Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of, and is governed by, the FoxtrotAI Terms of Service or other written agreement (the "Agreement") between FoxtrotAI LLC ("FoxtrotAI," "Processor," or, for CCPA purposes, "Service Provider") and the customer that accepts the Agreement ("Customer," "Controller," or "Business"). It applies to FoxtrotAI's Processing of Customer Personal Information and Amazon Information in the course of providing the Services. If there is a conflict between this DPA and the Agreement regarding data protection, this DPA controls.

Scope. FoxtrotAI is a U.S.-only, business-facing service and does not intend to Process the personal data of individuals in the EEA/UK. The GDPR-style terms below are included so the DPA is complete for any enterprise Customer that requires them; the operative regime for most Customers is the CCPA/CPRA service-provider framework.

1. Definitions

• "Applicable Data Protection Law" means all privacy and data-protection laws applicable to a party's Processing under this DPA, including the California Consumer Privacy Act as amended by the CPRA ("CCPA") and, where applicable, the EU/UK GDPR.
• "Amazon Information" means information FoxtrotAI obtains through the Amazon Ads API or Amazon Selling Partner API (SP-API) on Customer's authorization, and information derived from it that identifies Amazon, Customer's Amazon account, or Customer's listings.
• "Customer Personal Information" means personal information within Customer Data that FoxtrotAI Processes on Customer's behalf (e.g., business-contact identifiers Customer provides).
• "Process," "Controller," "Processor," "Business," "Service Provider," "Sell," "Share," and "Consumer" have the meanings given under Applicable Data Protection Law.
• "Subprocessor" means a third party engaged by FoxtrotAI to Process Customer Personal Information or Amazon Information.

2. Roles and Scope

For Customer Personal Information, Customer is the Controller/Business and FoxtrotAI is the Processor/Service Provider, Processing only on Customer's documented instructions. The subject matter, duration, nature, purpose, data types, and data subjects are described in Annex A. For Amazon Information, FoxtrotAI acts as an authorized developer/service provider Processing at Customer's direction and within Amazon's applicable API terms and Data Protection Policy ("DPP").

3. Processing Instructions; Purpose Limitation

FoxtrotAI will Process Customer Personal Information and Amazon Information only (a) to provide, secure, maintain, support, and administer the Services requested by Customer; (b) as further documented in the Agreement and this DPA; and (c) as required by law, in which case FoxtrotAI will inform Customer unless legally prohibited. FoxtrotAI will not Process such data for any other purpose, and will notify Customer if it can no longer meet its obligations under Applicable Data Protection Law.

4. CCPA Service-Provider Certification

FoxtrotAI certifies that, with respect to Customer Personal Information disclosed by Customer, it:

• does not Sell or Share the information;
• does not retain, use, or disclose it except as necessary to perform the Services (the business purpose) or as permitted by the CCPA;
• does not retain, use, or disclose it outside the direct business relationship with Customer;
• does not combine it with personal information from other sources, except as the CCPA permits for a service provider; and
• will comply with applicable CCPA obligations and provide the same level of privacy protection as the CCPA requires of a business.

5. Amazon Information — Special Terms

• Purpose limitation. FoxtrotAI uses Amazon Information solely to provide the authorized Services to the authorizing advertiser or selling partner (campaign management, reporting, bid/budget optimization, seller-authorized pricing updates, inventory-aware pacing, security, support, and audit).
• No model training; no cross-customer use. FoxtrotAI will not use Amazon Information to develop, train, fine-tune, evaluate, benchmark, or improve generalized machine-learning or AI models, will not use one customer's Amazon Information for another's benefit or to build cross-customer profiles, and will not use it to operate non-Amazon products or advertising platforms, to market, or as collateral. Automated narrative generation (X-Ray) runs open-weight models within FoxtrotAI's AWS environment; Amazon Information is not shared with any external model vendor and is not used to train any model.
• No buyer PII. FoxtrotAI does not request, access, or store Amazon buyer personally identifiable information.
• Amazon incident reporting. FoxtrotAI will report Security Incidents involving Amazon Information to Amazon (security@amazon.com) without unreasonable delay and within 24 hours of confirmed detection, subject to the law-enforcement/exacerbation exception in FoxtrotAI's Privacy Policy.
• Deletion. FoxtrotAI will delete Amazon Information and revoke stored authorization tokens on disconnection or verified request as described in Section 11 and its Privacy Policy.

6. Confidentiality

FoxtrotAI ensures that personnel authorized to Process the data are bound by confidentiality obligations and access it only on a need-to-know basis under least-privilege controls.

7. Security Measures

FoxtrotAI maintains the technical and organizational measures described in Annex B, including encryption in transit (TLS 1.2+) and at rest (AES-256), least-privilege role-based access, MFA for administrative access, private network segmentation, secure secrets management, logging, and monitoring, appropriate to the risk.

8. Subprocessors

• Customer authorizes FoxtrotAI to engage the Subprocessors listed in Annex C. FoxtrotAI imposes on each Subprocessor written obligations no less protective than this DPA (including, where Amazon Information is Processed, Amazon-DPP-consistent terms) and remains responsible for its Subprocessors' performance.
• FoxtrotAI will give Customer notice before adding or replacing a Subprocessor that Processes Customer Personal Information or Amazon Information; Customer may object on reasonable data-protection grounds, and if the parties cannot resolve the objection, Customer may terminate the affected Services.

9. Assistance with Rights Requests

Taking into account the nature of the Processing, FoxtrotAI will provide reasonable assistance to enable Customer to respond to Consumer/data-subject requests (access, deletion, correction, opt-out) and to meet Customer's obligations under Applicable Data Protection Law, including data-protection impact assessments and consultations where applicable.

10. Personal Data Breach Notification

FoxtrotAI will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Information, with information reasonably available to help Customer meet its notification obligations, and will take reasonable steps to mitigate and remediate. This is in addition to FoxtrotAI's separate obligation to notify Amazon under Section 5.

11. Deletion and Return

On expiry or termination, or on Customer's verified request, FoxtrotAI will delete or return Customer Personal Information and delete Amazon Information and revoke stored authorization tokens, except for copies required to be retained by law or for limited security, fraud-prevention, billing, or audit purposes, which remain subject to this DPA. Token deletion occurs immediately on disconnection; other deletion occurs within a commercially reasonable period; encrypted backups expire on their normal lifecycle.

12. Audit and Information

FoxtrotAI will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by Customer or an auditor Customer mandates, on reasonable prior notice, no more than once per year absent a Personal Data Breach or regulator requirement, subject to confidentiality and FoxtrotAI's security policies.

13. International Transfers

FoxtrotAI Processes and stores data in the United States. FoxtrotAI does not intend to Process EEA/UK personal data; if it does for a particular Customer, the parties will put in place an appropriate transfer mechanism (e.g., the EU Standard Contractual Clauses / UK Addendum), which are incorporated by reference to the extent applicable.

14. Liability

Each party's liability under or in connection with this DPA is subject to the exclusions and limitations of liability in the Agreement.

15. Term; Precedence; Governing Law

This DPA is effective for as long as FoxtrotAI Processes the data and survives termination until deletion is complete. It supplements and, on data-protection matters, prevails over the Agreement. It is governed by the laws of the State of New Jersey, consistent with the Agreement.

Annex A — Details of Processing

• Subject matter: Provision of the FoxtrotAI Services (joint Amazon pricing and advertising optimization, reporting, and the X-Ray assessment).
• Duration: For the term of the Agreement and until deletion under Section 11.
• Nature & purpose: Hosting, storing, analyzing, optimizing, and reporting on Customer's Amazon advertising and pricing; generating recommendations and narrative assessments.
• Types of data: Business-contact identifiers (name, business email); Amazon advertising data (campaigns, keywords, search terms, bids, budgets, metrics); catalog/commercial data (ASINs, SKUs, prices, inventory signals, fees, guardrails). No Amazon buyer PII.
• Data subjects: Customer's authorized business users/administrators. (No consumers/buyers.)
• Frequency: Continuous, for the duration of the Services.

Annex B — Technical & Organizational Measures

• Encryption: TLS 1.2+ in transit; AES-256 at rest for databases and backups.
• Access control: role-based least-privilege; MFA for administrative access; access logging.
• Network: private network segmentation; production databases without direct public internet access.
• Secrets: OAuth tokens and keys stored in a managed secrets manager (AWS Secrets Manager), never in the application database or in plaintext.
• Operations: monitoring, logging, incident-response plan, and audit logging of material SP-API write actions.
• Data minimization: only the minimum Amazon Information necessary; no buyer PII; numeric-whitelist redaction for AI narrative inputs.

Annex C — Authorized Subprocessors

• Amazon Web Services (incl. Amazon Bedrock): Hosting, storage, security, backup, monitoring, operations, and in-environment AI inference (open-weight models). United States.