Data Processing Addendum

1. Roles

For personal data contained in the shipment data the Customer sends to ShipClear, the Customer is the controller and ShipClear is the processor. ShipClear processes that personal data only to provide the Service and on the Customer's documented instructions (including as set out in the Terms and this DPA).

2. Subject matter and details of processing

• Subject matter: provision of shipping-rate calculation for the Customer's store.
• Duration: the term of the Customer's use of the Service, plus the retention periods in the Privacy Policy.
• Nature and purpose: receiving shipment details, computing rates via connected carriers, and storing quote records for audit.
• Types of personal data: recipient postal code, state, and country; item dimensions/weights; and any personal data the Customer chooses to include in a rate request.
• Categories of data subjects: the Customer's end customers (shipment recipients) and the Customer's authorized users.

3. Processor obligations

• process personal data only on the Customer's documented instructions, unless required by law;
• ensure persons authorized to process the data are bound by confidentiality;
• implement appropriate technical and organizational security measures (Section 5);
• assist the Customer, taking into account the nature of processing, in responding to data-subject requests and in meeting its security, breach-notification, and impact-assessment obligations;
• notify the Customer without undue delay after becoming aware of a personal-data breach;
• at the Customer's choice, delete or return personal data at the end of the Service and delete existing copies except where retention is legally required.

4. Sub-processors

The Customer authorizes ShipClear to engage the sub-processors below to process personal data. We impose data-protection obligations on each sub-processor no less protective than those in this DPA and remain responsible for their performance.

• Vercel Inc. (United States) - Application hosting, serverless compute, and content delivery.
• Neon Inc. (United States) - Managed PostgreSQL database hosting (stores account, store configuration, and quote data).
• Stripe, Inc. (United States) - Subscription billing and payment processing (billing contact, payment method, invoices). Card numbers go to Stripe directly and never reach ShipClear.
• Resend, Inc. (United States) - Transactional email and support inbox delivery (account emails, receipts, and messages you send to our support addresses).
• Anthropic PBC (United States) - AI assistant model provider: receives assistant conversation content and referenced store configuration ONLY when a store enables the AI assistant and a user consents.

We will give the Customer a way to be informed of new sub-processors before they process personal data, and the Customer may object on reasonable data-protection grounds.

5. Security measures

• encryption of data in transit (TLS) and encryption of carrier credentials at rest (AES-256-GCM);
• per-store access scoping and authenticated, least-privilege access to production systems;
• security response headers and rate limiting on public endpoints;
• automated data-retention limits and monitoring of the rating service.

6. International transfers

Where ShipClear or a sub-processor processes personal data outside the EEA or UK, the transfer is made under an appropriate transfer mechanism, including the EU Standard Contractual Clauses and the UK Addendum where required, which are incorporated by reference into this DPA.

7. Audits

On reasonable prior written request, and no more than once per year (unless required by a supervisory authority), ShipClear will make available information necessary to demonstrate compliance with this DPA and allow for reasonable audits, subject to confidentiality.

8. Liability and term

Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service. This DPA takes effect when incorporated into the Terms and continues for as long as ShipClear processes personal data on the Customer's behalf.

9. Contact

Data protection contact: privacy@shipclear.io.