Data Processing Addendum
Last updated 2026-10-22 · Version 2026-10-22
Pre-launch draft: these documents require lawyer review before launch.
Legal contact: [email protected]. Service operator: Applixus A.Ş., Turkey.
Roles and documented instructions
This DPA applies when a business customer controls personal data in store listings, authorized store imports or workspace content and Applixus A.Ş. processes it on that customer's behalf. The customer determines purposes and lawful basis; Applixus processes only documented instructions to provide asoplan.ai. Account security and billing processing may be separate controller activities. Processing lasts for the service term and necessary deletion period; data subjects may include the customer's staff and store users whose data the customer lawfully supplies.
Protection and assistance
Apply confidentiality, least-privilege access, tenant separation and appropriate technical and organizational measures. Applixus will assist with data-subject requests, security assessments and breach obligations to the extent required by law and the service. Notify the customer without undue delay after becoming aware of a personal-data breach affecting customer data. Provide reasonable compliance information and proportionate audit cooperation subject to security and confidentiality safeguards.
Sub-processors and transfer safeguards
The service-provider list is DigitalOcean (hosting), OpenRouter (AI routing), fal.ai (creative generation), MailerSend (transactional email), Paddle (payments), PostHog (analytics) and Upstash (rate limiting). Provider roles depend on the operation: Paddle may be an independent controller as merchant of record rather than a sub-processor. Applixus must bind actual sub-processors to appropriate obligations, maintain locations and transfer safeguards, and notify customers of material changes with a reasonable opportunity to object before use. This list does not itself establish a lawful international-transfer mechanism.
Return and deletion
On termination, return or delete customer personal data on documented request, except legally required retention and securely isolated backup copies removed on their retention cycle. Customers must not supply unnecessary sensitive data or credentials outside designated secure connection flows. Commercial details, audit arrangements and transfer instruments must be reviewed and finalized before launch.