordinary backup rotation. SellerPilot will provide information reasonably necessary to demonstrate compliance. Audits must protect other customers, security and confidential information and should first use available documentation.

7. International transfers

Where restricted data is transferred internationally, the parties will use an applicable adequacy decision, approved contractual clauses or another lawful safeguard. Contact SellerPilot for available provider transfer documentation.

8. Processing details

• Subjects: Etsy seller/account users and limited order metadata; normalized records intentionally exclude buyer contact details.
• Data: account identifiers, shop/listing/order/payment metadata, destination country, seller costs, settings and support records.
• Operations: collection from authorized APIs, storage, organization, calculation, display, support, backup and deletion.
• Frequency and duration: as initiated by the customer during workspace use and retained according to the Privacy Policy.

9. Contact

DPA questions or signature requests: contact@sellerpilotapp.com.