This Data Processing Addendum (the "DPA") forms part of the SOLD Now Terms of Service (the "Terms") between SOLD Now LLC, a Texas limited liability company ("SOLD Now", "we", "us", "our", or the "Company"), and the Subscriber that accepted the Terms ("you", "Subscriber", "Reseller"). It sets out the terms on which SOLD Now processes Personal Information on your behalf.
Capitalized terms not defined here have the meanings given in the Terms or, where the term is defined in the CCPA, the meaning given in the CCPA.
With respect to Subscriber Personal Information, you are the Business and SOLD Now is a Service Provider. You determine the purposes and means of the processing; SOLD Now processes only on your documented instructions, which consist of the Terms, this DPA, the configuration choices you make within the Platform, and any further written instruction you give.
SOLD Now is a Business in its own right, and not a Service Provider, with respect to the Personal Information it collects about you directly for its own purposes — for example account registration data, subscription billing records, and platform usage diagnostics. That processing is governed by the SOLD Now Privacy Policy, not by this DPA.
To the extent Applicable Privacy Law other than the CCPA applies to the processing of Subscriber Personal Information, references in this DPA to "Business" shall mean "Controller" and references to "Service Provider" shall mean "Processor".
SOLD Now processes Subscriber Personal Information only for the following business purposes: providing, maintaining, securing, and supporting the Platform for you; performing the services described in the Terms; and complying with law. Annex C describes the categories of Personal Information, the categories of Consumers, and the duration of processing.
SOLD Now shall not:
(a) Sell or Share Subscriber Personal Information;
(b) retain, use, or disclose Subscriber Personal Information for any purpose other than the business purposes specified in Section 3, including retaining, using, or disclosing it for a commercial purpose other than providing the services, or outside the direct business relationship between the parties;
(c) combine Subscriber Personal Information with Personal Information it receives from, or on behalf of, any other person, or collects from its own interaction with a Consumer, except where permitted by the CCPA for a Service Provider; or
(d) use Subscriber Personal Information to train, fine-tune, or improve any generally available artificial intelligence model, or permit a sub-processor to do so. SOLD Now engages the artificial intelligence providers listed in Annex A.2 under commercial terms that prohibit the use of submitted content for model training, and will not route Subscriber Personal Information to a provider or service tier that does not offer such terms. See Section 8.1.
Certification. SOLD Now certifies that it understands the restrictions in this Section 4 and will comply with them.
SOLD Now shall notify you promptly if it determines that it can no longer meet its obligations under Applicable Privacy Law. On such notice, or where you reasonably believe SOLD Now is processing Subscriber Personal Information in an unauthorized manner, you may take reasonable and appropriate steps to stop and remediate the unauthorized processing, including by instructing SOLD Now in writing to cease the processing concerned.
SOLD Now limits access to Subscriber Personal Information to personnel who need it to provide the Platform, and binds those personnel to obligations of confidentiality that survive the end of their engagement.
SOLD Now maintains reasonable security procedures and practices appropriate to the nature of the Subscriber Personal Information, designed to protect it from unauthorized access, destruction, use, modification, or disclosure. These include encryption of data in transit over public networks, encryption of data at rest, network and firewall controls, role-based access control, per-account data isolation as described in Section 4 of the Privacy Policy, and audit logging of administrative actions.
Security measures may change as the Platform evolves, but SOLD Now will not make a change that materially reduces the overall level of protection during a paid subscription term.
SOLD Now shall notify you of a Security Incident affecting Subscriber Personal Information without undue delay after confirming it, and in any event within the time required by Texas Business and Commerce Code § 521.053 and any other applicable state breach-notification statute.
The notice will describe, to the extent then known, the nature of the incident, the categories of Personal Information involved, the measures taken or proposed to address it, and a point of contact. SOLD Now will provide further information as the investigation progresses, and will cooperate reasonably with your own notification obligations as the Business. An initial notice is not an acknowledgement of fault or liability.
You authorize SOLD Now to engage the sub-processors listed in Annex A to process Subscriber Personal Information. SOLD Now enters a written contract with each sub-processor imposing terms at least as protective as this DPA, and remains responsible to you for each sub-processor's performance.
SOLD Now will give you at least thirty (30) days' notice before adding or replacing a sub-processor, by posting an updated Annex A and notifying you by email or in-platform notice. If you reasonably object to a new sub-processor on data-protection grounds within that period, you may terminate the affected subscription without further charge; that is your sole remedy for an objection.
The Platform offers optional AI-assisted features. Where you use one, the content that feature submits is transmitted to the provider listed in Annex A.2 that serves the feature. SOLD Now:
(a) engages each such provider under commercial API terms that prohibit the use of submitted content to train or improve that provider's models, and does not use consumer or free service tiers whose terms permit training;
(b) records the prompt text submitted by each AI feature, and the assistant's reply, in an audit log within your own account, visible to you in the Platform. That log is Subscriber Data and is deleted on the timeline in Section 10;
(c) does not submit customer contact records, mailing lists, or SMS opt-in data to an AI provider as part of any feature's own data gathering. Two paths can nonetheless carry Personal Information to a provider, and you should be aware of both: text you type into the assistant yourself, and documents you upload to the invoice import feature, which are transmitted in full and from which the feature is designed to extract a buyer name and email address; and
(d) treats address autocomplete as distinct from the above. Address fields use Google Maps Platform, called directly from your browser as described in Annex A.3, rather than an AI provider.
You remain responsible under Section 5 of the Acceptable Use Policy for the content you submit to AI features. AI output is generated for your review and is not appraisal, authentication, tax, or legal advice.
Annex B lists third-party services that you may connect to the Platform using credentials held in your own name. Those services are not SOLD Now sub-processors. When you connect one, you engage that provider directly, you are responsible for your relationship with it, and SOLD Now's role is limited to transmitting data at your direction.
SOLD Now shall assist you in responding to a Consumer's request to know, access, correct, delete, or opt out, by providing the self-service export, correction, and deletion tools described in Section 4 of the Terms and Section 5 of the Privacy Policy, and by providing reasonable further assistance where those tools are insufficient.
Where SOLD Now receives such a request directly from one of your Consumers, it will not respond substantively other than to direct the Consumer to you, and will inform you of the request within ten (10) business days. Where you request assistance under this Section, SOLD Now will respond within the timeframe stated in Section 9 of the Privacy Policy.
The retention and deletion timelines in this Section mirror Section 4 of the Terms and Section 5 of the Privacy Policy, and are stated here for completeness rather than as a separate commitment.
Section 1 of the Terms restricts the Service to businesses and individuals located in the United States. Subscriber Personal Information is stored in data centers located in the United States.
Two processing operations reach outside the United States, neither of which involves customer contact records: background removal from product photographs is performed by a provider established in Austria, and address autocomplete requests are served from Google's global network. Both are identified in Annex A.3.
This DPA is written for United States privacy law. It does not include, and SOLD Now does not offer under it, the terms required by the EU General Data Protection Regulation or the UK GDPR — including Article 28 processor clauses, Standard Contractual Clauses, an Article 27 representative, or an international transfer mechanism. If you direct Personal Information of individuals located in the European Economic Area, the United Kingdom, or Switzerland into the Platform, you do so on your own responsibility and outside the permitted scope of the Terms. Contact info@soldnow.app before doing so.
On your written request, and no more than once in any twelve (12) month period, SOLD Now will complete a reasonable written security and privacy questionnaire, or provide then-current third-party audit reports or certifications held by SOLD Now or its sub-processors, sufficient to let you verify SOLD Now's compliance with this DPA. This Section does not entitle you to access SOLD Now's premises, systems, source code, or other Subscribers' data. You will treat all material provided under this Section as SOLD Now's confidential information.
Order of precedence. In the event of a conflict between this DPA and the Terms with respect to the processing of Subscriber Personal Information, this DPA controls. In the event of a conflict between this DPA and the Privacy Policy, this DPA controls as to Subscriber Personal Information; the Privacy Policy controls as to Personal Information SOLD Now processes as a Business.
Term. This DPA takes effect when you accept the Terms and continues until SOLD Now has deleted all Subscriber Personal Information in accordance with Section 10.
Liability. Each party's liability under this DPA is subject to the limitations and exclusions in Section 8 of the Terms.
Governing law. This DPA is governed by the laws of the State of Texas and is subject to the dispute-resolution provisions in Section 10 of the Terms.
Changes. SOLD Now may update this DPA on the basis and with the notice described in Section 12 of the Terms, and will not make a change that materially reduces the protections afforded to Subscriber Personal Information during a paid subscription term.
SOLD Now engages the following sub-processors to process Subscriber Personal Information.
| Sub-Processor | Entity | Purpose | Categories Processed | Location |
|---|---|---|---|---|
| Microsoft Azure | Microsoft Corporation | Cloud hosting, application and database infrastructure, file and image storage, application diagnostics (Application Insights), federated sign-in (Entra External ID), and platform transactional email (Azure Communication Services) for account, security, and billing notices | All Subscriber Personal Information stored in the Platform; recipient email addresses for platform notices; sign-in identifiers | United States |
| Stripe | Stripe, Inc. | Processing SOLD Now's own subscription fees, in which each Subscriber is a Stripe Customer | Subscriber billing contact details and payment method records. SOLD Now does not receive or store full payment card numbers | United States |
| Postmark | ActiveCampaign, LLC | Delivery of Subscriber-initiated email — invoices, customer replies, and marketing campaigns — on a SOLD Now-owned Postmark account with a dedicated sending server per enrolled Subscriber | Recipient email addresses, message content, and delivery metadata | United States |
These providers process content submitted to the optional AI-assisted features described in Section 8.1 and in Section 2.3 of the Privacy Policy. Each is engaged under SOLD Now's own account and credentials.
| Sub-Processor | Entity | Purpose | Categories Processed | Location |
|---|---|---|---|---|
| Anthropic | Anthropic, PBC | The "Hey Simon" assistant; item identification and research from photographs; pricing research; marketing copy generation; and extraction of line items from invoice and statement documents you upload | Text you type into the assistant; item photographs; item, category, manufacturer, and location records; and the contents of documents you upload for import, which may include the name and email address of a buyer printed on that document | United States |
| Google LLC | Alternative provider for item identification, marketing copy, and marketing image generation (Gemini API and Google Cloud Vertex AI / Imagen) | Item photographs; item, category, and manufacturer names; marketing direction text you supply | United States | |
| OpenAI | OpenAI, L.L.C. | Alternative provider for item identification and marketing image generation | Item photographs; item, category, and manufacturer names; marketing direction text you supply | United States |
| Sub-Processor | Entity | Purpose | Categories Processed | Location |
|---|---|---|---|---|
| Google Maps Platform | Google LLC | Address autocomplete, geocoding, and distance calculation. These requests are made directly from your browser, so Google also receives the device IP address and, where you grant permission, approximate location | Address text entered into customer, consignment partner, location, travel log, and reseller address fields, transmitted as it is typed | United States / global |
| SerpAPI | SerpApi, LLC | Retrieval of reference images for item research | Item name search terms only. No customer Personal Information | United States |
| remove.bg | Kaleido AI GmbH (Canva) | Background removal from product photographs | Item photographs only | Austria (European Union) |
The following third-party services are connected using credentials held in your own name, or by an OAuth authorization you grant from your own account with that provider. You contract with these providers directly. SOLD Now transmits data to them at your direction and is not their controller, and they are not SOLD Now's sub-processors.
| Service | How it is connected | What you are responsible for |
|---|---|---|
| Twilio | Your own Twilio Account SID and Auth Token, entered in Settings | Your Twilio account, A2P 10DLC campaign registration, sender identity, and messaging compliance |
| Your own SMTP server | Your own SMTP host, username, and password, entered in Settings | Your mail server and its deliverability |
| Stripe (customer payments) | Your own Stripe API keys, entered in Settings, used to take payments from your customers | Your Stripe account and its terms. Distinct from the Stripe entry in Annex A, which is SOLD Now billing you |
| PayPal | Your own PayPal credentials, entered in Settings | Your PayPal account and its terms |
| eBay | An OAuth authorization you grant from your own eBay seller account. SOLD Now's platform application keyset signs the API calls, but the access is yours | Your eBay seller account, listings, and marketplace policy compliance |
| Etsy | An OAuth authorization you grant from your own Etsy seller account, on the same basis as eBay | Your Etsy seller account, listings, and marketplace policy compliance |
Categories of Consumers whose Personal Information is processed: your retail customers and prospects; subscribers to your mailing lists; sellers who claim a Car on a Raid Train you conduct; shoppers who place an order through your online store, where you hold that add-on; and the individual users you invite to your account.
Categories of Personal Information processed: name; email address; postal address; mobile and other telephone numbers; SMS and email marketing consent records, including the date, time, source page, and consent language captured; purchase and transaction history; item preferences and interest notes; customer communication history; order and shipping details; and any further Personal Information you choose to enter into free-text fields.
Sensitive Personal Information: the Platform is not designed for, and you must not enter, Sensitive Personal Information as defined by the CCPA, protected health information governed by HIPAA, or full payment card numbers. See Section 6 of the Acceptable Use Policy.
Nature and purpose of processing: storage, organization, retrieval, transmission, and deletion of the above, for the purpose of providing inventory management, customer relationship management, order and invoice handling, marketing outreach initiated by you, live-selling show scheduling, and — where you hold the add-on — online storefront operation.
Frequency of processing: continuous, for the duration of the subscription.
Duration of processing: for the term of the subscription, followed by the Grace Period and deletion timelines in Section 10.
Personal Information transmitted to artificial intelligence providers: free text you type into the "Hey Simon" assistant, which may contain any Personal Information you choose to type; the full contents of invoice, statement, or CSV documents you upload to the import feature, from which a buyer name and email address are extracted by design; and your saved location records, including street address, where the assistant needs them. Product photographs are transmitted to AI providers and may incidentally depict Personal Information if you photograph it. See Section 8.1.
Personal Information transmitted to mapping providers: address text entered into customer, consignment partner, location, travel log, and reseller address fields is transmitted to Google Maps Platform from your browser as it is typed, together with your device IP address. See Annex A.3.
Automated decision-making: SOLD Now does not carry out automated decision-making that produces legal or similarly significant effects concerning any Consumer. Optional AI-assisted features generate suggested text and attribute tags for your review, as described in Section 2.3 of the Privacy Policy.
