Data Processing Addendum

1. Definitions

Unless otherwise defined in the Agreement, the following terms have the meanings given below. Terms such as “Controller,” “Processor,” “Data Subject,” “Personal Data,” “Processing,” “Personal Data Breach,” and “Supervisory Authority” have the meanings given in the EU GDPR (or, where applicable, the equivalent concept under UK GDPR, FADP, or CCPA/CPRA).

1.1 “Applicable Data Protection Laws” means all laws and regulations applicable to the Processing of Personal Data under this DPA, including (as applicable) the EU GDPR, UK GDPR, Swiss FADP, CCPA/CPRA, and other U.S. state privacy laws (including the Virginia CDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA, and successor or equivalent laws).

1.2 “Business” and “Service Provider” have the meanings given in the CCPA/CPRA. For purposes of the CCPA/CPRA, Merchant is the Business and VerifyLive is the Service Provider.

1.3 “Merchant Personal Data” means Personal Data relating to Data Subjects that is Processed by VerifyLive on behalf of Merchant in connection with the Service.

1.4 “Restricted Transfer” means a transfer of Merchant Personal Data from the European Economic Area, United Kingdom, or Switzerland to a jurisdiction that is not the subject of an adequacy decision or equivalent mechanism under Applicable Data Protection Laws.

1.5 “Standard Contractual Clauses” or “SCCs” means (a) for Restricted Transfers subject to the EU GDPR, the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, specifically Module Two (Controller-to-Processor); and (b) for Restricted Transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner’s Office (the “UK Addendum”).

1.6 “Sub-Processor” means any third party engaged by VerifyLive to Process Merchant Personal Data in connection with the provision of the Service.

1.7 “Sub-Processor List” means the then-current list of authorized Sub-Processors maintained and published by VerifyLive at verifylive.net/legal/subprocessors, or such successor URL as VerifyLive may designate in writing.

1.8 “TOMs” means the technical and organizational security measures set forth in Annex II to this DPA, as updated from time to time in accordance with Section 5.

2. Roles of the Parties

2.1 Controller and Processor

With respect to Merchant Personal Data Processed under the Agreement, and except as set forth in Section 2.2, Merchant is the Controller (or, where applicable, Business) and VerifyLive is the Processor (or, where applicable, Service Provider). VerifyLive Processes Merchant Personal Data solely on Merchant’s documented instructions, as set forth in this DPA, the Agreement, and any Order Form.

2.2 Limited Independent Controller Processing

VerifyLive acts as an independent Controller of a limited set of Personal Data strictly for the purposes of: (a) fraud prevention, detection, investigation, and network-level threat intelligence across the VerifyLive merchant base; (b) verifying the identity, age, geolocation, and behavioral signals of end users as required by Applicable Data Protection Laws or industry anti-fraud obligations; (c) maintaining and improving the security and integrity of the Service, including billing, account management, and audit logging; and (d) compliance with VerifyLive’s own legal obligations. Processing described in clauses (a) through (d) is carried out on the basis of VerifyLive’s legitimate interests or legal obligations under Applicable Data Protection Laws and is not conducted on behalf of Merchant.

2.3 Aggregated and De-Identified Data

VerifyLive may create aggregated and de-identified datasets derived from Merchant Personal Data for the purposes of producing benchmarks, analytics, threat intelligence, and improvements to the Service. Such datasets will not identify Merchant or any Data Subject and will be maintained such that re-identification is not reasonably possible. Aggregated and de-identified data is not Merchant Personal Data and is owned by VerifyLive.

2.4 Instructions

Merchant’s complete and final instructions to VerifyLive regarding the Processing of Merchant Personal Data are set forth in the Agreement, this DPA (including Annex I), the applicable Order Form, and any configuration settings made available by VerifyLive. If VerifyLive reasonably believes that an instruction from Merchant infringes Applicable Data Protection Laws, VerifyLive will promptly notify Merchant and may, without liability, suspend the affected Processing until the instruction is modified or withdrawn.

3. Description of Processing

3.1 Details in Annex I

The subject matter, duration, nature, and purpose of the Processing, the types of Personal Data Processed, the categories of Data Subjects, and the obligations and rights of Merchant as Controller are set forth in Annex I (Details of Processing) to this DPA.

3.2 Duration

The Processing will continue for the duration of the Agreement and, to the extent permitted or required by Applicable Data Protection Laws, for the retention period set forth in VerifyLive’s published retention schedule.

3.3 Prohibited Processing

VerifyLive will not (a) sell Merchant Personal Data, (b) share Merchant Personal Data for cross-context behavioral advertising, (c) retain, use, or disclose Merchant Personal Data outside of the direct business relationship with Merchant, or (d) combine Merchant Personal Data with Personal Data received from other sources, except as expressly permitted by the CCPA/CPRA and this DPA (including the aggregated and de-identified uses in Section 2.3 and the independent-Controller uses in Section 2.2).

4. Merchant Obligations

4.1 Lawful Basis

Merchant represents and warrants that it has, and will maintain throughout the Term, a lawful basis under Applicable Data Protection Laws to disclose Merchant Personal Data to VerifyLive for the Processing described in this DPA, including providing all required notices and obtaining all required consents from Data Subjects.

4.2 Accuracy of Instructions

Merchant is solely responsible for the accuracy, quality, and legality of Merchant Personal Data and for the means by which Merchant acquired Merchant Personal Data.

4.3 Sensitive and Prohibited Data

Merchant will not submit to the Service any special categories of Personal Data (as defined in Article 9 of the EU GDPR), biometric identifiers (other than behavioral signals collected by the Service), data concerning health, data concerning children under thirteen (13) years of age in violation of COPPA, or payment card primary account numbers, except as expressly contemplated by the Service documentation. VerifyLive is not designed to Process such data and assumes no obligations with respect to such data beyond those required by Applicable Data Protection Laws.

5. VerifyLive Obligations

5.1 Compliance with Instructions

VerifyLive will Process Merchant Personal Data only on Merchant’s documented instructions, except where Applicable Data Protection Laws require otherwise. In such a case, VerifyLive will inform Merchant of the legal requirement before Processing, unless that law prohibits such notice on important grounds of public interest.

5.2 Confidentiality

VerifyLive will ensure that all personnel authorized to Process Merchant Personal Data are bound by appropriate written obligations of confidentiality and have received privacy and security training appropriate to their role.

5.3 Technical and Organizational Measures

VerifyLive will implement and maintain the TOMs set forth in Annex II to ensure a level of security appropriate to the risk. VerifyLive may update the TOMs from time to time, provided that any such update does not materially diminish the overall level of protection afforded to Merchant Personal Data.

5.4 Assistance to Merchant

Taking into account the nature of the Processing and the information available to it, VerifyLive will provide reasonable assistance to Merchant in: (a) responding to requests from Data Subjects seeking to exercise rights under Applicable Data Protection Laws (see Section 7); (b) ensuring compliance with Merchant’s obligations regarding security of Processing; (c) notifying Personal Data Breaches to Supervisory Authorities and affected Data Subjects, as set forth in Section 8; and (d) conducting data protection impact assessments and, where required, prior consultations with Supervisory Authorities, as set forth in Section 9.

5.5 Records

VerifyLive will maintain records of its Processing activities as required by Article 30(2) of the EU GDPR and equivalent provisions of other Applicable Data Protection Laws, and will make such records available to Merchant or the relevant Supervisory Authority upon reasonable written request.

6. Sub-Processors

6.1 General Authorization

Merchant grants VerifyLive a general authorization to engage Sub-Processors for the Processing of Merchant Personal Data, provided that VerifyLive complies with this Section 6.

6.2 Current Sub-Processors

The Sub-Processors engaged by VerifyLive as of the Effective Date are listed in the Sub-Processor List, which is incorporated into this DPA by reference and is available at verifylive.net/legal/subprocessors. A summary of the current Sub-Processor List is set forth in Annex III for convenience; in the event of any conflict between Annex III and the published Sub-Processor List, the published list controls.

6.3 Notice of Changes

VerifyLive will provide Merchant with prior written notice of the addition or replacement of any Sub-Processor by (a) updating the published Sub-Processor List and (b) providing notification to the email address on file for Merchant or through the VerifyLive console, in either case at least thirty (30) days before the new Sub-Processor begins Processing Merchant Personal Data, except where a shorter notice period is required for operational or security reasons (in which case VerifyLive will provide as much notice as is reasonably practicable).

6.4 Right to Object

Merchant may object to a new Sub-Processor on reasonable data-protection grounds by written notice delivered to VerifyLive within fifteen (15) days of the notice under Section 6.3. The Parties will work together in good faith to resolve the objection. If the Parties cannot resolve the objection within thirty (30) days, Merchant’s sole and exclusive remedy is to terminate the affected portion of the Service on written notice to VerifyLive, with a pro-rated refund of any prepaid, unused Fees attributable to the terminated Service.

6.5 Flow-Down Obligations

VerifyLive will enter into a written agreement with each Sub-Processor that imposes data-protection obligations no less protective than those set forth in this DPA, including obligations of confidentiality, security, assistance with Data Subject rights, and breach notification. VerifyLive remains fully liable to Merchant for the performance of each Sub-Processor’s obligations under such agreement.

7. Data Subject Rights

7.1 Forwarding Requests

If VerifyLive receives a request from a Data Subject seeking to exercise rights under Applicable Data Protection Laws with respect to Merchant Personal Data (including rights of access, rectification, erasure, restriction, portability, objection, and opt-out of sale/sharing), VerifyLive will, without undue delay, forward the request to Merchant and will not respond to the Data Subject except to confirm receipt, unless required to do so by Applicable Data Protection Laws.

7.2 Assistance

Taking into account the nature of the Processing, VerifyLive will provide commercially reasonable assistance, including through appropriate technical and organizational measures, to enable Merchant to fulfill its obligation to respond to Data Subject requests within the time period required by Applicable Data Protection Laws.

7.3 Costs

Assistance provided by VerifyLive under this Section 7 up to a reasonable threshold of activity is included in the Fees. If Merchant’s requests for assistance are disproportionate to the scope of the Service or become manifestly excessive, VerifyLive may charge a reasonable fee for such assistance at its then-current professional services rates, upon prior written notice to Merchant.

8. Personal Data Breach Notification

8.1 Notification Timing

VerifyLive will notify Merchant of a Personal Data Breach affecting Merchant Personal Data without undue delay, and in any event within seventy-two (72) hours of VerifyLive’s confirmation of the breach. Merchants subscribed to the Business or Enterprise tier (pursuant to a separately-executed DPA) may be entitled to a shorter notification window.

8.2 Content of Notice

To the extent known at the time of notification, VerifyLive’s notice will include: (a) a description of the nature of the Personal Data Breach, including (where possible) the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned; (b) the likely consequences of the Personal Data Breach; (c) the measures taken or proposed to be taken by VerifyLive to address the Personal Data Breach, including measures to mitigate its possible adverse effects; and (d) the name and contact details of the VerifyLive privacy contact from whom further information may be obtained.

8.3 Cooperation

VerifyLive will cooperate with Merchant in the investigation, mitigation, and remediation of a Personal Data Breach, and will provide such further information as is reasonably necessary for Merchant to meet its own notification obligations under Applicable Data Protection Laws.

8.4 No Admission of Liability

VerifyLive’s provision of notice under this Section 8 is not, and will not be construed as, an acknowledgment of any fault or liability of VerifyLive with respect to the Personal Data Breach.

9. Data Protection Impact Assessments

Upon Merchant’s reasonable written request, VerifyLive will provide Merchant with documentation and information reasonably necessary to enable Merchant to carry out a data protection impact assessment or, where required, a prior consultation with a Supervisory Authority under Articles 35 and 36 of the EU GDPR (or equivalent provisions of other Applicable Data Protection Laws). VerifyLive’s obligation under this Section 9 is limited to the information reasonably available to it and may be satisfied, in whole or in part, through the provision of VerifyLive’s then-current security questionnaire responses, audit reports (including SOC 2 Type II reports, when available), and published documentation.

10. International Transfers

10.1 Authorization of Transfers

Merchant authorizes VerifyLive to transfer Merchant Personal Data outside the European Economic Area, United Kingdom, or Switzerland (as applicable) where necessary for the provision of the Service, subject to the safeguards in this Section 10.

10.2 EU Restricted Transfers

For Restricted Transfers of Merchant Personal Data subject to the EU GDPR from Merchant (as data exporter) to VerifyLive (as data importer), the Parties agree that the EU SCCs Module Two (Controller-to-Processor) are incorporated into this DPA by reference and shall apply, with the following completions: (a) in Clause 7, the optional docking clause does not apply; (b) in Clause 9, Option 2 (general written authorization) applies, with the time period for advance notice of Sub-Processor changes set at thirty (30) days as provided in Section 6.3; (c) in Clause 11, the optional language regarding independent dispute resolution does not apply; (d) in Clause 17, the governing law is the law of the Republic of Ireland; (e) in Clause 18, the forum for disputes is the courts of Ireland; and (f) the Annexes to the EU SCCs are deemed completed by the information set forth in Annexes I, II, and III to this DPA.

10.3 UK Restricted Transfers

For Restricted Transfers subject to the UK GDPR, the Parties agree that the UK Addendum is incorporated into this DPA by reference and shall apply to such transfers, with the EU SCCs (as completed in Section 10.2) forming the underlying SCCs for purposes of the UK Addendum. Table 4 of the UK Addendum is completed such that neither Party may end the UK Addendum under Section 19 when the Approved Addendum changes, unless such change is required by law.

10.4 Swiss Restricted Transfers

For Restricted Transfers subject to the Swiss FADP, the EU SCCs (as completed in Section 10.2) shall apply, with the following deemed modifications: (a) references to the EU GDPR are construed as references to the FADP; (b) the competent Supervisory Authority is the Swiss Federal Data Protection and Information Commissioner; and (c) until the entry into force of the revised FADP, the SCCs also protect Personal Data of legal entities.

10.5 Alternative Transfer Mechanisms

If the SCCs, UK Addendum, or any other transfer mechanism is invalidated, replaced, or amended by a competent authority or court of competent jurisdiction, the Parties will work together in good faith to implement a valid replacement mechanism, including any new standard clauses, binding corporate rules, or supplementary measures that may be required.

11. Audit Rights

11.1 Audit Reports

Upon Merchant’s reasonable written request, and no more than once per calendar year (except where a Personal Data Breach has occurred or where required by a Supervisory Authority), VerifyLive will make available to Merchant its then-current third-party audit reports (including SOC 2 Type II reports, when available), security questionnaires, and summaries of penetration testing results reasonably necessary to demonstrate compliance with this DPA. Such information is VerifyLive Confidential Information and may be shared only with Merchant’s employees, advisors, and auditors who are bound by obligations of confidentiality.

11.2 On-Site Audits

If the information provided under Section 11.1 is not sufficient to demonstrate compliance with this DPA, or where a Supervisory Authority so requires, Merchant (or a mutually-agreed independent third-party auditor bound by obligations of confidentiality) may conduct an on-site audit of VerifyLive’s relevant facilities and systems, subject to: (a) at least thirty (30) days’ prior written notice; (b) reasonable scope and duration agreed in advance; (c) conduct during normal business hours and in a manner that does not unreasonably interfere with VerifyLive’s operations; (d) compliance with VerifyLive’s reasonable security and confidentiality requirements; and (e) the expense of Merchant (unless the audit reveals a material breach by VerifyLive, in which case VerifyLive will bear its own costs). Merchant may not audit more than once per calendar year under this Section 11.2, except in the case of a confirmed Personal Data Breach or as required by a Supervisory Authority.

11.3 Competitors Excluded

Merchant will not engage any person or entity to conduct an audit under this Section 11 who is a competitor of VerifyLive.

12. Return and Deletion

12.1 Return or Deletion on Termination

Upon termination or expiration of the Agreement, and at Merchant’s election communicated in writing within thirty (30) days of termination, VerifyLive will: (a) return Merchant Personal Data to Merchant in a commonly used machine-readable format, or (b) securely delete Merchant Personal Data, except for copies required to be retained by Applicable Data Protection Laws, for archival or backup purposes in accordance with VerifyLive’s documented retention schedule, or for the defense of legal claims.

12.2 Deletion Timeline

VerifyLive will complete the return or deletion contemplated by Section 12.1 within ninety (90) days following Merchant’s election (or, if no election is made, within one hundred twenty (120) days following termination), subject to the retention exceptions in Section 12.1.

12.3 Certification

Upon Merchant’s written request, VerifyLive will provide a written certification that the return or deletion has been completed in accordance with this Section 12, identifying any categories of Merchant Personal Data retained and the applicable legal basis for retention.

13. Liability

The liability of each Party under this DPA is subject to the limitations of liability set forth in Section 13 of the Agreement, including the lesser-of Liability Cap in Section 13.2 of the Agreement and the uncapped carve-outs in Section 13.4 of the Agreement. For the avoidance of doubt, any liability of VerifyLive arising from a breach of this DPA, including statutory damages or administrative fines under Applicable Data Protection Laws, is subject to those limitations except to the extent that Applicable Data Protection Laws do not permit such limitation.

14. General

14.1 Order of Precedence

In the event of any conflict or inconsistency between this DPA and the Agreement with respect to the Processing of Merchant Personal Data, this DPA controls. In the event of any conflict between this DPA and the SCCs (as completed in Section 10.2), the SCCs control.

14.2 Amendment

VerifyLive may amend this DPA from time to time to reflect changes in Applicable Data Protection Laws, guidance from Supervisory Authorities, or VerifyLive’s security practices, provided that no such amendment will materially diminish the overall level of protection afforded to Merchant Personal Data. Material amendments take effect thirty (30) days after notice to Merchant. Non-material amendments take effect immediately upon publication.

14.3 Severability

If any provision of this DPA is held invalid or unenforceable, the remainder will continue in full force and effect, and the invalid or unenforceable provision will be deemed replaced by a valid and enforceable provision that most closely reflects the Parties’ original intent.

14.4 Governing Law

Except as expressly provided in Section 10.2 with respect to the SCCs, this DPA is governed by the laws governing the Agreement, without regard to conflicts-of-law principles.

Annex I — Details of Processing

A. List of Parties

Data Exporter (Controller): Merchant, as identified in the Order Form. Contact point: Merchant’s primary account administrator and privacy contact, as designated in the VerifyLive console. Role: Controller (EU/UK/CH) / Business (CCPA/CPRA).

Data Importer (Processor): VerifyLive LLC, 119 S Western Ave Unit 1, Chicago, Illinois 60612, United States. Contact point: [email protected]. Role: Processor (EU/UK/CH) / Service Provider (CCPA/CPRA).

B. Categories of Data Subjects

• Merchant’s end customers (including prospective customers who initiate a checkout or transaction)
• Merchant’s employees and authorized users who access the VerifyLive console
• Individuals identified in fraud signals, chargeback evidence, or reported incidents

C. Categories of Personal Data

• Identifiers: name, email address, telephone number, billing and shipping address, IP address, device identifier, user account identifier
• Transaction metadata: order amount, currency, payment method type, card brand, tokenized payment reference, last four digits of the payment instrument, timestamps, channel, and platform
• Verification signals: geolocation (country, region, city; never street-level absent consent), device fingerprint signals, behavioral biometrics (keystroke dynamics, mouse and touch movement), risk score outputs
• Age and identity verification attributes (where the AgeAssure or VerifiedHuman features are enabled): confirmed/unconfirmed status, verification timestamp, verification method indicator
• Dispute and chargeback evidence: order history, shipping confirmation, delivery evidence, prior communications provided by Merchant for the purpose of disputing a chargeback

D. Special Categories of Personal Data

VerifyLive is not designed to Process special categories of Personal Data (as defined in Article 9 of the EU GDPR). Merchant is responsible for ensuring that no such data is submitted to the Service except as expressly contemplated by the Service documentation.

E. Nature and Purpose of Processing

VerifyLive Processes Merchant Personal Data to provide the Service to Merchant, including: (i) real-time fraud scoring and identity verification at checkout or point of sale; (ii) behavioral and geolocation risk analysis; (iii) age verification where enabled; (iv) shipping and delivery risk analysis; (v) fraud-aware loyalty and redemption tracking; (vi) evaluation, communication, and settlement of Chargeback Guarantee claims; (vii) dashboard analytics and reporting; (viii) transmission of tokenized signals to Merchant’s integrated Commerce Platform; and (ix) administration, billing, and support of the Service.

F. Duration of Processing

For the duration of the Agreement and thereafter in accordance with VerifyLive’s published retention schedule, except where a longer retention period is required by Applicable Data Protection Laws.

G. Sub-Processors

The Sub-Processors engaged to Process Merchant Personal Data are set forth in the published Sub-Processor List at verifylive.net/legal/subprocessors and summarized in Annex III.

Annex II — Technical and Organizational Measures

VerifyLive maintains the following technical and organizational security measures to ensure a level of security appropriate to the risk. These measures are reviewed no less frequently than annually and may be updated without materially diminishing the overall level of protection.

1. Information Security Program

VerifyLive maintains a written information security program aligned with the NIST Cybersecurity Framework and oriented toward SOC 2 Type II readiness. The program defines roles and responsibilities, risk management, asset inventory, access management, change management, vulnerability management, and incident response.

2. Access Control

Role-based access control enforced through Microsoft Entra ID single sign-on with multi-factor authentication required for all administrative access. Least-privilege access provisioning, quarterly access reviews, and immediate revocation upon personnel changes. Privileged actions logged and monitored.

3. Encryption

Merchant Personal Data is encrypted in transit using TLS 1.2 or higher (with TLS 1.3 preferred) and at rest using AES-256 or equivalent. Cryptographic key material is managed through managed key services with rotation policies. Evidence records carry post-quantum-ready dual signatures.

4. Network and Application Security

Perimeter protection through a web application firewall (Cloudflare WAF), DDoS protection, and bot mitigation. Segmented network architecture separating production, staging, and development environments. Regular static and dynamic application security testing. CI/CD pipelines include automated pre-deployment security scanning.

5. Vulnerability Management

Continuous dependency scanning, regular vulnerability assessments, and prompt remediation of identified issues based on severity. Critical and high-severity issues targeted for remediation within commercially reasonable windows consistent with industry practice.

6. Logging and Monitoring

Centralized logging with tamper-evident storage, security information and event monitoring (SIEM), alerting on suspicious activity, and retention of security-relevant logs for no less than twelve (12) months.

7. Incident Response

Documented incident response plan with defined roles, escalation paths, communications procedures, and post-incident review. Breach notification procedures aligned with Section 8 of this DPA.

8. Personnel Security

Background checks on personnel with access to Merchant Personal Data (to the extent permitted by applicable law), written confidentiality obligations, mandatory security and privacy training on hire and annually thereafter, and role-based training for personnel with elevated responsibilities.

9. Vendor and Sub-Processor Management

Security review of Sub-Processors prior to engagement, contractual flow-down of obligations consistent with this DPA, and ongoing monitoring of Sub-Processor security posture.

10. Physical Security

Processing of Merchant Personal Data is carried out in data centers operated by established cloud infrastructure providers that maintain industry-standard physical security controls, including biometric access, 24/7 surveillance, environmental monitoring, and redundant power and network infrastructure.

11. Business Continuity and Disaster Recovery

Documented business continuity and disaster recovery plans, with recovery objectives commensurate with the criticality of the Service. Backup procedures designed to protect against data loss and to enable timely restoration.

12. Data Minimization

The Service is designed to receive, process, and retain the minimum Personal Data necessary to provide fraud prevention, verification, and related functions. The Service does not receive or store full primary account numbers, card verification values, or card expiration dates.

Annex III — Summary Sub-Processor List

The following is a summary of VerifyLive’s current Sub-Processors as of the Effective Date of this DPA. The authoritative, up-to-date list is published at verifylive.net/legal/subprocessors and is incorporated into this DPA by reference. In the event of any conflict between this Annex III and the published Sub-Processor List, the published list controls.

Sub-Processor

Purpose

Data Categories

Location / Safeguard

Microsoft Corporation (M365 / Entra ID)

Identity, email, productivity, support ticketing

Merchant contact identifiers, support correspondence

United States / EU. EU SCCs via Microsoft DPA.

Google LLC (Google Cloud Platform)

ML model training infrastructure, logging

De-identified training data, operational logs

United States / EU. EU SCCs via Google Cloud DPA.

Cloudflare, Inc.

Edge network, WAF, DDoS protection, bot management

IP addresses, request metadata, tokenized signals

Global edge / U.S. EU SCCs via Cloudflare DPA.

Railway Corp.

Inference hosting for fraud-detection models

Request-time feature vectors (tokenized)

United States. EU SCCs via Railway DPA.

Render Services, Inc.

Application hosting (core API and dashboard)

Encrypted Merchant Personal Data at rest

United States. EU SCCs via Render DPA.

Vercel Inc.

Marketing website, documentation hosting

Website analytics, form submissions

Global edge / U.S. EU SCCs via Vercel DPA.

GitHub, Inc. (Microsoft)

Source control, CI/CD, security scanning

Engineering metadata only (no Merchant Personal Data)

United States. EU SCCs via Microsoft/GitHub DPA.

MaxMind, Inc. (minFraud)

Geolocation and IP-reputation signals

IP address, device signals, request metadata

United States. EU SCCs via MaxMind DPA.

Stripe, Inc. (Stripe Connect)

Chargeback Guarantee settlement payouts to Merchants

Merchant payout identifiers, settlement amounts

United States / EU. EU SCCs via Stripe DPA.

Shopify Inc.

Platform adapter (for Shopify Merchants)

Order, customer, and product metadata

Canada / U.S. EU SCCs via Shopify DPA.

Block, Inc. (Square)

Platform adapter (for Square Merchants)

POS, invoice, appointment, and customer metadata

United States. EU SCCs via Square DPA.

Anthropic, PBC

AI reasoning — fraud-pattern reasoning

De-identified signal summaries (no direct identifiers)

United States. API with zero-retention configuration.

Google LLC (Generative AI API)

AI reasoning — fraud-pattern reasoning

De-identified signal summaries (no direct identifiers)

United States. API with zero-retention configuration.

X.AI Corp.

AI reasoning — fraud-pattern reasoning

De-identified signal summaries (no direct identifiers)

United States. API with zero-retention configuration.

Notifications of additions or replacements of Sub-Processors are provided in accordance with Section 6.3 of this DPA.

15. Execution

15.1 Electronic Acceptance (Default for Standard Tiers)

For Merchants subscribed through the VerifyLive self-serve onboarding flow (Shield Lite, Growth, Founders Growth, Founders Pro Scale, Founders Pro Elite, and Professional tiers), this DPA is accepted electronically at the time Merchant accepts the Agreement through click-through, check-box, or in-product acceptance. Electronic acceptance has the same force and effect as a manual signature. No separate signed copy of this DPA is required for electronic acceptance to be binding.

15.2 Optional Signed Copy

If Merchant requires a countersigned copy of this DPA for its internal records or regulatory purposes, Merchant may execute the signature block below and return it to [email protected]. VerifyLive will return an executed counterpart within ten (10) business days.

MERCHANT

By: ___________________________________

Name: ________________________________

Title: _________________________________

Date: _________________________________

Merchant legal name: __________________

Order Form / Subscription ID: ___________

VERIFYLIVE LLC

By: ___________________________________

Name: Tom McDonald

Title: Founder & Chief Executive Officer

Date: _________________________________