Texin Portal Data Processing Addendum

The short version. You direct processing of your data. Texin limits its use and recipients, protects it, does not sell it or train models on it, and handles deletion within one 30-day window. You independently select your AI provider. This DPA is part of the Terms; the sections below control.

1. Scope

This DPA is incorporated into the Terms between TexIN Commerce LLC, d/b/a Texin.ai ("Texin"), and Customer. Customer Data means connected-source data and submitted content; Personal Data is Customer Data protected by applicable data-protection law. Customer is controller/business or an authorized processor; Texin is processor/service provider, or subprocessor, for Customer Data. The processing, confidentiality, security, recipient and deletion duties cover all Customer Data. The DPA controls data-protection conflicts; Terms Section 12 supplies the single aggregate liability cap.

2. Instructions

Texin processes data only to provide, secure and support Portal on documented instructions in the Terms, this DPA and authorized settings/tool requests, and to satisfy binding law/platform duties. It notifies Customer of conflicting mandatory processing where allowed and may refuse unlawful instructions. Customer obtains authority and consents, including for client brands and AI-client disclosure, and excludes sensitive personal data, buyer contact details and credentials from submitted content.

3. Purpose restrictions

Texin will not sell or share Personal Data as defined by CCPA, use or disclose Customer Data outside the specified service purposes/direct relationship, combine source data across customers (except aggregated, de-identified statistics under Terms Section 6, which exclude Amazon and Google source data unless that platform permits it in writing), or train, fine-tune or improve models with it or authorize processors to do so. Where CCPA applies, Texin provides the required protection, certifies it understands these restrictions, notifies Customer if unable to comply and permits reasonable monitoring, stopping and remediation of unauthorized processing. No advertising or unrestricted product-development license is granted.

4. Personnel and security

Personnel owe confidentiality and have access only for necessary authorized tasks. Texin maintains the safeguards in Section 11, appropriate to data and binding platform/legal duties, without materially reducing overall protection. Google human-access restrictions below control ordinary support access.

5. Platforms and AI clients

Amazon data remains within the authorizing business/workspace and subject to SP-API, Ads API and report-specific restrictions. Texin may suspend, delete or provide required audit/incident information to comply. Google API data follows Limited Use, including permitted consented transfers, restricted human access and explicit prior user consent for relevant business transfers, as stated in the Privacy Policy.

At Customer's direction, Portal returns requested data to the AI provider Customer independently appoints under its own contract and non-training settings. This does not waive Texin's platform/legal duties. Self-service connected data does not enter Texin's own server-side model analysis. Appointed tracking providers receive submitted tracking inputs/settings rather than connected-source records.

6. Subprocessors

Customer authorizes the listed subprocessors. Texin obtains appropriate written purpose, confidentiality and security restrictions and remains responsible for appointed processors' performance. Texin emails owners before adding a provider that will process Customer Data. Customer may object and cancel; if the change takes effect before the paid period ends, Texin refunds the unused part of that month for the affected service. Any longer legally required notice applies.

7. Incidents and assistance

Security Incident means unauthorized access to, disclosure, loss, alteration or destruction of Customer Data held by Texin or its appointed processors.

Texin notifies Customer without undue delay, no later than 72 hours after awareness of a Security Incident affecting Customer Data, and sooner where law/platform duties require; suspected Amazon incidents are handled under applicable platform rules. It shares available impact/response information, cooperates and provides updates without waiting for investigation completion. Texin reasonably assists with legally required rights requests, assessments and security duties; assistance does not delay mandatory deadlines.

8. Verification

Texin answers reasonable security questions and permits audits where law requires, under confidentiality/security safeguards and at Customer's cost unless law requires otherwise. Statutory service-provider monitoring/remediation and platform/regulator access rights remain intact. Audits must protect other customers' information.

9. Return and manual deletion

Customer should revoke source access in its Amazon/Google account and notify support@texin.ai. Collection stops at service end or loss of source authorization. Texin staff delete connected-source data, tokens and saved workspace content within 30 days after the earliest applicable subscription/trial end, source-access revocation or deletion request. Revocation covers the affected source; service end/request covers the workspace. Earlier binding triggers and shorter deadlines prevail; notice does not restart the clock. No automatic-erasure feature is promised.

An owner may request a common-format copy while data remains, within that same 30-day exit/revocation window; request promptly, as deletion may occur sooner. Exports cannot extend retention. Backups, replicas and appointed-processor copies must be removed or expire within the same deadline; restore procedures suppress deleted data before access resumes. Only minimized records required by law or necessary billing, consent and security evidence remain, restricted to their permitted purpose. Source history is not retained for those purposes. Customer controls copies directed to its AI provider or other chosen recipients.

10. Processing details and locations

Processing comprises scheduled/instructed collection, storage, calculation, return, tracking, support and security during authorized service and Section 9 retention. Data includes business sales, orders, inventory, listings, advertising/Google reports, account metadata/tokens and submitted context/tracking inputs; people include business users and persons incidentally named in content. Portal targets U.S. businesses/U.S. Amazon accounts; providers may process globally. EU/UK-regulated personal data requires a separate written agreement and lawful transfer mechanism; this DPA supplies no executed SCCs.

11. Safeguards and duration

Safeguards include encrypted transport and platform credentials; workspace authorization and least-privilege access; unique personnel accounts and access removal; confidentiality/security training; minimized protected logs; vulnerability remediation; separation of test and production; incident escalation; and controlled backups/restoration. Binding platform controls also apply. This DPA continues while Texin holds Customer Data.

Contact TexIN Commerce LLC, d/b/a Texin.ai: support@texin.ai, or by mail at 1401 Lavaca Street, Unit #7267, Austin, TX 78701.