Data Processing Addendum

1. Scope & roles. This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Customer," the maker) and Crater Ink Studios LLC (doing business as Hivara, the "Processor"). It applies to personal information about your end customers that you import or upload to Hivara (for example, names and addresses in Etsy/Amazon/eBay/Poshmark sales exports). For that data, you are the controller / business and Hivara is your processor / service provider.

2. Purpose & instructions. Hivara processes imported customer personal information solely to provide the service to you, on your documented instructions, and not for Hivara's own independent purposes except as permitted by this DPA or required by law. Imported customer personal information is not included in Hivara's aggregated/anonymized data reuse, AI-model improvement, or cross-customer benchmarking.

3. Customer responsibilities. You represent that you have a lawful basis to provide the imported data, that you have given your end customers any required notices and obtained any required consents, and that your instructions comply with applicable law.

4. No sale; service-provider restrictions. Hivara does not sell or share imported customer personal information, does not retain, use, or disclose it for any purpose other than performing the service (or as otherwise permitted by applicable law), and does not combine it with other data except as permitted. Hivara will: (a) notify you if it determines it can no longer meet its obligations under applicable privacy law or this DPA; (b) allow you to take reasonable and appropriate steps to stop and remediate unauthorized use of the data; and (c) reasonably assist you in responding to verifiable consumer requests your end customers direct to you.

5. Security measures. Hivara maintains reasonable administrative, technical, and organizational security measures appropriate to the data.

6. Sub-processors & change notice. Hivara may use sub-processors (listed below) to provide the service. Hivara will impose data-protection obligations on each sub-processor substantially similar to those in this DPA and will provide notice of any new or replacement sub-processor before it begins processing, with an opportunity to object. If you reasonably object to a new sub-processor on data-protection grounds, your remedy is to cancel the affected subscription; if you do not object before the sub-processor begins processing, you are deemed to have accepted it.

7. Breach notification & cooperation. Hivara will notify you without undue delay after becoming aware of a personal-information breach affecting imported customer data, and will reasonably cooperate with you in meeting your notification obligations.

8. Deletion / return on termination. On termination, or at your request, Hivara will delete or return imported customer personal information, except where retention is required by law or exists temporarily in routine backups.

9. Sub-processor list.

10. Contact. contact@hivara.app.