Data Processing Addendum

Version 2026-09-27 · Published September 27, 2026

This DPA is available for acceptance by merchants using InPose TryOn. It takes effect between InPose and a Merchant when the Merchant records its acceptance electronically or in writing as described in Section 11.

1. Parties and scope

This Data Processing Addendum (DPA) forms part of the service agreement between the merchant using InPose TryOn (Merchant) and InPose (InPose). The Merchant's identity and Shopify store are those recorded when it accepts this DPA. InPose is located at 99 Hatapuach St., Israel. Its privacy and contractual contact is support@inpose.io.

For personal data processed to provide try-on on the Merchant's instructions, the Merchant is the controller and InPose is the processor. If the Merchant acts for another controller, it confirms its authority to appoint InPose as a subprocessor. Each party remains responsible for obligations applicable to its role. InPose separately determines the purposes of processing its own business-contact, account-security and financial records; this DPA does not convert that processing into processing on the Merchant's instructions.

“Applicable Data Protection Law” means privacy and data-protection law applicable to the processing covered by this DPA. “Personal Data,” “controller,” “processor,” “processing,” “personal data breach” and “subprocessor” have the meanings given by that law. The provisions below also apply to equivalent roles under other applicable privacy laws.

2. Processing instructions

InPose will process covered Personal Data only to provide the service described in Annex A, follow the Merchant's documented configuration and verified support/privacy instructions, and comply with applicable law. The service agreement, this DPA and authenticated Merchant actions constitute documented instructions. Additional instructions should be sent through an agreed secure channel.

InPose will inform the Merchant if it reasonably believes an instruction conflicts with Applicable Data Protection Law. If law requires processing outside the Merchant's instructions, InPose will notify the Merchant before processing unless prohibited by that law. Neither party is required to follow an unlawful instruction.

InPose will not sell or share covered Personal Data for cross-context behavioral advertising, use shopper photos or results as marketing assets, or train a shared model on those uploads or results. InPose will not combine that data with unrelated customer data for a separate commercial purpose. Provider processing is subject to the documented subprocessor terms and safeguards; this DPA does not promise zero provider retention.

3. Merchant responsibilities

The Merchant determines whether the service is appropriate for its store and provides required privacy notices and lawful instructions. It must obtain any necessary permissions for the photos and product media submitted, honor customer choices, and verify a requester before disclosing or deleting data.

Try-on is optional. The Merchant must not require shoppers to upload a photo to browse or buy, or represent an AI preview as a sizing, fit, identity-verification or other consequential decision. The Merchant must not intentionally submit identity documents, payment credentials, health records or other unnecessary sensitive information.

Merchant exports are under the Merchant's control after download. The Merchant must secure them, restrict them to the stated privacy/support purpose, and delete available-media copies by the original session expiry. Activity exports must be deleted when the verified request or authorized support work is complete, unless a documented legal obligation requires restricted retention.

4. Confidentiality and security

InPose will restrict access to authorized people and services that need it for the agreed purposes. People permitted to access covered Personal Data must be subject to confidentiality obligations. InPose will maintain risk-appropriate technical and organizational safeguards, including the controls in Annex B, and will not materially reduce overall protection during the service term.

The Merchant is responsible for the security of its Shopify accounts, authorized staff access, downloaded exports and devices. Each party will promptly notify the other of a compromised access mechanism relevant to the service and cooperate in containment.

5. Subprocessors

The Merchant generally authorizes the subprocessors listed in Annex C for the specified functions. InPose will engage subprocessors under written terms imposing data-protection obligations appropriate to their work, including confidentiality, security and assistance with deletion and rights requests. InPose remains responsible for its subprocessors' performance of the obligations it delegates under this DPA.

InPose will give the Merchant at least 30 days' notice before adding or replacing a subprocessor that will process covered Personal Data. The Merchant may object within that period on reasonable data-protection grounds. The parties will work to resolve the objection. If no reasonable resolution is available, the Merchant may stop the affected service and terminate that part of the service before the change takes effect. Urgent changes necessary to address an immediate security risk or legal requirement may occur sooner, with prompt notice and the same objection process.

6. International transfers

Processing can occur outside the Merchant's or shopper's country, including in the United States. Where Applicable Data Protection Law requires safeguards for a restricted transfer, the parties will ensure an appropriate, valid transfer mechanism is in place before that transfer. An applicable adequacy decision, properly completed and binding standard contractual clauses, or another lawful mechanism may be used.

InPose maintains data-processing agreements and applicable transfer safeguards with AWS and Google Cloud. This DPA does not assert a particular certification or independently execute standard contractual clauses between the Merchant and InPose. Where additional clauses or a UK addendum are required for that relationship, the parties will complete and incorporate them before relying on the affected transfer. InPose will reasonably assist the Merchant with information needed to assess the actual transfers and safeguards; contact support@inpose.io for the applicable contractual documentation.

7. Individual rights and assistance

Taking account of the nature of processing and the information available, InPose will reasonably assist the Merchant with requests for access, correction, erasure, restriction, portability or objection. Unless law requires otherwise, InPose will direct requests received from shoppers to the Merchant and will not independently disclose covered Personal Data without a verified instruction.

Anonymous try-on sessions are not automatically linked to a Shopify customer account or email. The parties must verify the relevant session reference; they must not infer identity from a photo. InPose provides separate controls for session media and retained activity. Resolving a privacy-request receipt records work already completed and does not itself perform erasure.

InPose will reasonably assist with data-protection impact assessments, regulator consultations and inquiries concerning its processing, taking account of the information it can provide. The parties will cooperate within applicable legal response deadlines.

8. Personal data breaches

InPose will notify the Merchant without undue delay after becoming aware of a personal data breach affecting covered Personal Data. An initial notice may be supplemented as facts are established. Notices will describe, to the extent known, the nature and likely consequences of the breach, affected data and individuals, mitigation steps and a contact for follow-up.

InPose will take reasonable steps to contain and remediate the breach, preserve necessary evidence securely and cooperate with the Merchant. Notification does not itself admit fault. The Merchant remains responsible for notifications to individuals or authorities required of a controller, with InPose's reasonable assistance.

9. Retention, return and deletion

The operational periods and limitations in Annex A apply. The Merchant may request an available export or deletion through the authenticated app or a verified support process. InPose will delete or return covered Personal Data on the Merchant's documented instruction or at the end of processing, except where law requires retention. Any lawfully retained data will remain protected, restricted to the required purpose and deleted when the retention requirement ends.

Session access expiry and a queued deletion request are not proof of completed physical erasure. InPose will use its deletion and retry processes and verify completion before representing an erasure request as complete. Restricted recovery copies age out separately. A recovery restore must reapply deletion and retention controls before returning restored data to normal use.

10. Accountability and audits

InPose will make information reasonably necessary to demonstrate compliance with this DPA available to the Merchant. The parties will normally begin with relevant documentation and existing security evidence. Where required by Applicable Data Protection Law, InPose will allow and reasonably assist an appropriate audit or inspection by the Merchant or an independent auditor bound by confidentiality.

Audits must protect other customers' data and service security. The parties will agree reasonable notice, scope, timing and safeguards without preventing a legally required audit, regulator access, or an urgent investigation of a material incident. InPose will inform the Merchant if it believes an audit instruction infringes Applicable Data Protection Law.

11. Term, precedence and acceptance

This DPA applies while InPose processes covered Personal Data and continues to protect retained data after termination. If it conflicts with the service agreement about that processing, this DPA controls; mandatory transfer clauses control where applicable. Liability and governing-law provisions in the service agreement apply only to the extent consistent with Applicable Data Protection Law and binding transfer clauses.

Acceptance must be recorded electronically or in writing, identifying the Merchant, store, DPA version, authorized accepting person and timestamp. Publishing this document alone does not establish Merchant acceptance. Existing merchants must receive the DPA and any required acceptance process before InPose represents that this agreement is in place with them.

Annex A — Processing description

Annex B — Technical and organizational measures

• TLS for service transport; encrypted private AWS object and database storage.
• Authenticated Shopify merchant access, tenant-bound data operations and server-scoped administrative API authorization.
• Short-lived media access, no-store responses for sensitive exports, access audits and explicit support/privacy purposes.
• Shopper permission before generation; optional widget analytics fail closed unless Shopify's consent API permits them.
• Separate media/activity deletion workflows, durable retries, retention controls and restricted backup recovery.
• Verified Shopify webhook signatures; minimal event metadata; secrets kept outside source control.
• Production error/dead-letter monitoring and confirmed severity notifications to support@inpose.io.
• Restricted operator access, incident procedures, verified identity/request handling and confidentiality obligations. Organizational practice must be maintained by InPose; code alone does not prove it.

Annex C — Initial subprocessors

Shopify operates the Merchant's commerce platform and app authentication/billing interfaces. Its processing under the Merchant's Shopify agreement is not represented here as InPose appointing Shopify to perform all those functions.

Accepting this DPA

An authorized representative can review this version at https://inpose.io/dpa/ and record acceptance in InPose’s authenticated Shopify Settings when available. Alternatively, contact support@inpose.io with the Merchant’s legal name, Shopify store domain, representative’s name and role, this DPA version and an explicit statement of acceptance and authority. InPose will verify the request and retain the acceptance record. Do not send shopper photos, passwords, tokens or identity documents.

InPose’s contact address is 99 Hatapuach St., Israel. For privacy assistance, subprocessor notices, transfer documentation or a signed copy, contact support@inpose.io.