Data processing agreement

This data processing agreement ("DPA") is part of the terms of service between The Growth Folks®, Rohtas, Bihar, India, which operates CatalogBadge ("we"), and the business that holds a CatalogBadge account ("you"). It applies whenever we process personal data on your behalf. You accept it by using the service; if your procurement needs a signed copy, email hello@catalogbadge.com and we sign this same text.

1. Roles

• For the data in your feeds, photos, brand settings and store setup, you are the controller and we are your processor. If you use CatalogBadge for a client (an agency), your client is the controller, you are its processor and we are your sub-processor.
• For the data we need to run our own business with you (your sign-in, your team members' accounts, billing status, support emails), we are the controller, as described in our privacy policy.

2. What we process

• Purpose and nature: reading your product feeds, copying your product photos, drawing ad images, building and serving the feed files your ad platforms fetch, and, only if you turn them on, suggesting text with AI and removing photo backgrounds.
• Personal data: product data is mostly not personal, but it can be: people who appear in product photos, names in product titles or descriptions, and contact details on a logo. Also the names and email addresses of the people you invite to your account.
• Data subjects: your staff and the people you invite, and anyone who appears in your product content.
• Special categories: none. Do not put health, religious, biometric or similar data into your feeds.
• Duration: while your account is open, then the deletion periods in section 8.

3. What we commit to

• We process the data only on your instructions: the terms, this DPA, your settings in the dashboard and what you ask us by email. If we think an instruction breaks the law, we tell you.
• We never sell the data, use it for advertising, use it to train AI models or combine it with other customers' data. We never touch your ad accounts or create catalogs for you.
• Everyone at The Growth Folks who can reach the data is bound to keep it confidential.
• We protect the data with the measures in the annex below.
• We help you answer requests from data subjects (access, correction, deletion) and, where it is reasonable, with data protection impact assessments and questions from a regulator.
• We give you the information you need to check that we keep this DPA: this page, the sub-processor list, the data location statement and written answers to your security questionnaire, once a year or after an incident. An audit in person happens only when a regulator requires it, at a time we agree and at your cost.

4. Sub-processors

You authorise the sub-processors on our sub-processor list. Each works under written terms that protect the data at least as well as this DPA, and we remain responsible to you for them. Before we add or replace one, we update the list and email every account owner at least 30 days ahead. If you object on reasonable data protection grounds within those 30 days and we cannot meet the objection, you may cancel, and we refund the unused part of any period you already paid for.

5. Where the data goes

We are in India, and your data is stored and processed in the United States and on Cloudflare's global network, as the data location statement sets out. For personal data from the European Economic Area, the United Kingdom or Switzerland, the European Commission's standard contractual clauses (module 2, or module 3 when you are a processor), with the UK addendum and the Swiss amendments, form part of this DPA, with you as data exporter and us as data importer. Our sub-processors' transfers rely on their own mechanisms (standard contractual clauses or the EU-US Data Privacy Framework). For other countries' transfer rules, tell us what your law requires and we will work with you on it.

6. Security incidents

If a breach of security leads to your personal data being lost, changed, disclosed or accessed without authorisation, we tell the account owner by email without undue delay and within 72 hours of becoming aware of it, with what we know, what we are doing and whom to contact, and we keep you updated as we learn more.

7. Your data at the end

On request we send you a copy of your data before we delete it. When you ask us to delete your account, we delete everything under it within 7 days; a paused store's images and feeds are deleted after 90 days. Encrypted backups expire within 3 months. The full list of periods is in the retention section of our privacy policy. Dodo Payments keeps its own billing records as merchant of record.

8. General

• Liability under this DPA follows the limits in the terms of service.
• If this DPA and the terms disagree about personal data, this DPA wins; if the standard contractual clauses apply and disagree with this DPA, the clauses win.
• This DPA follows the law and courts named in the terms, except where the standard contractual clauses require otherwise.
• We may update this DPA to follow the law or a change in the service; we email account owners 30 days before a change that reduces your protection.

Annex: security measures

• Encryption: TLS on every connection; data encrypted at rest by Cloudflare and Backblaze; backups encrypted before they leave Cloudflare, with a key held only by The Growth Folks' owner, offline.
• Separation between customers: every database query that touches store data is limited to one store, every stored file sits under that store's own prefix, and another customer's id is answered as "not found".
• Access: customer passwords are stored only as salted PBKDF2 hashes; sign-in pages are protected by Turnstile and rate limits; sessions last 30 days. Our admin area sits behind Cloudflare Access with named people only, each with a role.
• Feed and image addresses: your feed URLs carry a 256-bit secret token that you can replace at any time; image addresses are random and cannot be listed.
• Fetching: we fetch only the URLs you give us, refuse private and internal network addresses, and cap size and time. Product text is placed into images as text, never as code.
• Logs never contain a feed URL, a feed token or an email address. Errors are recorded as codes.
• Resilience: a failed update never replaces your published feeds; nightly encrypted backups with a monthly restore test; uptime monitoring with alerts.
• Deletion runs automatically every hour against a recorded queue, and the record keeps ids and counts only.