Legal
Data Processing Addendum
Last updated 2026-08-27
This addendum forms part of our Terms of Service and applies whenever OpCycle processes personal data on your behalf. You do not need to sign it. It applies automatically to every customer. If anything here conflicts with the rest of the agreement on the handling of personal data, this addendum controls.
If your organization requires a countersigned copy for its records, write to hello@opcycle.ai and we will sign one.
1. Words used here
Applicable data protection law means the privacy and data protection laws that apply to the processing under our agreement, including the California Consumer Privacy Act as amended, and the EU and UK General Data Protection Regulation.
Controller, processor, data subject, personal data, processing, and personal data breach carry the meanings given to them by applicable data protection law. In California terms, controller means business and processor means service provider.
Anything else capitalized carries the meaning given in the Terms of Service.
2. Which of us is which
As between us, you are the controller and we are the processor. You decide what personal data enters the platform and why. We process it only as far as providing the service requires.
3. Our instructions
We process personal data only on your documented instructions, which are the Terms of Service, this addendum, your configuration of the service, and whatever else you tell us in writing. If the law requires us to process it some other way, we will tell you before we do, unless the law forbids us from telling you. If we believe an instruction breaks applicable data protection law, we will say so.
4. No sale, and no other purpose
We will not sell or share personal data. We will not keep, use, or disclose it for any purpose other than providing the service, or as applicable data protection law otherwise permits, and we will not combine it with data from other sources except as providing the service to you requires. We will not use it to train, develop, or improve any machine learning or artificial intelligence model. We certify that we understand these restrictions and will comply with them.
5. Confidentiality
Everyone we authorize to process personal data is bound by appropriate obligations of confidentiality.
6. Security
We implement and maintain the technical and organizational measures described in the security section of the Terms of Service and in Annex II below, appropriate to the risk.
7. Subprocessors
You authorize us to engage the subprocessors listed in Annex III, together with the hosting and infrastructure providers needed to run the service. Each one is bound by data protection obligations no less protective than this addendum, and we remain responsible for how they perform.
We will notify you before we add or replace a subprocessor that processes personal data, and give you a reasonable opportunity to object.
8. Requests from individuals
Taking into account the nature of the processing, we will help you respond to requests from individuals exercising their rights, as far as we are able, through appropriate technical and organizational measures. If such a request reaches us directly, we will point the individual to you, where we are permitted to.
9. Other assistance
We will give you reasonable help with data protection impact assessments, with prior consultations with supervisory authorities, and with your own obligations to keep personal data secure and to deal with personal data breaches.
10. Personal data breach
We will notify you without undue delay, and in any event within seventy-two hours, after becoming aware of a personal data breach, consistent with the security section of the Terms of Service, and we will give you the information you reasonably need to meet your own notification obligations.
11. Deletion or return
When our agreement ends, we delete or return personal data on the timetable set out in the Terms of Service, except where the law requires us to keep it.
12. Audit
We will make available the information reasonably needed to show that we comply with this addendum, and we will allow for and contribute to reasonable audits, inspections included, carried out by you or an auditor you appoint, on reasonable prior notice and subject to confidentiality.
13. International transfers
Where we process personal data protected by the EU or UK General Data Protection Regulation and transfer it to a country without an adequacy decision, the applicable Standard Contractual Clauses, and the UK International Data Transfer Addendum where it applies, are incorporated here by reference, with you as data exporter and OpCycle as data importer.
Annex I. Details of the processing
Categories of data subject. Your personnel and authorized users, and, to the extent they appear in your business data, your retail and wholesale accounts and your end consumers.
Categories of personal data. Business contact information, and, to the extent you choose to include it, consumer order information such as names, email addresses, shipping addresses, and purchase history reaching us through the integrations you authorize. No special categories of personal data are intended to be processed.
Nature and purpose. Hosting, processing, and analysis of your business data to provide sales forecasting, demand and production planning, inventory, procurement, order management, and reconciliation and reporting functionality, and to support you in using it.
Duration. For as long as your account is open, plus the export and deletion periods set out in the Terms of Service.
Annex II. Technical and organizational measures
Encryption of personal data in transit and at rest. Logical separation of your data from other customers' data. Role-based access controls. Regular backups. A written information security program. Vulnerability management. Confidentiality obligations on personnel. All as further described in the security section of the Terms of Service.
Annex III. Subprocessors
Our cloud infrastructure and hosting providers, engaged to host and operate the service. Stripe, our payment processor, for subscription billing. Our email delivery provider, for the transactional mail the product sends. Our cloud hosted LLM providers, for the summaries and briefings the platform writes.
A current list, with names and locations, is available to you on request.
Contact
OpCycle, Inc. Write to hello@opcycle.ai.
See also our Terms of Service and our Privacy Policy.