Data Processing Addendum
Last updated: 15 July 2026.
Roles and scope
This Data Processing Addendum ("DPA") describes how ACE (the Agentic Commerce Engine), operated by Rezolve Ai Limited, 21 Sackville Street, London W1S 3DN, England, processes personal data on behalf of its customers under UK GDPR and EU GDPR.
- For the catalog, content, and analytics data you bring into ACE (including data about your own shoppers collected by the optional storefront experiment script), you are the controller and ACE is the processor.
- For your ACE account itself (login email, settings, billing metadata), ACE is the controller, as described in the Privacy Policy.
Subject matter, duration, nature and purpose
Processing covers product catalog enrichment, AI search optimization, feed generation, content publishing, and related analytics, for the duration of your subscription. Categories of data subjects: your staff and team members, and (where you enable storefront features) visitors and customers of your store. Categories of data: product and content data, staff contact details, and pseudonymized shopper interaction events (hashed IP, session identifiers, consent-gated experiment events).
Sub-processors
We use the following sub-processors. We will give notice on this page before adding or replacing a sub-processor that handles customer personal data.
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting and edge network | United States (us-east) |
| Supabase Inc. | Managed PostgreSQL database, authentication, and file storage | United States |
| Inngest, Inc. | Background job orchestration (14-day event payload retention) | United States |
| OpenAI, Anthropic, Google | Large language model inference for content generation. Not used for model training per their enterprise terms | United States |
| Resend, Inc. | Transactional email delivery | United States |
| Authoritas (Analytics SEO Ltd) | AI search visibility and research data | United Kingdom |
| Langfuse (self-hosted) | LLM observability on our own infrastructure at an Authoritas-internal domain. Receives prompts and completions for debugging | European Union |
| Oxylabs (Teso LT, UAB) | Proxy network for fetching publicly available storefront pages | Lithuania |
| Cloudflare, Inc. | Turnstile bot protection on public forms | United States (global network) |
| Amazon Web Services | Object storage for uploaded feed files and CDN log analysis | Configurable per deployment (US by default) |
International transfers
Our primary hosting (Vercel, Supabase) is located in the United States, so personal data processed by ACE is transferred to and stored in the US. For transfers out of the UK and EEA we rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum with each sub-processor, and, where the sub-processor is certified, the EU-US Data Privacy Framework. We do not currently offer EU-region data residency.
Security measures
- Encryption in transit (TLS) everywhere and encryption at rest in our database and storage.
- Store access tokens encrypted at application level with AES-256-GCM.
- API keys stored as salted hashes; plaintext shown once at creation.
- Row-level security scoping every tenant's data in the database.
- IP addresses stored only as salted hashes across all analytics features.
- Role-based access control for team members within a project.
Deletion and return of data
You can export your data at any time (Settings, then Data & Privacy) and delete individual projects or your entire account in the product. Account deletion permanently removes your data from our systems, including uploaded files and generated content, per the retention table in the Privacy Policy. For Shopify installations, the mandatory shop/redact webhook additionally erases all shop-scoped data within 48 hours of uninstall.
Assistance and notification
We assist you with data subject requests that reach us instead of you, notify you without undue delay after becoming aware of a personal data breach affecting your data, and make available the information reasonably necessary to demonstrate compliance with this DPA.
Countersigned copy
If your procurement process requires a countersigned DPA incorporating the Standard Contractual Clauses, contact DPM@rezolve.com.