Data Processing Addendum

01Roles and scope

For personal data processed in connection with the service on your behalf, you are the controller and Sill is the processor. Where you act as a processor for a third-party controller, Sill is a subprocessor. This DPA applies to the extent Sill processes such personal data and prevails over any conflicting term in the agreement on the subject of data protection.

02Processing on documented instructions

Sill processes personal data only on your documented instructions — including the agreement, this DPA, and your configuration and use of the service — and as required by applicable law, in which case Sill will inform you unless legally prohibited. Sill will tell you if, in its opinion, an instruction infringes data-protection law.

03Sill’s obligations

• —Confidentiality: persons authorized to process personal data are bound by confidentiality.
• —Security: Sill implements the technical and organizational measures in Annex III (Art. 32).
• —Subprocessors: Sill uses only the subprocessors in Annex II under written terms, and gives notice of changes (Section 4).
• —Assistance with data-subject requests: Sill helps you respond to requests to exercise data-subject rights (Section 6).
• —Assistance with security, breach, and DPIAs: Sill assists you with Art. 32–36 obligations, taking into account the nature of processing and the information available to it.
• —Deletion or return on termination (Section 8).
• —Information and audits: Sill makes available the information needed to demonstrate compliance (Section 9).

04Subprocessors

You authorize Sill to engage the subprocessors listed in Annex II. Sill imposes data-protection obligations on each subprocessor no less protective than this DPA and remains responsible for their performance. Sill will give you prior notice of any intended addition or replacement of a subprocessor, giving you the opportunity to object on reasonable data-protection grounds. Sill will give such notice by email and/or by updating its published subprocessor list at least 30 days in advance.

05International transfers

Sill processes personal data in United States (AWS us-east-1 / Fly.io iad; Neon us-east-1). Where Sill transfers personal data originating in the EEA, the UK, or Switzerland to a country without an adequacy decision, the parties agree that the European Commission’s Standard Contractual Clauses (and the UK Addendum / Swiss amendments as applicable) are incorporated by reference and apply. The parties select Module Two (controller to processor) where the Customer is the controller, and Module Three (processor to processor) where the Customer acts as a processor; the docking clause applies, and the clauses are governed by the law and courts of the Customer’s EEA member state (or Ireland where none applies).

06Data-subject requests

Taking into account the nature of the processing, Sill will assist you by appropriate technical and organizational measures, insofar as possible, to respond to requests to exercise data-subject rights. The service lets account administrators export signed audit records and purge the buyer detail on a specific record; for other requests, Sill will support you within a reasonable time. If a data subject contacts Sill directly, Sill will refer them to you.

07Personal-data breach

Sill will notify you without undue delay after becoming aware of a personal-data breach affecting personal data processed on your behalf, and will provide the information reasonably available to help you meet your notification obligations.

08Return and deletion

On termination, and at your choice, Sill will delete or return the personal data processed on your behalf and delete existing copies, unless retention is required by law. During the service, encrypted buyer detail is purged automatically at the end of its retention window, and administrators can purge the buyer detail on a specific record on request. Audit records are retained for their classified retention period to preserve evidentiary integrity; certain immutable, signed records may be retained until the end of that period or as required by law.

09Audits

Sill will make available information necessary to demonstrate compliance with Art. 28 and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable confidentiality, scheduling, and security conditions: no more than once per twelve months (unless required by a supervisory authority or following a personal-data breach), on at least 30 days’ notice, during business hours, at the Customer’s cost; where available, Sill’s third-party audit reports or certifications satisfy this obligation.

10Liability and precedence

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the agreement. This DPA is governed by the same law as the agreement, the laws of the State of Delaware, USA. In the event of a conflict on data protection, this DPA controls; the SCCs control over this DPA to the extent of any conflict regarding transfers.

11Annex I — Details of processing

Subject matter & duration: processing of personal data as necessary to provide the Sill service for the term of the agreement and any wind-down period. Nature & purpose: identification and logging of AI-agent traffic; evaluation of signed mandates against your policy; authorization of resulting actions through your processor; and creation, storage, and export of signed audit records.

Categories of data subjects: your authorized dashboard users; and, where applicable to a transaction, your end customers (buyers) and the principals on whose behalf agents act.

Categories of personal data:

No special-category data is required by the service. Full payment-card numbers are never processed; only opaque processor tokens are handled.

12Annex II — Subprocessors

Providers the Customer connects to their own account (for example, Stripe and Shopify) act as independent controllers or as the Customer’s own processors, not as Sill sub-processors, and are therefore not listed here. They are described in the Privacy Policy.

13Annex III — Technical & organizational measures

• —Encryption in transit (TLS) for all connections, including to the database.
• —Encryption at rest for sensitive data using AES-256-GCM with per-row, KMS-wrapped data-encryption keys and purpose-scoped keys.
• —ed25519 cryptographic signing of audit records, with an append-only, Merkle-chained, tamper-evident log enforced at the database level.
• —Multi-tenant isolation enforced with PostgreSQL row-level security keyed to the account, failing closed; buyer-detail reads are additionally gated by user role.
• —Card data minimization: only opaque processor tokens are handled; raw card numbers never enter any Sill system, enforced by an automated check in the build pipeline.
• —Access logging of privileged actions, including any decryption or purge of buyer detail.
• —Secrets held in a managed secrets store with least-privilege access; passwords and tokens stored only as hashes.

14Contact

Data-protection contact: [email protected]. The signatory name, title, and registered address of Sill Labs Inc. are completed on execution of this DPA.