Legal

Data Processing Addendum

Last updated: October 19, 2026

1. Scope and roles

This Data Processing Addendum (DPA) forms part of the Terms of Service between ADERYX AI LAB LLC (the provider of PropulSell, the processor) and the customer that uses PropulSell (the controller). It applies to the personal data contained in the content you upload or generate (for example photos in which a person appears, product names and descriptions) and in any other customer data we process on your behalf, as described in Article 28 of Regulation (EU) 2016/679 (GDPR) and the UK GDPR.

We act as controller of your account, billing-relationship and security data; that processing is described in our Privacy Policy, not in this DPA. Stripe, our payment processor, handles payment data under its own terms and is outside this DPA.

If you use PropulSell for personal or household purposes only, this DPA does not apply.

2. Subject matter, duration and purpose

We process customer personal data only to provide the Service: storing your uploads, running them through AI models, returning the results and keeping your library, gallery and history, as described in the Terms. Processing lasts for as long as you have an account, plus the retention periods in Section 10.

3. Types of data and data subjects

Data subjects: you and your team; people who appear in photos or videos you upload; people named in text you submit (for example buyers or models).

Types of data: images and videos (which may show faces and other personal characteristics), text you enter, file names and metadata, and the generated outputs.

We do not intend to process special categories of data. Do not upload them.

4. Our obligations as processor

We will:

process customer personal data only on your documented instructions, which are this DPA, the Terms and your use of the Service; we will tell you if we think an instruction breaks data protection law;

ensure that everyone we authorise to process the data is bound by confidentiality;

implement the technical and organisational measures in Section 6;

not sell the data, not use it for advertising and not use your uploads to train AI models without your explicit consent;

ask our AI providers to process your content only to deliver the requested result.

5. Your obligations as controller

You confirm that you have the right and, where required, a lawful basis and the consent of every person shown in your uploads to have us process their data, and that your instructions comply with law and with our Acceptable Use Policy. You are responsible for the accuracy and legality of the content you upload.

6. Security measures

We apply measures appropriate to the risk (Article 32 GDPR), including:

TLS encryption in transit and AES-256 encryption at rest;

private, per-account storage paths for uploads and access control on our systems;

least-privilege access for staff and providers;

regular security reviews and backups of the database;

a vulnerability reporting channel at [email protected].

7. Sub-processors

You give us general authorisation to use the sub-processors listed at https://propulsell.com/subprocessors. We will inform you by email at least 14 days before adding or replacing one, and you may object on reasonable data protection grounds within that period ([email protected]). We bind each sub-processor by contract to data protection obligations no less protective than this DPA and remain responsible for their performance.

8. International transfers

ADERYX AI LAB LLC is based in the United States. Where customer personal data from the EEA, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply and are incorporated by reference: Module Two (controller to processor) or, where you act as a processor yourself, Module Three, with ADERYX AI LAB LLC as data importer. For the UK, the UK International Data Transfer Addendum to those clauses applies; for Switzerland, references to the GDPR include the Swiss FADP. Choices under the clauses: Clause 7 docking clause is included; Clause 9 option 2 (general authorisation, 14 days notice); Clause 11 optional redress is not included; Clause 17 and 18: the law and courts of Ireland. Annex I and II are completed by Sections 2 to 6 of this DPA and the list of sub-processors. Where a sub-processor is certified under the EU-US Data Privacy Framework we may rely on it instead. A signed copy of the clauses is available on request.

9. Assistance, breaches and audits

Data subject requests: we will pass on requests we receive about customer data and help you respond, using the export and deletion tools in Studio settings where possible.

Assistance: we will help you with security, data protection impact assessments and consultations with authorities, taking into account the nature of the processing.

Personal data breach: we will notify you without undue delay, and where feasible within 72 hours, after becoming aware of a breach affecting customer personal data, with the information we have to help you meet your own duties.

Audits: on reasonable request, not more than once a year unless a breach requires it, we will give you the information needed to show compliance with Article 28 (for example our security documentation and sub-processor terms) and allow audits by you or an auditor you appoint under reasonable confidentiality and notice.

10. Return and deletion

Files saved in your account remain there until you delete them or delete your account. You can export your data at any time from Studio > Settings > Danger zone (data export).

When you delete your account, we delete saved customer content from active systems, except records we must retain by law. Backup copies may remain until overwritten in our normal backup cycle.

11. Liability, precedence and acceptance

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where law forbids this. If this DPA conflicts with the Terms on a data protection matter, this DPA prevails; if it conflicts with the Standard Contractual Clauses, the clauses prevail. It takes effect when you create an account and stays in force while we process customer personal data. For a countersigned copy write to [email protected]. Governing law and courts follow the Terms, except as the Standard Contractual Clauses require.

[email protected]