Data Processing Agreement
Effective Date: October 20, 2026 · Last Updated: October 19, 2026
This Data Processing Agreement ("DPA") forms part of the WeScale Terms of Service (the "Terms") between WeScale and the member who uses the Service ("you"). It applies only where WeScale processes personal data on your behalf. Capitalized terms not defined here have the meaning given in the Terms.
1. Roles
1.1 For personal data that WeScale processes on your behalf while providing the Service ("Member Personal Data"), you are the controller (or a processor acting for your own controller), and WeScale is your processor or service provider.
1.2 For the data of your own WeScale account (such as your name, email address, plan and usage of the Service), WeScale acts as an independent controller, as described in our Privacy Policy. That data is outside this DPA.
1.3 Annex 1 describes the processing.
2. Instructions
2.1 WeScale processes Member Personal Data only on your documented instructions. Those instructions are given by the Terms, this DPA, and your use and configuration of the Service, such as connecting a platform, publishing products or viewing your business performance.
2.2 WeScale will tell you if, in its opinion, an instruction infringes applicable data protection law, unless the law prohibits it.
2.3 WeScale does not sell or share Member Personal Data, and does not use it for any purpose other than providing the Service to you. WeScale does not combine it with personal data it receives from other members or from its own interactions with individuals, except as needed to provide the Service and as permitted by law. Where U.S. state privacy laws apply, WeScale acts as your service provider or contractor and complies with the restrictions those laws place on it.
3. Confidentiality
WeScale ensures that people authorized to process Member Personal Data are bound by confidentiality obligations and access it only as needed to provide the Service.
4. Security
WeScale maintains the technical and organizational measures described in Annex 2. It may update them, provided the overall level of protection does not decrease.
5. Subprocessors
5.1 You authorize WeScale to use the subprocessors listed in Annex 3.
5.2 WeScale binds each subprocessor by a written agreement to data protection obligations that offer at least the same level of protection as this DPA. WeScale remains responsible for its subprocessors' performance.
5.3 WeScale will give you at least 30 days' notice before a new subprocessor processes Member Personal Data. If you object on reasonable data protection grounds within that period, the parties will discuss the objection in good faith. If it is not resolved, you may stop using the affected feature, or terminate the Terms, as your sole remedy.
6. International transfers
6.1 WeScale and its subprocessors process Member Personal Data in the United States.
6.2 Where Member Personal Data is transferred from the European Economic Area, Switzerland or the United Kingdom to a country without an adequacy decision, the parties agree that the EU Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor, as applicable) and, for the United Kingdom, the UK International Data Transfer Addendum, are incorporated into this DPA by reference. The options and details those clauses require are set out in Annex 4.
6.3 A subprocessor may rely on another lawful transfer mechanism, such as the EU–U.S. Data Privacy Framework.
7. Assistance
7.1 WeScale will promptly forward to you any request it receives from an individual about Member Personal Data, and will not respond to it except on your instructions or as required by law.
7.2 Taking into account the nature of the processing, WeScale will provide reasonable assistance with your obligations to respond to individuals' requests, carry out data protection impact assessments, and consult supervisory authorities.
8. Personal data breaches
8.1 WeScale will notify you without undue delay, and in any event within 72 hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Member Personal Data.
8.2 The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of individuals and records concerned, the likely consequences, and the measures taken or proposed. WeScale will take reasonable steps to contain the breach.
9. Deletion
9.1 When you disconnect a platform, WeScale keeps the data already collected through that connection for 30 days, so that reconnecting restores your history, and then deletes it. When you uninstall WeScale from a platform, or when you or the platform asks WeScale to delete data, WeScale deletes the covered data within 30 days.
9.2 When you delete your account, WeScale deletes Member Personal Data within 30 days.
9.3 Data collected from a connected platform remains available to you in that platform. WeScale does not return it separately.
9.4 Copies in routine backups are deleted as the backups expire. Until then, they are kept secure and are not used.
9.5 WeScale may keep data where the law requires it, and only for that purpose.
10. Audits
10.1 On written request, WeScale will provide the information reasonably necessary to demonstrate compliance with this DPA.
10.2 If that information is not sufficient, or a supervisory authority requires it, you may audit WeScale's compliance, on at least 30 days' notice, no more than once in any 12-month period, and at your own cost. The audit must happen during business hours, must not disrupt the Service, and is subject to confidentiality obligations.
11. Liability, term and order of precedence
11.1 Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms.
11.2 This DPA lasts as long as WeScale processes Member Personal Data for you.
11.3 If this DPA conflicts with the Terms, this DPA controls with respect to the processing of personal data. If the Standard Contractual Clauses conflict with this DPA, the Standard Contractual Clauses control.
11.4 WeScale may update this DPA. It will notify you of material changes and ask you to accept the updated version, in the same way as for the Terms. An update will not reduce the protection of Member Personal Data unless the law requires it.
11.5 This DPA is governed by the law that governs the Terms, except where the Standard Contractual Clauses require otherwise.
Annex 1. Description of the processing
| Subject matter and purpose | Providing the Service: creating and publishing products to your connected stores, and showing your business performance from your connected platforms. |
| Nature of the processing | Collection through the platforms' interfaces, storage, organization, analysis, display and deletion. |
| Duration | The term of the Terms, plus the deletion periods in section 9. |
| Categories of individuals | Your customers, and people who appear in content you create or connect, such as advertising images or email images. |
| Categories of personal data | Order details received from Printify, including the recipient's name and contact details. These are read when orders are collected and removed before storage, except the country and region. Aggregate sales, marketing and advertising figures that do not identify individuals. Images in your advertising and email content, which may show people. |
| Special categories of data | None intended. |
Annex 2. Security measures
- Access credentials for connected platforms are encrypted before storage and used only by WeScale's servers.
- Each member's data is isolated: database access rules limit each member to their own data.
- Data is encrypted in transit.
- Access to production systems is limited to authorized personnel who need it to run the Service.
- Personal data of your customers is removed from order records before storage.
- Session recordings, when the member consents, hide form entries, credentials, business figures, messages, and payment and customer information.
- Backups are kept for a limited period and expire automatically.
- A written incident response procedure covers detection, containment, notification and review.
Annex 3. Subprocessors
| Vendor | What it does for WeScale | Personal data it receives | EU/UK transfer mechanism |
|---|---|---|---|
| Vercel Inc. | Hosts the WeScale app | All data the app handles passes through it: member account data, store data and, in transit only, shopper contact details in orders read from Printify (removed before anything is stored) | DPF; SCCs; UK Addendum |
| Supabase Inc. | Main database and sign-in | Member account data, store data, connected-platform access credentials (encrypted), and members' conversations with the WeScale assistant | SCCs; UK Addendum |
| Cloudflare, Inc. | File storage and delivery | Files members upload or create (designs, mockups), and ad and email images from connected platforms | DPF; SCCs; UK Addendum |
| Inngest Inc. | Runs background tasks | Record identifiers, file links, product titles and descriptions, and store web addresses | None stated in the vendor's terms |
| Functional Software, Inc. (Sentry) | Error monitoring | Member identifiers, IP addresses and technical details of errors | DPF; SCCs; UK Addendum |
| Axiom, Inc. | Stores technical logs | Member and store identifiers in log entries | SCCs (its UK terms refer to the earlier clauses) |
| Upstash, Inc. | Enforces usage limits | Member identifiers | DPF; SCCs; UK Addendum |
| Plus Five Five, Inc. (Resend) | Sends sign-in emails | Member email address | DPF; SCCs; UK Addendum |
| PostHog, Inc. | Product analytics and session recordings, only with the member's consent | Member account data, usage events, screen recordings with sensitive content hidden, and requests made by AI assistants connected to WeScale | DPF; SCCs; UK Addendum |
| Intercom, Inc. | In-app customer support | Member name and email, and the messages members send | DPF; SCCs; UK Addendum |
| Usertour Inc. | In-app guides and announcements | Member name, email, plan and signup date | None stated in the vendor's terms |
| OpenRouter, Inc. | Access to AI models | Design images, and members' questions to the WeScale assistant | SCCs; UK Addendum |
| OpenAI, L.L.C. / OpenAI Ireland Ltd | Search for the WeScale assistant | Members' questions to the assistant | EU: contract with OpenAI Ireland; UK: SCCs with UK Addendum |
| Cohere Inc. | Search ranking for the WeScale assistant | Members' questions to the assistant | SCCs (UK not stated) |
| Railway Corp. | Hosts the WeScale assistant's service | Members' questions and the assistant's answers | DPF; SCCs; UK Addendum |
| Zapier, Inc. | Adds new members from WeScale's community | Member name, email and join date | DPF; SCCs; UK Addendum |
Abbreviations:
- DPF: the EU–U.S. Data Privacy Framework and its UK Extension.
- SCCs: the EU Standard Contractual Clauses (2021).
- UK Addendum: the UK International Data Transfer Addendum.
Annex 4. Standard Contractual Clauses details
- Clause 7 (docking clause): applies.
- Clause 9 (subprocessors): option 2, general written authorization, with the notice period in section 5.3.
- Clause 11 (redress): the optional language does not apply.
- Clause 13 (supervision): the supervisory authority of the EU member state where your EU representative is established, or, if you have none, where the individuals concerned are.
- Clause 17 (governing law): the law of Ireland.
- Clause 18 (forum): the courts of Ireland.
- UK Addendum: Tables 1 to 3 are completed with the information in this DPA and its annexes; Table 4: either party may end the Addendum as set out in its Section 19.