Version 1.0. Last updated 28 October 2026.
This Data Processing Agreement ("DPA") is entered into between Flaunt Software, Inc., a Delaware corporation with offices at 830 Massachusetts Ave, Suite 1500, Fl 3, Indianapolis, IN 46204 ("Flaunt"), and the customer identified in the Order Form or other written or electronic record evidencing acceptance of the Agreement (the "Customer"). Flaunt and Customer are each a "Party" and together the "Parties."
This DPA forms part of, and is incorporated by reference into, the Master Service Agreement and any associated Order Forms and Statements of Work between the Parties (together, the "Agreement"). It governs Flaunt's Processing of Personal Data on behalf of Customer in connection with the Services. In the event of any conflict between this DPA and the Agreement with respect to the Processing of Personal Data, this DPA prevails. Capitalized terms not defined here have the meanings given in the Agreement.
(A) Flaunt provides an AI platform that connects to a brand's software tools, ingests data into a data warehouse Flaunt hosts for each brand, applies Flaunt's proprietary transformations, and makes the data available through an AI analysis and coding agent, the Flaunt MCP server and applications built on the platform, together with any configuration, custom development, and related professional services Flaunt performs for Customer (collectively, the "Services").
(B) Customer uses the Services for its own brand and/or on behalf of brands it serves ("Managed Brands"). Where Customer uses the Services on behalf of Managed Brands, Customer may itself act as a Processor for those Managed Brands, and Flaunt acts as Customer's Sub-processor.
(C) In providing the Services, Flaunt Processes Personal Data on Customer's documented instructions. The Parties enter into this DPA to comply with Applicable Data Protection Laws, including the GDPR and the CCPA.
1.1 "Applicable Data Protection Laws" means all data protection and privacy laws and regulations applicable to a Party's Processing of Personal Data under the Agreement, including, as applicable: (a) the EU General Data Protection Regulation 2016/679 ("GDPR"); (b) the UK Data Protection Act 2018 and the UK GDPR; (c) the Swiss Federal Act on Data Protection ("FADP"); (d) the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act ("CCPA"); and (e) all other comprehensive U.S. state consumer privacy laws (collectively, "U.S. State Privacy Laws"), in each case as amended, superseded, or replaced from time to time.
1.2 "Customer Personal Data" means any Personal Data that Flaunt Processes on behalf of Customer or its Managed Brands under the Agreement.
1.3 "Managed Brands" has the meaning given in the Agreement and includes the brands on whose behalf Customer uses the Services.
1.4 "Sub-processor" means any third party engaged by Flaunt to Process Customer Personal Data in connection with the Services.
1.5 The terms "Controller," "Processor," "Data Subject," "Processing," "Personal Data," and "Personal Data Breach" have the meanings given in the GDPR. The terms "Business," "Service Provider," "Contractor," "Consumer," "Sell," "Share," and "Sensitive Personal Information" have the meanings given in the CCPA. Equivalent terms under other Applicable Data Protection Laws have corresponding meanings.
2.1 Controller and Processor. With respect to Customer Personal Data, Customer (or, where applicable, its Managed Brand) is the Controller and Business, and Flaunt is the Processor and Service Provider. Where Customer acts as a Processor on behalf of a Managed Brand that is the Controller, Flaunt acts as a Sub-processor. Customer is responsible for ensuring it has the authority, and all necessary rights and lawful bases, to provide Customer Personal Data to Flaunt and to instruct the Processing described in this DPA, consistent with Section 2(c) of the Agreement.
2.2 Documented Instructions. Flaunt shall Process Customer Personal Data only on Customer's documented instructions, including with regard to international transfers, unless required to Process by a law to which Flaunt is subject (in which case Flaunt shall, where legally permitted, inform Customer of that requirement before Processing). The Agreement, this DPA, and Customer's use of the configuration options within the Services constitute Customer's complete and final documented instructions. Flaunt shall inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws, without obligation to monitor Customer's compliance.
2.3 Compliance. Each Party shall comply with its respective obligations under Applicable Data Protection Laws. Customer's instructions shall not require Flaunt to Process Customer Personal Data in violation of Applicable Data Protection Laws.
Flaunt Processes Customer Personal Data solely to provide and support the Services, including ingesting data from Customer's connected platforms (such as Shopify, Klaviyo, and Skio), hosting and organizing that data, applying analytical transformations, generating analyses and reports at Customer's direction, and building applications, dashboards, reports, automations, and integrations for Customer. The subject matter, duration, nature, purpose, categories of Data Subjects, and types of Personal Data are described in Annex 1.
Flaunt's use of anonymized data. As described in the Agreement, Customer instructs and authorizes Flaunt to create and use de-identified and aggregated data that cannot reasonably be used to identify any individual, Customer, or Managed Brand, in order to improve the Services and create industry benchmarks. Any benchmark or other output derived from such data and made available to anyone other than Customer shall be aggregated across a minimum of five (5) brands. Flaunt shall maintain such data in de-identified form, shall not attempt to re-identify it, shall contractually prohibit any recipient from re-identifying it, and shall not use it to train, develop, or improve any generalized or third-party artificial intelligence or machine learning model.
Flaunt is a Service Provider (and, where applicable, a Contractor) with respect to Customer Personal Data Processed under the CCPA. Flaunt shall not:
Flaunt shall not use Customer Personal Data to train, develop, or improve any generalized or third-party artificial intelligence or machine learning model. Flaunt's agreements with its AI model providers prohibit those providers from using Customer Personal Data to train their models. Flaunt sends every model request through the Vercel AI Gateway with zero data retention turned on, so AI model providers do not retain Customer Personal Data after responding to a request. Flaunt certifies that it understands and will comply with the restrictions in this Section 3.1.
Flaunt shall notify Customer promptly if it determines that it can no longer meet its obligations under the CCPA or this Section 3.1. Customer may take reasonable and appropriate steps to ensure that Flaunt uses Customer Personal Data in a manner consistent with Customer's obligations under the CCPA and, upon notice to Flaunt, to stop and remediate any unauthorized use of Customer Personal Data.
Flaunt shall ensure that personnel authorized to Process Customer Personal Data are bound by appropriate confidentiality obligations (whether contractual or statutory) and have received appropriate data protection and security training. Flaunt shall limit access to Customer Personal Data to those personnel who need access to provide the Services.
Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risks to Data Subjects, Flaunt shall implement and maintain appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk, consistent with Article 32 GDPR. These measures are described in Annex 2 and include, at a minimum:
5.1 Updates. Flaunt may update its security measures from time to time, provided that such updates do not materially diminish the overall level of security afforded to Customer Personal Data.
6.1 General authorization. Customer grants Flaunt general written authorization to engage Sub-processors to Process Customer Personal Data. Flaunt shall maintain an up-to-date list of its Sub-processors, including each Sub-processor's name, the purpose of its Processing, and its Processing location, on its website or on request. The Sub-processors as of the date of this DPA are listed in Annex 4. Each AI model provider is contractually prohibited from using Customer Personal Data to train its models.
6.2 Notice and objection. Flaunt shall provide Customer with at least thirty (30) days' prior notice (by email to Customer's administrator contact, in-product notice, or update to a published Sub-processor list with a subscription mechanism) before engaging a new Sub-processor that will Process Customer Personal Data. Customer may object on reasonable grounds relating to data protection by notifying Flaunt in writing within the notice period. If the Parties cannot reach a resolution, Customer may, as its sole and exclusive remedy, terminate the affected Services and receive a pro-rata refund of any prepaid fees for the unused portion of the term.
6.3 Flow-down and liability. Flaunt shall enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than those in this DPA, sufficient to satisfy Article 28(3) GDPR and the CCPA requirements applicable to Service Providers and Contractors. Flaunt remains fully liable to Customer for each Sub-processor's performance of its obligations.
6.4 Customer-directed integrations. Where Customer connects the Services to a third-party application or AI tool under Customer's own account (including by connecting Flaunt's MCP server to an AI assistant), that third party is not a Sub-processor of Flaunt. Customer Personal Data that Customer retrieves from the Services into such an application is disclosed at Customer's direction, and Customer's use of that application is governed by Customer's agreement with its provider.
7.1 Assistance. Taking into account the nature of the Processing, Flaunt shall assist Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling Customer's obligation to respond to Data Subject (or Consumer) requests to exercise their rights under Applicable Data Protection Laws, including rights to access, correct, delete, port, restrict, opt out of Sale or Sharing, opt out of profiling or targeted advertising, limit use of Sensitive Personal Information, and object to Processing.
7.2 Requests received by Flaunt. If Flaunt receives a request directly from a Data Subject or Consumer relating to Customer Personal Data, Flaunt shall, unless legally prohibited, promptly forward the request to Customer and shall not respond directly except to acknowledge receipt and direct the individual to Customer. Where the Services provide self-service functionality for acting on such requests, Customer shall use that functionality before requesting additional assistance.
8.1 Notice. Flaunt shall notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice shall, to the extent then known, describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it.
8.2 Cooperation. Flaunt shall cooperate with Customer and take reasonable steps directed by Customer to assist in the investigation, mitigation, and remediation of the breach, and to assist Customer in meeting its own notification obligations to supervisory authorities and Data Subjects. Notification of, or response to, a Personal Data Breach shall not be construed as an acknowledgment by Flaunt of fault or liability.
Taking into account the nature of the Processing and the information available to it, Flaunt shall provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities, in each case to the extent required by Articles 35 and 36 GDPR or equivalent provisions of other Applicable Data Protection Laws.
10.1 Information. Flaunt shall make available to Customer, on reasonable written request and no more than once per calendar year (except where required by Applicable Data Protection Laws or following a Personal Data Breach), the information necessary to demonstrate compliance with Article 28 GDPR, including summaries of Flaunt's most recent third-party audits or certifications (such as SOC 2 or ISO 27001, where available) and responses to a reasonable security questionnaire.
10.2 Inspections. Where the information described in Section 10.1 is insufficient to demonstrate compliance, or where required by a competent supervisory authority, Flaunt shall allow for and contribute to audits, including inspections, by Customer or an independent auditor mandated by Customer and bound by confidentiality. Audits shall occur during regular business hours, on at least thirty (30) days' notice (except in an emergency or where required by a regulator), and in a manner that does not unreasonably interfere with Flaunt's operations or compromise other customers' data. Each Party bears its own costs unless the audit reveals material non-compliance by Flaunt.
11.1 Processing location. Flaunt Processes Customer Personal Data in the United States. Flaunt shall ensure appropriate safeguards are in place for any transfer of Customer Personal Data.
11.2 Transfer mechanisms. Where Flaunt Processes Customer Personal Data originating from the European Economic Area, the United Kingdom, or Switzerland in a country that has not received an adequacy decision, such transfers are governed by the Standard Contractual Clauses approved by the European Commission in Decision (EU) 2021/914 (the "EU SCCs"), incorporated by reference, with Module Two (Controller-to-Processor) applying when Customer is a Controller and Module Three (Processor-to-Processor) applying when Customer acts as a Processor for a Managed Brand. For transfers from the United Kingdom, the UK International Data Transfer Addendum (version B1.0) applies. For transfers from Switzerland, the EU SCCs apply with the modifications set out in FDPIC guidance. Operational details are set out in Annex 3.
11.3 Government and third-party requests. If Flaunt receives a legally binding request from a government authority or other third party for disclosure of Customer Personal Data, Flaunt shall, unless legally prohibited: (a) promptly notify Customer; (b) request that the requesting party direct its request to Customer; and (c) challenge any request it reasonably considers over-broad or unlawful, and disclose only the minimum Customer Personal Data necessary to comply.
Customer may add or remove Managed Brands in the Services or by email. When a Managed Brand is removed, Flaunt shall delete that brand's Customer Personal Data within thirty (30) days of the request, and from backups within sixty (60) days of the request in accordance with Flaunt's standard backup rotation. If Customer's relationship with a Managed Brand has ended, Flaunt may also act on a written request received directly from that Managed Brand to delete its Customer Personal Data, after notifying Customer.
Upon termination or expiration of the Agreement, Customer's access to the Services ends. Customer may request return of Customer Personal Data in writing within thirty (30) days after termination or expiration. Flaunt shall delete all Customer Personal Data from its active systems within thirty (30) days after that period ends (or after completing any requested return, if later), and from backups within sixty (60) days in accordance with its standard backup rotation, except (a) de-identified and aggregated data as described in Section 3, and (b) Customer Personal Data that Flaunt is required to retain by law, which Flaunt shall isolate and protect from further Processing until deletion is permitted. On request, Flaunt shall certify in writing that deletion has been completed. With respect to the return and deletion of Customer Personal Data, this Section supersedes any contrary provision of the Agreement.
Each Party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement, including the data protection cap in Section 8(b) of the Master Service Agreement, except to the extent such limitations are prohibited by Applicable Data Protection Laws, the EU SCCs, or the UK Addendum. Customer shall indemnify Flaunt against claims, fines, or damages to the extent arising from (a) Customer's instructions that infringe Applicable Data Protection Laws, or (b) Customer's failure to comply with its own obligations under Applicable Data Protection Laws.
14.1 Governing law. This DPA is governed by the same law as the Agreement (the laws of the State of Delaware), except that, where the EU SCCs or the UK Addendum apply, the governing law and forum specified in those instruments control with respect to the matters they govern.
14.2 Order of precedence. In the event of conflict among the governing documents, the order of precedence is: (1) the EU SCCs and UK Addendum (where applicable); (2) this DPA; (3) the Agreement; and (4) any other referenced document.
14.3 Updates. Flaunt may update this DPA by publishing a new version and notifying Customer by email or in the Services. An update that does not reduce the protections afforded to Customer Personal Data takes effect when it is published. An update that materially reduces those protections takes effect only after at least thirty (30) days' notice; if Customer does not accept it, Customer may terminate the affected Services before it takes effect and receive a pro-rata refund of any prepaid fees for the unused portion of the term. New Sub-processors are governed by Section 6.2. Any other amendment must be agreed in writing by both Parties.
14.4 Severability. If any provision of this DPA is held invalid or unenforceable, the remaining provisions remain in full force, and the Parties shall negotiate in good faith a valid replacement that achieves the original intent.
14.5 Survival. Provisions that by their nature should survive termination, including Sections 3 (purpose limitation), 5, 8, 12, and 13, survive termination or expiration of this DPA.
14.6 Counterparts and electronic acceptance. This DPA may be executed in counterparts and accepted by electronic signature or by Customer's acceptance of an Order Form in the Services, each of which is deemed an original. No separate signature is required for this DPA to take effect.
Flaunt implements and maintains the following technical and organizational measures, which may be updated in accordance with Section 5.1 provided the overall level of security is not materially diminished:
This Annex 3 applies to transfers of Customer Personal Data subject to the GDPR, the UK GDPR, or the Swiss FADP from Customer (as data exporter) to Flaunt (as data importer). It is incorporated into and forms part of this DPA.
The Parties incorporate the EU SCCs (Decision (EU) 2021/914). Module Two (Controller-to-Processor) applies by default where Customer is a Controller; Module Three (Processor-to-Processor) applies where Customer acts as a Processor on behalf of a Managed Brand. The applicable Module is determined by Customer's actual role and may differ across data sets within a single account.
Annex I.A (Parties): Data exporter: Customer, as identified in the Order Form or sign-up record, acting as Controller (Module Two) or Processor (Module Three). Data importer: Flaunt Software, Inc., 830 Massachusetts Ave, Suite 1500, Fl 3, Indianapolis, IN 46204; contact: privacy@flaunt.ai; acting as Processor (Module Two) or Sub-processor (Module Three).
Annex I.B (Description of transfer): As set out in Annex 1 to this DPA. Frequency: continuous via API integrations. Retention: for the term of the Agreement plus the wind-down period in Section 12.
Annex I.C (Competent supervisory authority): Where Customer is established in an EEA Member State, the lead supervisory authority identified under Article 56 GDPR; otherwise the Irish Data Protection Commission.
Annex II (Technical and organizational measures): As set out in Annex 2 to this DPA, incorporated by reference, together with the government and third-party request protocol in Section 11.3.
Annex III (Sub-processors): As set out in Annex 4 to this DPA and the Sub-processor list maintained under that Section, as updated from time to time in accordance with Section 6.2.
For transfers subject to the UK GDPR, the Parties incorporate the UK International Data Transfer Addendum (version B1.0, in force 21 March 2022). Tables 1–3 are populated by reference to Sections 1 and 2 of this Annex 3 and Annexes 1 and 2 to this DPA. Table 4: neither Party may end the Addendum except as set out in its Section 19. The UK Addendum is governed by the laws of England and Wales, with disputes before the courts of England and Wales; the competent authority is the UK Information Commissioner's Office.
For transfers subject to the Swiss FADP, the EU SCCs apply with the following modifications: references to the GDPR are read as references to the FADP; references to EU Member State law are read as references to Swiss law; references to the competent supervisory authority and courts are read as the FDPIC and the competent Swiss courts; and references to Personal Data are read to include data of legal entities for so long as the FADP extends such protection.
In the event of conflict between this Annex 3 and the EU SCCs, the UK Addendum, or the Swiss modifications, those instruments prevail with respect to the transfers they govern. In the event of conflict between this Annex 3 and the body of this DPA, this Annex 3 prevails with respect to the matters it governs.
This Annex 3, including the EU SCCs, the UK Addendum, and the Swiss modifications incorporated above, is executed by the Parties when Customer accepts the Agreement and this DPA, whether by signing an Order Form or by accepting it in the Services. For purposes of Annex I.A to the EU SCCs, each Party's signature and date are captured at the time of such acceptance. No separate signature is required.
The Sub-processors below Process Customer Personal Data as of the date of this DPA. Flaunt keeps the current list on its website or provides it on request.