Data Processing Agreement

This Data Processing Agreement ("DPA") supplements the Master Subscription Agreement between JewelVi LLC, a New Jersey limited liability company ("Processor") and the subscribing store ("Controller") where JewelVi processes personal data on the store's behalf. It is accepted together with the Master Subscription Agreement. For data JewelVi controls itself, the Privacy Policy and applicable law govern.

Processor processes Controller personal data only on Controller's documented instructions — including providing customer intake, concept generation, 3D and try-on features, approvals, signatures, delivery, support and security — unless law requires otherwise. Processor will tell Controller if it believes an instruction is unlawful, where permitted.

Data subjects: store customers, staff and authorized users. Categories: names, emails, phone numbers, design preferences and briefs, uploaded photos and sketches, saved try-on photos, measurements, design outputs, signature images, approval details, usage and security logs. Live try-on video frames and body position points are processed only on the device and are not received by Processor. No biometric identifiers are processed.

Processing continues for the subscription term and the post-termination export and deletion period below. The purpose is providing the contracted services, not unrelated advertising or training Processor's own AI models.

Processor limits personnel access to those who need it and binds them to confidentiality. Processor maintains the safeguards in Schedule C.

Controller authorizes the subprocessors in Schedule B. Processor will give at least 30 days' notice by email of any new subprocessor, during which Controller may object on reasonable data-protection grounds; if the parties cannot resolve the objection, Controller may terminate the affected service and receive a refund of unused prepaid fees. Processor binds subprocessors to appropriate confidentiality and security obligations and remains responsible for their processing as required by law.

Processor will reasonably assist Controller with access, correction, deletion, portability and opt-out requests, consent records, data protection assessments and regulator inquiries. Processor will promptly refer requests it receives directly from a store's customers to that store.

Processor will notify Controller without undue delay, and in any event within 72 hours, after confirming a personal-data breach affecting Controller data, provide the details known and updates as they become available, and cooperate in the response. The parties will coordinate any notices to regulators or individuals required by law.

On expiration or termination, Controller may request an export within 30 days. Processor will delete Controller personal data from active systems within 90 days after expiration, subject to legal holds and required retention; automated backups expire within 30 days after that. Processor will confirm deletion in writing on request. The full retention schedule is:

• Store customer profiles, briefs, inspiration uploads, sketches, AI concepts, 3D models and saved try-on photos: kept while the store's subscription is active, unless the store deletes them sooner. Stores can delete unapproved projects in the app; other deletions are handled on the store's written request within 30 days.

• Approved design versions, customer signatures and approval records: kept unchanged for the life of the store's account so the approval remains a reliable record, then deleted with the account as described below, unless the store asks for longer retention or a legal hold applies.

• Legal acceptance and consent records: kept for the life of the store's account and deleted with it.

• Store account, staff, device and license records: kept for the life of the account and deleted within 90 days after the subscription ends.

• JewelVi's own invoices, payment and tax records: kept for seven years, as required for tax and accounting purposes.

• Activity history and service diagnostics stored with a store's account: kept for the life of the account and deleted with it.

• Backups: our database provider keeps automated backups on a rolling basis; backups expire automatically within 30 days, so deleted information can remain in a backup until that backup expires.

• Export and closure: for 30 days after a subscription ends, the store may request an export of its data by writing to legal@jewelvi.com. Within 90 days after the subscription ends, JewelVi permanently deletes the store's account data and files from active systems and confirms deletion on request.

Processor will provide reasonable information to demonstrate compliance, and may answer routine audit requests with policies, written answers to questionnaires or relevant provider reports, subject to confidentiality and security. On-site audits require reasonable advance notice, no more than once a year unless required by a regulator, and protections for other customers.

Controller data is stored in the United States. Where a subprocessor processes data in another country, it does so under its own transfer safeguards, and the parties will put in place any additional measures the law requires.

The Master Subscription Agreement governs liability, subject to data protection law that cannot be waived. If this DPA conflicts with the Agreement about personal data, this DPA controls. Nothing here limits the rights of individuals or regulators.

Subject matter: hosted jewelry-store consultation and design workflow. Nature: collection, storage, transformation, generation, transmission and deletion. Frequency: ongoing during sessions and the life of the account. Data subjects and categories: as in section 3. Instructions: the store's configuration of the service and its documented support requests.

• Supabase, Inc. — Database, sign-in and private file storage (customer records, designs, photos, signatures). Location: United States (AWS us-east-1).

• Lovable (Lovable Labs Incorporated) and its hosting network — Hosting and delivery of the JewelVi website and application. Location: Global edge network; application data is not stored there.

• Google LLC — Gemini API — AI design image generation, design revisions and 3D specification interpretation from the brief, sketches and inspiration images. Location: United States and other Google locations.

• Meshy (Meshy LLC) — Optional 3D model generation when authorized store staff request a 3D model. Location: United States.

• Resend, Inc. — Email delivery of design links to customers when a store sends them, and of JewelVi invoice, reminder and payment-confirmation emails to store billing contacts. Location: United States.

• Google LLC — MediaPipe model files and Google Fonts; jsDelivr CDN — Delivers try-on tracking software and fonts to the device; receives the device's IP address and browser details, not camera images. Location: Global content networks.

• Device speech service (for example Apple or Google, depending on the device) — Only when a user taps the microphone: converts spoken commands to text. Location: Determined by the device and browser vendor.

• Intuit Inc. — QuickBooks Online — Invoicing, bookkeeping and payment reconciliation for JewelVi's own subscription billing (store business name, billing contact, invoice and payment records — no jewelry customer data). Location: United States.

• JewelVi LLC's business bank (receiving ACH and Business Zelle payments) — Receives store subscription payments; sees the paying business's name, bank reference and amount. Location: United States.

• Sign-in through managed authentication; staff roles (owner, manager, staff); PIN-protected handoff between customer and staff.

• Database access rules that limit every store record to members of that store; platform administration limited to designated JewelVi administrators.

• Private file storage for photos, sketches, designs and signatures, reached only through short-lived signed links.

• Encrypted connections (HTTPS/TLS) for all traffic, and encryption at rest provided by the database host.

• Approved design versions and legal acceptance records that cannot be edited after they are created.

• AI provider keys and administrative credentials kept on the server, never sent to devices; error details shown to customers never include provider or technical information.

• Rolling automated backups that expire within 30 days.

• Security issues can be reported to legal@jewelvi.com; JewelVi investigates reports promptly and follows the incident terms in section 8.

This DPA is accepted electronically together with the Master Subscription Agreement. JewelVi records the accepting store, its signed-in representative, the document versions and the date and time.