Data Processing Addendum

Effective date: October 23, 2026

1. Parties and roles

This Data Processing Addendum ("DPA") forms part of the Terms & Conditions between the customer using the Selltics platform (the "Customer") and Individual Entrepreneur Myroshnichenko Dmytro, registered at 17 Tekstylna St., Bldg. 41, Kherson, Kherson District, Kherson Region, Ukraine ("Selltics"). For personal data the Customer submits to the Service, the Customer is the controller and Individual Entrepreneur Myroshnichenko Dmytro is the processor. "GDPR", "controller", "processor", "personal data", and "processing" have the meanings given in Regulation (EU) 2016/679.

2. Subject matter and duration

The subject matter of processing is the operation of the Selltics platform: ingesting, storing, and analysing Amazon advertising data, operating the Selltics AI assistant, and billing, as described in the Terms. Processing lasts for the duration of the agreement and ends with the deletion described in Section 10.

3. Categories of data and data subjects

• Data subjects: the Customer's users — account holders and the people they invite (for example, the Telegram users who talk to the AI assistant).
• Personal data: account identifiers (name, email address), Telegram chat IDs and usernames, messages exchanged with the AI assistant, billing ledger records, and payment records (amount, currency, provider order and payment id, status, timestamps). The billing address and tax id given at checkout are collected and held by Paddle, the merchant of record, not by Selltics.
• Authentication data: password hashes (argon2id; older bcrypt hashes until their next use); for Google sign-in, the Google account identifier, email address, name and Google's email-verified flag; the sign-up attestation (18 or over, business use); the encrypted authenticator (TOTP) secret and hashed recovery codes; session and trusted-device records with IP address and user agent; the consent record (accepted Terms and Privacy Policy versions, time, method, IP address, user agent); security audit events (sign-ins, lockouts, password and two-factor changes) with IP address and user agent; and an email delivery log holding a masked recipient address and its hash, never a message body.
• Not processed: buyer personal data. Advertising and order data is consumed in non-PII form — no buyer names, addresses, or other personal details of the Customer's end buyers.

4. Processing on documented instructions

Selltics processes personal data only on the Customer's documented instructions: the Terms, this DPA, and the configuration the Customer sets in the Service (the accounts connected, the profiles activated, the automations enabled, the questions asked). Activating a profile instructs Selltics to archive the performance records of every profile of its advertiser account, the profiles the Customer has not activated included, while at least one profile of that account stays activated; the records of a profile that is not activated are stored only, not shown in the Service and not used by any feature (Section 10). Selltics will inform the Customer if, in its view, an instruction infringes applicable data protection law, unless the law prohibits informing on important grounds of public interest.

5. Confidentiality

Persons authorised to process personal data — for Selltics, the operator described in the Information Security Policy — are bound to confidentiality by contract or statute. Subprocessors are bound by written data-protection obligations no less protective than this DPA.

6. Technical and organisational measures

The full description lives in the public Information Security Policy, which is incorporated into this DPA as its annex of technical and organisational measures. In summary:

• All public traffic enters through a single Cloudflare Tunnel, encrypted in transit (TLS 1.2+); no database or internal service has a public endpoint.
• Sign-in via email/password (argon2id-hashed; older bcrypt hashes are replaced at the next sign-in) or Google OAuth, protected by Turnstile challenges, per-IP rate limits, and Redis-backed brute-force lockouts; short-lived access tokens.
• A password policy of 12 to 128 characters with a breached-password check and no composition rules; a per-account lockout of 15 minutes after 10 consecutive failed attempts; server-side sessions that can be revoked; and two-factor authentication with an authenticator app (TOTP), mandatory for every account with a connected Amazon account and enforced server-side before an Amazon account is connected or reauthorized, and optional for other accounts.
• Per-service isolated databases, each with its own credentials; secrets kept only as encrypted SealedSecrets.
• GitOps deployment with human-gated promotion and immutable commit-SHA image tags; defined patch SLAs (critical ≤72 hours, high ≤14 days).
• Centralized logging with 30-day retention; logs exclude secrets, tokens, and customer data payloads.
• Nightly backups of the service databases on a 14-day rotation, with an exercised restore procedure. The time-series advertising-metrics store is additionally protected by a continuous raw-event archive to offsite object storage and a weekly full dump on a 28-day rotation: the rotation runs after each successful weekly dump and removes the dumps more than 28 days old, so while the weekly dumps succeed a dump is kept at most 35 days. The raw-event archive is partitioned per advertiser and marketplace, and its performance archive per advertiser account and profile. The records of activated profiles are kept indefinitely and deleted per customer on written request; the records of never-activated profiles are deleted 7 days after the last activated profile of the advertiser account is deleted (Section 10). Records that cannot be attributed to an advertiser and marketplace, and failed deliveries, are kept at most 21 days.

7. Subprocessors

The Customer gives general authorisation to the subprocessors listed below — the complete, current list.

This page is the notice. Before a subprocessor is added or replaced, the list below is updated and the effective date at the top of this page is moved forward, so the change is published here before it takes effect. Selltics does not announce subprocessor changes by email or in the product: this page, and not a message, is where the Customer sees the change. The Customer may object to a new subprocessor by writing to support@selltics.net; if an objection cannot be resolved, the Customer may terminate per the Terms.

Most recent change to this list: Google is no longer used as an LLM provider and remains a subprocessor only for OAuth sign-in and the support mailbox, and xAI was removed. DeepSeek is now the only LLM provider.

AI subprocessor: DeepSeek is the only LLM provider and the only AI subprocessor that processes prompts. Prompts contain only the minimum aggregated, non-PII metrics needed to answer, and DeepSeek is used under terms that prohibit training on submitted data. Prompts and tool results are also persisted for 30 days in the Selltics AI audit store — kept for billing and abuse review — and then pruned.

8. Assistance with data subject rights

Taking into account the nature of the processing, Selltics assists the Customer with appropriate technical and organisational measures in fulfilling data subject requests — access, rectification, erasure, restriction, portability, and objection. Requests that reach Selltics directly are forwarded to the Customer without undue delay; practical help goes through support@selltics.net.

9. Personal data breach notification

Selltics notifies the Customer without undue delay, and within 72 hours of becoming aware of a personal data breach affecting the Customer's data, with the information reasonably available: the nature of the breach, the categories and approximate number of data subjects and records affected, likely consequences, and the measures taken. The incident process behind this commitment is described in the Information Security Policy.

10. Deletion and return

On termination of the agreement, on account disconnect, or on written request, Selltics deletes the Customer's personal data from live databases within 30 days, unless law requires longer retention (for example, billing records). Backup generations containing the data are removed by the rotation that follows each successful nightly service-database dump once they are more than 14 days old, at most 16 days after the dump was taken while the nightly dumps succeed. Before deletion, the Customer may export its data or request a copy in a commonly used format.

Amazon Ads history is not covered by the paragraph above. The advertising metrics and catalog history collected from the Amazon Ads API and Amazon Marketing Stream, and the raw stream archive, are kept indefinitely for every profile the Customer has activated, so that the Customer can compare a period with the same period in earlier years. The original archive is partitioned per advertiser and marketplace; the performance archive is partitioned per advertiser account and profile. Termination, an Amazon Ads disconnect, or the deletion of a profile does not delete this history; a disconnect stops its collection, a profile deletion stops collection for that profile, and the deletion of the last activated profile of an advertiser account stops collection for the whole account. It is deleted on the Customer's written request, naming the profiles concerned, to support@selltics.net: within 30 days of the request, Selltics deletes it from the live databases and from the Customer's partitions of the raw archive. Archive records that cannot be attributed to an advertiser and marketplace, and failed deliveries, are not held per customer and are kept at most 21 days. A copy in the weekly dump of the time-series store is removed by the rotation that follows a successful weekly dump once it is more than 28 days old, at most 35 days after the dump was taken while the weekly dumps succeed.

The archived performance records of never-activated profiles — the profiles of an advertiser account that the Customer never activated (Section 4) — are deleted 7 days after the last activated profile of the advertiser account is deleted, unless a profile of that account is activated again within those 7 days. A written request for a profile that removes the last activated profile of its advertiser account also deletes, within the same 30 days, the archived records of the account's never-activated profiles; the history of the account's other activated profiles is kept until a written request names them.

Amazon Selling Partner data is handled differently: order data is read from Amazon through the Selling Partner API on each request and is not kept as a history, and disconnecting a Selling Partner account deletes its authorization token immediately.

Payment records are one such legally retained billing record: they are kept for as long as accounting and tax law requires; the invoice for each top-up is issued and held by Paddle, the merchant of record. The raw webhook body Paddle sends to confirm a payment is separate and short-lived — it is erased 90 days after it is received, leaving only the record that the event was received.

11. Audit rights

Selltics supports audits documentation-first: the public Information Security Policy, the pre-filled security questionnaire, and written answers to specific questions under this DPA are the first line of evidence. Where an audit or inspection is legally required and documentation is insufficient, the parties will agree its scope, timing, and confidentiality in advance; the Customer bears its own costs.

12. International transfers

Where processing involves a transfer of personal data to a country without an adequacy decision, the parties rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where UK GDPR applies), which are deemed incorporated into this DPA with the Customer as data exporter and Selltics as data importer. Subprocessor transfers are covered by equivalent safeguards in Selltics's agreements with them.

13. Liability

Liability under this DPA is subject to the limitations and exclusions of the Terms & Conditions; this DPA does not create a separate or additional cap. Nothing in this section limits liability that cannot be limited by law or a data subject's own statutory claims. This DPA is governed by the laws of Ukraine. Questions: support@selltics.net.