Rotozoom Data Processing Agreement
Version 2026-10 (effective on publication)
1. Parties and how this agreement is concluded
- Controller: the business that operates the WooCommerce shop and uses a Rotozoom cloud feature ("the Shop").
- Processor: LEDLIGHTINGS EOOD (LEDLIGHTINGS LTD.), str. Stefan Stambolov 1, Zlatograd, Bulgaria, VAT No. BG204173724 ("Rotozoom"). Data-protection contact: dpo@rotozoom.com.
- Part of the agreement: this Data Processing Agreement forms part of the agreement between the Shop and Rotozoom under the Rotozoom Terms of Service. It is published at rotozoom.com/dpa.
- Order of precedence: for the processing of personal data, this agreement prevails over the Terms of Service.
1a. Acceptance
- The Shop accepts this agreement together with the Terms of Service, electronically, when it creates a Rotozoom account and again at each checkout, by ticking the box (or confirming the notice) next to the button. No separate signature is needed.
- Rotozoom stores on the Shop's account which version of this agreement was accepted and when. The current version can be downloaded at any time from rotozoom.com/dpa; the Shop may ask for the version it accepted at dpo@rotozoom.com.
- The person accepting confirms that they are authorised to bind the Shop.
- A new version takes effect as described in §14; the next sign-up or checkout records acceptance of the new version.
- Accounts that existed when this version was published were notified, and their acceptance of this version was recorded with the version, the date and the basis of acceptance.
- A Shop that uses a cloud feature without a Rotozoom account (for example the Sales Assistant from wordpress.org) is bound by this agreement for that processing from the moment it switches the feature on, as provided in the Terms of Service.
2. Subject matter and duration
- Subject matter: Rotozoom processes personal data on the Shop's behalf to provide the cloud features of the Rotozoom plugins listed in Annex 1.
- Duration: while the Shop uses at least one such feature, plus the deletion periods in Annex 1 and §12.
3. Nature and purpose of the processing
Per service, see Annex 1. In general: receiving data from the Shop's site, storing it in the EU, sending it to AI or messaging providers where the feature needs it, returning results to the Shop, and deleting it on schedule. Rotozoom processes the data only to provide the feature to that Shop.
Rotozoom's own processing (as controller, not covered by this agreement): licensing and billing records about the Shop, usage counters and credit balances (no message text), security logs and abuse prevention, aggregated statistics that contain no personal data of the Shop's customers, and anonymised industry-pool excerpts (below).
Industry knowledge pools (Sales Assistant).
- Instruction. If the Shop chooses an industry knowledge pool in the Sales Assistant settings, the Shop instructs Rotozoom to: (1) take conversations of 8 or more messages; (2) remove personal data from them — names, e-mail addresses, phone numbers, addresses, order numbers and other identifiers — automatically before anything is stored (if removal fails, nothing is stored; any uncleaned row is deleted within 1 hour); (3) analyse only the redacted text (with Anthropic Claude, Annex 3) and keep the result as anonymised excerpts.
- Purpose: improving the shared answers the assistant gives to shops in the same industry.
- Roles. Steps (1) and (2) are processing on the Shop's behalf under this agreement; the Shop's legal basis towards its customers is its legitimate interest in a better assistant. Anonymised excerpts are not personal data (Recital 26 GDPR); Rotozoom keeps and uses them as its own, without a fixed retention period, until it decides to delete them. If an excerpt is found to still relate to an identifiable person, Rotozoom deletes or corrects it.
- Switching off. The Shop can choose no pool at any time. No new conversations are taken; anonymised excerpts already made are not affected.
4. Categories of data subjects and personal data
| Data subjects | Personal data | Service |
|---|---|---|
| Shoppers / visitors of the Shop | chat messages and anything they type into them; shopping context (product viewed, page titles, cart items); lead details (name, e-mail, phone, request) if the Shop keeps leads on Rotozoom servers; live-chat messages | Sales Assistant |
| Shop staff | names and messages in live chat; account e-mail | Sales Assistant (PRO) |
| Reviewers (the Shop's customers who write a product review) | review text and anything written into it, star rating, product name, language, review photos. Never the reviewer's name, e-mail, phone, address or order number. | Reviews PRO (on release) |
| (on release) Shop customers | name, e-mail, phone, return reason, photos, order and product references; registration e-mail and name (opt-in) | Warranty |
| (on release) B2B partners and their contact persons | company, company ID, VAT number, responsible person, e-mail, phone, IBAN, country, balances, statements | B2B Manager |
| (on release) Suppliers and their contact persons | data in supplier documents and e-mails (names, addresses, bank details on invoices) | Warehouse, Suppliers & Dropshipping |
| (on release) Shop customers (if the Shop enables it) | address lines (transient); one-way hash of a customer identifier | Sell & Ship address check / reputation network |
No special categories (Art. 9 GDPR) are intended. The Shop shall not configure a feature to collect them. Shoppers may type anything into a chat; Rotozoom does not analyse messages for such data.
5. Controller's instructions
- The Shop's instructions are this agreement, the plugin settings the Shop chooses (for example indexing on/off, "Keep leads on Rotozoom servers", pool choice, which helpers are on), and written instructions sent to dpo@rotozoom.com.
- Rotozoom informs the Shop without delay if it believes an instruction infringes data-protection law.
- The Shop is responsible for having a legal basis for the processing and for informing its customers (for example by quoting the plugin's "What is sent" note in its own privacy policy).
6. Confidentiality
Rotozoom ensures that every person authorised to access the data is bound by confidentiality. Access is limited to what is needed to run, secure and support the service.
7. Security measures (Art. 32)
What Rotozoom has in place today (Annex 2 gives the detail):
- EU hosting: database and server functions on Supabase, EU region Ireland (eu-west-1); files in an EU-jurisdiction store (Cloudflare R2) (on release); worker and search servers in the EU (Germany) (on release).
- Encryption in transit: all connections over TLS.
- Separation per installation: every record and file is tied to the Shop's installation ID; file paths are per installation; a Shop can request links only to its own files.
- Signed requests and keys: licence tokens signed with an RSA key held only on the server; plugin updates signed, and Connect installs only signed packages; (on release) each installation signs its requests with its own Ed25519 key (the private key never leaves the site), and Rotozoom signs webhooks to the Shop with a platform key; replayed or out-of-time messages are rejected.
- No public files: downloads only by signed, time-limited links (15 minutes; at most 30 days for a link in an e-mail).
- Automatic retention jobs: Sales Assistant data is deleted by an hourly job (since 11.10.2026); other services by their own jobs at release.
- AI providers with zero data retention where configured: Google Gemini on Vertex AI (global) and Z.ai GLM (Together AI, USA), both through OpenRouter (Sales Assistant); Gemini on Vertex AI EU (Warranty, WSD, Reviews — on release). Anthropic Claude (USA) is used under its standard commercial data policy (no training on API data; inputs and outputs may be kept for a limited period).
- Data minimisation: the Sales Assistant chat does not send shopper names, e-mails, phones or orders; analytics (Product Filter, on release) are daily totals without cookies or IP addresses; image metadata (EXIF/GPS) is removed (Image Optimizer, on release).
- Access control: administrative tools behind an access gateway (Cloudflare Access) limited to named e-mail addresses; secrets held in the platform's secret store; rate limits and daily spending caps per service.
- Abuse protection for outgoing mail (on release): approved templates only, suppression of bounced/unsubscribed addresses per Shop.
- Security review: Rotozoom reviews these measures at least once a year and after any significant change or incident.
Rotozoom may update these measures provided the overall level of protection is not reduced.
8. Sub-processors
General authorisation. The Shop gives general authorisation for the sub-processors in Annex 3. Changes. Rotozoom notifies the Shop of any new or replaced sub-processor by e-mail to the account address and on a public page at rotozoom.com/legal/subprocessors at least 30 days before the change. Where a sub-processor must be replaced urgently (for example because it stops providing the service or no longer offers adequate protection), the notice period is at least 14 days. Objection. The Shop may object on reasonable data-protection grounds within that period. If no solution is found, the Shop may terminate the affected feature (or, if it cannot use the Service without it, this agreement and the Terms of Service) and receives a pro-rata refund of the fees it prepaid for the period after termination. Flow-down. Rotozoom imposes data-protection obligations on each sub-processor equivalent to this agreement (in practice, the provider's own DPA) and remains responsible for them. Emergency change: if a provider fails and the Sales Assistant falls back to the next AI model in the published chain, this is not a change of sub-processor, because every model in the chain is listed in Annex 3.
9. Assistance with data-subject requests
- Rotozoom forwards to the Shop, without undue delay and at the latest within 5 working days, any request it receives from the Shop's customers, and does not answer it itself except to redirect.
- Rotozoom helps the Shop find, export or delete a data subject's data held on Rotozoom servers, on request to dpo@rotozoom.com, within 10 working days.
- Most data lives in the Shop's own WordPress database; the Shop handles that part itself.
- Rotozoom also assists, as far as reasonable, with DPIAs and prior consultation (Art. 35–36), taking into account the information available to it.
10. Personal data breach
- Rotozoom notifies the Shop without undue delay and at the latest within 48 hours after becoming aware of a breach affecting the Shop's data, so that the Shop can meet its own 72-hour deadline towards the supervisory authority.
- The notice contains what is known at the time (nature, categories and approximate numbers, likely consequences, measures taken or proposed, contact point) and is completed as information becomes available.
- Rotozoom keeps a record of breaches and takes immediate steps to contain them.
11. International transfers
- Rotozoom stores the Shop's data in the EU. Some processing takes place outside the EU/EEA, namely the AI step of the Sales Assistant and the product/search vectors (see Annex 1 and 3).
- Rotozoom's servers are in the EU (Ireland). AI replies of the Sales Assistant are generated by providers in the USA and globally (Google, Z.ai GLM, Anthropic).
- Such transfers rely on the European Commission's Standard Contractual Clauses (Module 3, processor to processor) in the provider's agreement, or on the EU–US Data Privacy Framework where the provider is certified, with supplementary measures (zero data retention, minimisation) where configured.
- Rotozoom will not add a new transfer outside the EU/EEA without notice under §8.
12. Deletion or return at the end
- Data is deleted automatically according to the retention periods in Annex 1.
- When the Shop stops using a feature (licence ends, plugin uninstalled, or the Shop asks), Rotozoom deletes the remaining data for that feature within 30 days, except where Union or Member State law requires storage (for example B2B ledger and commission statements, warranty documents: 10 years).
- Return before deletion: before deleting, Rotozoom offers the Shop an export (CSV or JSON) of the data held for that feature on Rotozoom servers (for example leads and live-chat conversations). The Shop can request it at dpo@rotozoom.com within the 30 days.
- Backups are overwritten in their normal cycle.
13. Audits and information
- Rotozoom makes available the information necessary to demonstrate compliance: this agreement, the sub-processor list, a description of the measures, and answers to written questions, which the Shop may send at any time to dpo@rotozoom.com.
- On-site audits (by the Shop or by an auditor it appoints who is bound by confidentiality): at most once in any 12 months, with at least 30 days' written notice, at the Shop's cost, during normal business hours and limited to the systems that process the Shop's data. The written information above is provided first. An additional audit is possible where a supervisory authority requires it or after a personal data breach affecting the Shop's data.
- Audits of sub-processors are covered by their own certifications and reports.
14. Liability, law and changes
- Liability: Rotozoom's total liability under this agreement is limited to the fees the Shop paid to Rotozoom in the 12 months before the claim, the same cap as in the Terms of Service (§7). This does not limit liability where mandatory law does not allow it, nor the rights of data subjects under Art. 82 GDPR.
- Governing law and courts: Bulgarian law; the competent courts of Zlatograd, Bulgaria, as in the Terms of Service.
- Rotozoom may update this agreement for new services or legal changes, with notice under §8; changes that reduce protection need the Shop's agreement, which is recorded as in §1a.
Annex 1 — Processing per service
Live today
| Service | Data sent to Rotozoom | Purpose | Where / who processes | Retention |
|---|---|---|---|---|
| Sales Assistant 1.9.11 (FREE and PRO, every edition) | shopper messages; shopping context (product viewed, page titles, cart items); installation ID, site address; store profile and rules; product catalogue after indexing is turned on (name, categories, attributes, SKU, tags, description excerpt, price, stock, image link). No names/e-mails/phones/orders from the chat. Version 1.9.11 also transmits the shopper's IP address in each request; it is not read or stored. | AI replies, product search, live chat with shop staff (PRO), optional lead storage, assisted-revenue attribution, industry pool (if the Shop chooses one: queue + redaction, §3) | Supabase EU (Ireland). AI replies: Google Gemini on Vertex AI (global) via OpenRouter, zero retention → fallback Z.ai GLM via OpenRouter / Together AI (USA), zero retention → last fallback Anthropic Claude (USA), standard commercial data policy (no training; data may be kept for a limited period). Redacted pool conversations: Anthropic Claude. Vectors: Voyage AI (USA). Translation and staff drafts (PRO): Anthropic Claude. AI step outside the EU. | reply buffer 1 h · live-chat conversations (PRO) 12 months · leads 24 months, only if "Keep leads on Rotozoom servers" is on (off by default) · assisted-revenue events (hashed identifiers) 24 months · Shop server IP cleared after 12 months · catalogue and vectors while indexed · industry-pool queue (raw conversations before redaction) ≤ 30 days; anonymised excerpts: no fixed retention period (not personal data, §3) · enforced hourly since 11.10.2026 |
On release (not available today; each row takes effect with its release)
| Service | Data | Purpose | Where / who processes | Retention |
|---|---|---|---|---|
| Product Filter 1.1.0 PRO server search | product index (ID, title, SKU, first 300 chars of short description, categories, brands, tags, attributes, prices, stock, rating, date, language); synonyms; filter clicks and search text as daily totals (no cookies, no IP; e-mail/phone/ID/order-like terms dropped); colour names for AI suggestions | search, facets, analytics, colour suggestions | search server in the EU; Voyage AI (USA); Google Gemini (colour names only) | analytics 400 days while active; index, synonyms and analytics deleted 90 days after the last PRO request; immediately on uninstall |
| Image Optimizer 3.2.0 | product images (EXIF/GPS removed) | conversion, thumbnails, background removal | Rotozoom machines in the EU; coordinating server in Germany (DA International Group) | inputs and results ≤ 24 h |
| Warranty 1.2.0 | cards (no customer data); QR registration (customer e-mail, name; opt-in); returns (name, e-mail, phone, reason, ≤ 5 photos, status history, order, product); AI triage (description + ≤ 3 photos) | warranty cards, registrations, return handling, AI sorting | Supabase EU; files EU (R2); Mailjet EU; Gemini on Vertex AI EU via OpenRouter, zero retention | cards + PDF 10 years · returns 5 years after closing · photos 2 years · registrations: licence + 30 days · AI inputs not stored (only cost/outcome) · event IDs 30 days |
| B2B Manager 1.3.0 | partners (company, company ID, VAT no., responsible person, e-mail, phone, IBAN, country, status, programmes); ledger; statements (no end-customer names); price tables (IDs + rules) | partner ledger, statements, approvals, optional partner e-mails | Supabase EU; files EU; Mailjet EU; Registry Agency portal (BG partners, public authority) | ledger + statements 10 years · events 90 days · mail log 90 days · reconciliation 400 days · price files 24 h · partner records while the service is used |
| Warehouse, Suppliers & Dropshipping 1.3.x | supplier documents (one file + domain + anonymous installation ID for AI reading); price lists; document archive; supplier e-mails; invoice inbox (incoming e-mail) | read documents, price lists, archive, supplier mail | Gemini on Vertex AI EU via OpenRouter, zero retention; Supabase EU; files EU; Mailjet EU; Cloudflare Email Routing (inbox) | file not stored; extraction cache 90 days · price lists ≤ 24 h, feed results 30 days · archive 10 years · inbox document ≤ 24 h or until read |
| Sell & Ship helpers (when the Shop switches them on) | address check: country, settlement, postcode, first address line, order number; reputation: one-way hash of customer identifier | delivery address validation; delivery-risk signal | Supabase EU | address ≤ 24 h, not stored · reputation answers 30 days, observations 3 years · the reputation network stays switched off until a data protection impact assessment (DPIA) has been completed |
| Reviews PRO 0.x (FREE and the wordpress.org edition send nothing) | review text, star rating, product name, language, number of photos; review photos. No reviewer name, e-mail, phone, address or order number. | AI moderation (advisory labels: spam, abuse, personal data, off-topic), product review summaries, translation, photo processing and content check | Supabase EU; Gemini on Vertex AI EU via OpenRouter, zero retention; photos resized and EXIF/GPS removed on Rotozoom worker machines in the EU, coordinated from Germany (DA International Group) | review text: not stored after processing (only the result and its cost) · photos ≤ 24 h · translation cache 90 days |
| Platform (all of the above) | installation public key, domain, plugin list; request log; e-mail suppression list (address hash) | authentication, billing, abuse prevention, mail delivery | Supabase EU; Cloudflare; Mailjet EU | request log 12 months · suppression list (address hash, reason, date): no time limit, as long as needed to keep honouring unsubscribes and bounces · transient files 24 h · documents 10 years |
Annex 2 — Technical and organisational measures (detail)
| Area | Measure | Status |
|---|---|---|
| Location | Supabase eu-west-1 (Ireland); Cloudflare R2 EU jurisdiction; EU VPS (Germany) | live (Supabase); on release (R2, VPS) |
| Transport | TLS everywhere; HTTPS-only APIs | live |
| Identity | licence token signed server-side (RSA); per-installation Ed25519 keys; signed webhooks; replay window 300 s, event IDs remembered 7 days | licence live; Ed25519/webhooks on release |
| Integrity of software | signed update packages; Connect 1.1.18+ installs only signed packages | live |
| Separation | installation ID on every record; per-installation file prefixes; links only to own files | live (SA); on release (files) |
| Retention | hourly deletion job for Sales Assistant; per-service jobs at release | live (SA) |
| Minimisation | no shopper identity in SA chat; daily aggregates for analytics; EXIF/GPS removal; AI inputs not stored (Warranty) | live (SA); on release (others) |
| Providers | zero data retention routing for Gemini and GLM; EU Vertex region for Warranty/WSD | live (SA); on release |
| Access | Cloudflare Access on admin; secrets in the platform secret store; rate limits and daily cost caps per service | live |
| Incident handling | breach notice to the Shop within 48 hours (§10); record of incidents | commitment |
| Review | security measures reviewed at least once a year (§7) | commitment |
Annex 3 — Authorised sub-processors
| Sub-processor | Service(s) | Purpose | Location | Transfer mechanism |
|---|---|---|---|---|
| Supabase, Inc. | all | database, server functions | EU (Ireland) | EU hosting; SCCs for support access |
| Cloudflare, Inc. | all (on release: files, inbox, live chat) | network, file storage (EU jurisdiction), e-mail routing | global / EU (R2) | SCCs; DPF where the provider is certified |
| OpenRouter, Inc. | SA; Warranty, WSD, Reviews (on release) | routing to AI models, zero retention | USA | SCCs; DPF where the provider is certified |
| Google (Vertex AI / Gemini) | SA (global region); Warranty, WSD, Reviews (EU region, on release); PF colours (on release) | AI replies and document reading | global / EU | SCCs; DPF where the provider is certified |
| Together AI | SA (fallback) | runs Z.ai GLM, reached through OpenRouter, zero retention | USA | SCCs; DPF where the provider is certified |
| Anthropic, PBC | SA (last fallback, translation, staff drafts, analysis of redacted pool conversations) | Claude — AI replies; standard commercial data policy (no training; data may be kept for a limited period) | USA | SCCs; DPF where the provider is certified |
| Voyage AI | SA; PF (on release) | search vectors | USA | SCCs; DPF where the provider is certified |
| Mailjet (Sinch) | on release: platform mail | transactional e-mail | EU | EU |
| DA International Group | on release: RIO, Reviews photos, PF search server | server hosting | Germany | EU |
| Rotozoom worker machines (own) | on release: RIO, Reviews photos | image processing | EU | EU (no third party) |
The Registry Agency (Bulgaria) and the European Commission VIES are public authorities that receive queries; they are recipients, not sub-processors.