Merchant Data Processing Agreement

This Data Processing Agreement ("DPA") is between Raw Guild Studios LLC, a New York limited liability company that operates Cloud Catalogue ("we", "us"), and the merchant legal entity identified in its Cloud Catalogue account registration, order or acceptance record ("Merchant", "you").

This DPA supplements the Cloud Catalogue Terms of Service (the "Terms"). It applies only to personal data we process on your behalf when providing the Services ("Customer Personal Data"). Personal data we process for our own purposes as an independent controller (for example account administration, security, billing records and legal compliance) is described in our Privacy Policy and is not governed by this DPA, except where this DPA expressly says otherwise.

This DPA is accepted electronically. A valid acceptance records the exact version and fingerprint shown, the account, the person accepting, their confirmation that they are authorized to bind the Merchant, the Merchant's legal name, role and country, and the time. Where a statutory transfer instrument must be signed or completed in a prescribed form, that is a separate step described in Annex IV and Annex VI.

• Applicable Privacy Laws means, to the extent each applies to the processing in question: the EU General Data Protection Regulation 2016/679 ("GDPR"); the GDPR as retained in UK law and the UK Data Protection Act 2018 ("UK GDPR"); the Swiss Federal Act on Data Protection ("FADP"); the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations ("CCPA") and other applicable US state privacy laws; Canada's PIPEDA and applicable provincial laws; Brazil's Lei Geral de Proteção de Dados ("LGPD"); Türkiye's Law No. 6698 on the Protection of Personal Data ("KVKK"); Singapore's Personal Data Protection Act ("PDPA"); Australia's Privacy Act 1988; New Zealand's Privacy Act 2020; and any other data protection law that applies to the processing.
• Customer Personal Data means personal data that we process on your behalf in providing the Services, as described in Annex I.
• Controller, processor, personal data, processing and data subject have the meanings given in the Applicable Privacy Laws (including equivalent terms such as "business", "service provider" and "contractor" under the CCPA).
• Subprocessor means a third party we engage that processes Customer Personal Data on our behalf.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• Restricted Transfer means a transfer of Customer Personal Data that, under Applicable Privacy Laws, is permitted only with an adequacy decision or another approved safeguard.
• Services means the Cloud Catalogue services described in the Terms and in Section 4.

You decide why and how Customer Personal Data is processed. You are responsible for the purposes of collection, the legal basis, notices to and consents from individuals, accuracy, who receives the data, how long it is kept, responses to individuals' requests, and any marketing you carry out.

We act only on your documented instructions (Section 4) and carry out the duties that Applicable Privacy Laws place on processors.

If you are a processor acting for another controller, you warrant that the instructions you give us are authorized by that controller, and we act as your subprocessor.

We act as an independent controller only for limited processing needed to run our business: account administration, service security and abuse prevention, legally required accounting and tax records, compliance, and the establishment or defense of legal claims.

Paddle (Paddle.com Market Limited and its affiliates) sells Cloud Catalogue subscriptions as Merchant of Record. Paddle generally acts as an independent controller for payment and transaction data under its own terms and data-sharing arrangements. It is not a subprocessor of your catalog data. We do not receive or store payment card numbers.

You instruct us to process Customer Personal Data only to provide these Services: creating and editing catalogs; importing and exporting product data; producing sell sheets and line sheets; storing product images; generating branded PDFs; creating private buyer links; receiving buyer order requests (these are requests only — Cloud Catalogue does not provide buyer checkout, payment, fulfillment or inventory); team access you grant; customer support and security; and lawful export or deletion.

Your use and configuration of the Services, and this DPA, are your complete instructions. Any other instruction must be in writing, accepted by us, lawful and technically feasible, and may be subject to agreed fees.

We will tell you if we believe an instruction breaks Applicable Privacy Laws, unless the law prohibits telling you. We may disclose Customer Personal Data where the law requires it; we will limit the disclosure to what is required and notify you first where the law allows.

You warrant that you have the legal right to provide Customer Personal Data to us, that you have given the notices and obtained the consents the law requires, and that your instructions are lawful.

The Services are designed for ordinary business-to-business catalog and contact information, such as buyer names, business email addresses, phone numbers and business addresses. Unless we have agreed specific controls with you in writing, you must not upload or collect through the Services: health or medical information (including information protected by HIPAA); payment card numbers; passwords or other credentials of third parties; government identification numbers; biometric or genetic data; information about criminal convictions or offenses; information about children; special category or sensitive personal data; or data that the law requires to be stored only in a particular country.

We restrict access to Customer Personal Data to personnel and providers who need it to provide the Services and who are bound by confidentiality.

We apply security measures appropriate to the risk, described truthfully in Annex II.

We do not sell Customer Personal Data, use it for advertising unrelated to the Services, or use it to train artificial intelligence models.

Taking into account the nature of the processing and the information available to us, we provide reasonable assistance with individuals' requests, security, data protection impact assessments, prior consultations and regulators' requests.

We keep records of processing and cooperate with supervisory authorities as Applicable Privacy Laws require.

You give general authorization for the subprocessors listed in Annex III as of the date you accept. Annex III states, for each provider, which facts have been verified and which have not.

We will give at least 30 days' notice before adding or replacing a subprocessor where practicable and lawful; where a shorter period is needed (for example an urgent security replacement), we will notify you as soon as possible.

You may object on reasonable data protection grounds within 15 days of notice. We will try in good faith to resolve the objection. If we cannot, you may terminate the affected Services, and any refund owed under the Terms or mandatory law will apply.

We will put written terms in place with each subprocessor that impose data protection obligations appropriate to the processing, and we remain responsible to you for our subprocessors' performance as Applicable Privacy Laws require.

Our controls include separation of each merchant's data, authentication for accounts, least-privilege database access rules, private storage for product images, and expiring signed links to stored files, as described in Annex II.

Some limits are inherent to how the Services work. A signed file link that has already been issued keeps working until it expires (currently no longer than one hour). Private buyer links work for anyone who has them, so a buyer you share a link with can pass it on. Files that have been downloaded or emailed cannot be recalled.

You are responsible for your account credentials, for the roles you give teammates, and for whom you share buyer links with. These responsibilities do not reduce the security obligations the law places on us as processor.

We will notify you without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. We will provide, as it becomes available and in stages if necessary, the nature of the breach, the categories and approximate number of individuals and records concerned, the likely consequences, and the measures taken or proposed.

We will reasonably assist your investigation. You decide whether to notify supervisory authorities and individuals where you are the controller. Each party remains responsible for meeting the notification duties that apply to it by law.

If we receive a request from an individual about Customer Personal Data, we will forward it or direct the person to you, and we will not respond to it ourselves except to confirm that we passed it on, unless the law requires otherwise.

We will not disclose Customer Personal Data in response to such a request without your validation.

We will reasonably assist you, through the Services or otherwise, to meet requests for access, correction, deletion, portability, restriction, objection and similar rights within the deadlines the law sets. Identity verification must be proportionate and must not unlawfully obstruct the request.

We keep Customer Personal Data while your account is active.

After a paid subscription ends, catalogs remain available view-only for 90 days. Content is removed after that period only after we have sent a first notice at least 30 full days, and a final notice at least 7 full days, before the removal date, measured from when our email provider accepted each notice. If a notice is sent late, the removal date moves later so that both periods are met. Acceptance by the email provider does not prove that the message reached the inbox.

Removal is paused for legal holds, open disputes or refunds, and records the law requires us to keep (such as billing and tax records), which we keep separately and only as long as required.

Until the automated process described above is switched on and announced in our Privacy Policy, removal after the 90-day period is carried out manually. A verified deletion request does not need to wait for the 90-day period.

You can export your data at any time while you have access. On written request at the end of the Services we will delete or return Customer Personal Data unless the law requires us to keep it.

Copies held in our providers' backups and in email-delivery and AI-provider logs are deleted when they expire under those providers' terms. We have not yet verified those retention periods and do not promise immediate erasure of backup copies. We record deletion as complete only when we have verified it; a ticket or schedule alone is not treated as proof.

Being able to buy Cloud Catalogue in a country does not by itself mean a transfer of personal data from that country is lawful. Payment-provider coverage is not a transfer permission.

Where a Restricted Transfer from the European Economic Area is made from you as controller to us as processor, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) Module Two apply; where you are a processor and we are your subprocessor, Module Three applies, only if those roles are accurate. The Clauses must be completed with all Annexes and used without modification.

For the United Kingdom, the ICO International Data Transfer Addendum to the EU Clauses (or the IDTA) applies with its mandatory tables completed. For Switzerland, the EU Clauses apply with the amendments required for the FADP. For Brazil, the standard contractual clauses approved by ANPD Resolution CD/ANPD No. 19/2024 apply where required. For Türkiye, the standard contract published by the Personal Data Protection Authority under KVKK Article 9 applies where required, including notification to the Authority within five business days of signature. For Singapore, the comparable-protection requirements of the PDPA apply. Other countries are covered in Annex V.

The mechanism used depends on the actual region, parties and roles of each transfer. We carry out transfer impact or risk assessments where the law requires. We do not claim certification under the EU–US Data Privacy Framework. No transfer instrument is represented as executed unless it has actually been executed (Annex VI).

Where an executed transfer instrument requires a particular governing law or courts, those terms prevail over Section 19.

If a government authority requests Customer Personal Data, we will notify you where lawful, disclose only what is legally required, and consider challenging requests that appear unlawful or disproportionate.

Where the CCPA applies, we act as your service provider or contractor. We process Customer Personal Data only for the specified business purposes in Section 4. We do not sell or share it (as those terms are defined in the CCPA), retain, use or disclose it outside the direct business relationship with you, or combine it with other personal data except as the CCPA permits.

We will comply with the CCPA and provide the same level of privacy protection it requires. You may take reasonable and appropriate steps to ensure our use is consistent with your obligations, including those described in 11 CCR § 7051, and to stop and remediate unauthorized use. We will tell you if we can no longer meet our obligations. We pass equivalent obligations to our subprocessors and help you respond to consumer requests.

Where other US state privacy laws apply, we will meet the processor obligations those laws require.

Optional AI support answers in Cloud Catalogue are generated by a model provider through our hosting provider's AI gateway. We do not use Customer Personal Data to train AI models, and we do not authorize providers to do so.

We have not yet verified the retention and training terms that apply to these downstream providers, and we do not claim that any provider guarantees exclusion from training. Do not paste personal or sensitive information into support chat.

We will make available the information reasonably necessary to demonstrate compliance with this DPA, such as written answers and available reports. Where the law requires, we will allow reasonable audits or inspections by you or an auditor you appoint, on reasonable notice, under confidentiality, and in a way that protects other customers' data and our security.

We will not charge fees that would prevent you from exercising audit rights the law gives you.

You will indemnify us against third-party claims, regulatory fines (only where the law allows indemnity for them) and reasonable costs, to the extent they result from your unlawful collection of personal data, your unlawful marketing, your unauthorized sharing of personal data, or instructions you gave us that break the law.

This indemnity does not cover losses caused by our own negligence, breach or wrongdoing, or obligations the law places on us that cannot be transferred.

The limitation of liability in the Terms applies to this DPA only to the extent the law permits. It does not limit liability under executed Standard Contractual Clauses or other mandatory transfer terms, the rights of individuals or supervisory authorities, or any processor responsibility that cannot lawfully be limited.

We may update this DPA by publishing a new version and giving notice. Each acceptance is bound to the version accepted. A new version binds you only when you accept it or as the law otherwise permits. Changes never silently waive rights under a version you accepted or under an executed transfer instrument. If a change in law makes the processing impossible to continue lawfully, we may suspend the affected processing and will tell you.

For ordinary commercial disputes under this DPA, New York law applies and the state courts in Suffolk County, New York, or the US District Court for the Eastern District of New York, have jurisdiction. This does not apply where executed Standard Contractual Clauses or other mandatory transfer terms require a different governing law or courts (for EU Clauses we propose Irish law and the courts of Ireland, if agreed as those Clauses allow), where the law gives individuals or authorities a forum that cannot be waived, or to the powers of any supervisory authority.

Notices under this DPA go to hello@cloudcatalogue.co, and to the email address of the Merchant's account owner. We do not list a physical service address in this document.

If documents conflict, the following order applies: mandatory law and executed statutory transfer instruments; then this DPA for the processing of Customer Personal Data; then the Terms, whose limitation of liability applies only as stated in Section 17. Our Privacy Policy governs our processing as independent controller.

• Parties: Raw Guild Studios LLC (New York LLC), operating Cloud Catalogue, contact hello@cloudcatalogue.co, acting as processor (or subprocessor). The Merchant legal entity named in the acceptance record, acting as controller (or processor).
• Data subjects: the Merchant's buyers and prospective buyers; Merchant team members; individuals who appear incidentally in product images.
• Categories of data: names; business email addresses; phone numbers; business and shipping addresses entered by buyers; order request lines and notes; team member account details; product images; technical data such as access logs needed for security.
• Sensitive data: none intended (see Section 5).
• Nature and purpose: hosting and displaying catalogs, generating PDFs, serving private buyer links, receiving buyer order requests, team collaboration, support and security. No buyer payment, fulfillment or inventory processing.
• Duration: for the term of the Services plus the retention periods in Section 11.
• Exporter, importer and destinations: determined for each transfer from the acceptance record and Annex III; recorded per Merchant in the acceptance and transfer records.

These are the measures currently implemented in the Services. They have not been independently audited or certified.

• Database access rules that separate each merchant's data and restrict teammates to the catalogs and permissions granted to them.
• Account sign-in through our hosting provider's authentication service.
• Product images and fonts kept in private storage, served through signed links that expire (currently no longer than one hour; buyer-page image links currently expire sooner).
• Upload checks on file type and size, with server-side storage quotas.
• Privileged server keys kept on the server only; administrator functions require a verified administrator role.
• Rate limits on public endpoints and on AI support usage.
• Append-only audit records for billing, compliance, privacy requests and deletion steps.
• Deletion steps recorded with a proof record per table and storage bucket; backup and provider copies are not represented as deleted.
• Backup retention periods and locations: not yet verified with our provider.
• AI support: optional, used only on request by signed-in paying accounts.

Status as of November 9, 2026. "Unverified" means we have not yet confirmed the fact from a contract or the provider's written terms for our account.

• Lovable Labs Incorporated (app hosting, build platform and managed backend: database, authentication, storage, email sending and AI gateway). Lovable publishes a vendor-signed DPA (version dated November 17, 2025). Its applicability to our workspace depends on a Business plan, scheduled for November 18, 2026, and is not yet verified. Lovable's own subprocessors are listed at lovable.dev/subprocessors. Locations: unverified. Lovable's DPA does not automatically cover Add-on Service providers.
• Database, storage and backup infrastructure used by Lovable's managed backend. Entity, location and backup retention: unverified.
• Cloudflare (application runtime and inbound email routing). Scope, entity, location and terms: unverified.
• AI model provider reached through Lovable's AI gateway (optional support answers). Entity, location, retention and training terms: unverified.
• Inbound mailbox forwarding service for hello@cloudcatalogue.co. Provider and terms: unverified.
• Not a subprocessor: Paddle, which acts as Merchant of Record and generally as independent controller for payment and transaction data.

Changes to this list are published as a new register version and notified under Section 7.

• EU Standard Contractual Clauses: Commission Implementing Decision (EU) 2021/914, official text at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj. Module Two (controller to processor) or Module Three (processor to processor) as the roles require; Clause 7 docking clause; Clause 9 option 2 (general authorization, notice period per Section 7); Clause 11 optional redress clause not used; Clause 13 supervisory authority per the exporter's establishment; Clauses 17 and 18 proposed Irish law and courts. Annexes I–III of the Clauses are completed from Annexes I–III of this DPA.
• UK: the ICO International Data Transfer Addendum to the EU Clauses (version B1.0, in force March 21, 2022), official text published by the UK Information Commissioner's Office, with Tables 1–4 completed; or the IDTA.
• Switzerland: the EU Clauses with the amendments recognized by the Federal Data Protection and Information Commissioner (references to the GDPR read as the FADP, the FDPIC as competent authority, and Swiss courts available to data subjects in Switzerland).

These instruments must be used in their full prescribed text, completed and executed by authorized representatives of both parties. A link on this page, a checkbox, or acceptance of this DPA by itself does not execute them. Until executed, no Restricted Transfer under them is represented as covered.

• Brazil: ANPD standard contractual clauses (Resolution CD/ANPD No. 19/2024), where an international transfer requires them.
• Türkiye: the standard contract under KVKK Article 9, signed and notified to the Authority within five business days, where required.
• Singapore: a contract or other legally enforceable obligation giving comparable protection, as the PDPA transfer rules require.
• Canada, Australia and New Zealand: contractual protections and notices as the applicable federal, provincial or national law requires.
• Other countries: the mechanism local law requires, assessed for the actual transfer.

We do not claim that any single document makes processing compliant in every country. Each country is enabled for purchase only after its own requirements have been reviewed and recorded.

Each acceptance stores: the DPA version and SHA-256 fingerprint; the account and the person accepting; their confirmation of authority to bind the Merchant; the Merchant's legal name, role (controller or processor) and country; and the time. Records cannot be edited or deleted.

Where a prescribed transfer instrument is required, the record also states which instrument and module applies and whether it has been executed. Execution of such an instrument is recorded only when both parties have actually signed or completed it. No signature is ever created on a party's behalf, and no counsel review is implied.