Skip to main content

    LimeSpot Data Processing Agreement

    Last Updated: November 4, 2026

    This Data Processing Agreement ("DPA") forms part of the agreement between LimeSpot Solutions Inc. ("LimeSpot", "we", "us", or "our") and the Client ("you" or "Client") for the provision of LimeSpot services. This DPA sets out the terms governing the processing of personal data by LimeSpot on behalf of the Client.

    This DPA is published in English and in French; Section 15.14 of the Terms of Service governs its language.

    1. Definitions

    "Personal Data" means any information relating to an identified or identifiable natural person that is processed by LimeSpot in connection with providing services to the Client. It does not include LimeSpot's own records of its relationship with the Client that Section 2 places outside this DPA, including the support requests and other messages that the Client's staff and others acting for it exchange with LimeSpot about the services or the account, except the Personal Data of the Client's shoppers or customers that appears in them.

    "Processing" means any operation performed on Personal Data, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, or erasure.

    "Data Controller" means the Client, who determines the purposes and means of processing Personal Data.

    "Data Processor" means LimeSpot, who processes Personal Data on behalf of the Data Controller.

    "Data Subject" means an identified or identifiable natural person whose Personal Data is processed.

    "Sub-processor" means any third party engaged by LimeSpot to process Personal Data on behalf of the Client.

    2. Scope and Purpose

    LimeSpot processes Personal Data solely to provide its services to the Client, including personalization and recommendation services and services that analyze the Client's store and connected accounts, answer questions of people acting for the Client, and recommend and prepare changes to the store and those accounts. The types of Personal Data processed may include:

    • Shopper browsing behavior and product interactions
    • Purchase history and order information
    • Email addresses (for personalization purposes)
    • Device and browser information
    • Geographic location data
    • Customer records held in the Client's store, such as names, email addresses and contact details
    • Data in the accounts the Client connects to the services
    • Instructions, questions, conversations and decisions of the Client's staff and others using the services on the Client's behalf, and the email addresses they choose for notices

    The Data Subjects are the Client's shoppers and customers, and the Client's staff and other people who use the services on the Client's behalf.

    LimeSpot's own records of its relationship with the Client and the people who act for it, namely account, contact, plan, trial, billing, payment and tax records, the terms the Client accepted, details of the Client's store and measures of its size and results, records of which features they use and when, the feedback they give, and the support requests and other business communications they exchange with LimeSpot, including a conversation in the services that a person acting for the Client passes to LimeSpot's support, are not processed on the Client's behalf: LimeSpot keeps them as controller under its Privacy Policy, and this DPA does not govern them. Personal Data of the Client's shoppers or customers that appears in them, such as in a support request, is processed on the Client's behalf and remains subject to this DPA, including Section 10.

    LimeSpot processes Personal Data for the term of the agreement between LimeSpot and the Client and, after it ends, only for the deletion or return period in Section 10.

    3. Client Obligations

    The Client agrees to:

    • Ensure lawful collection and processing of Personal Data
    • Obtain necessary consents from Data Subjects
    • Provide appropriate privacy notices to Data Subjects
    • Notify LimeSpot of any changes affecting data processing
    • Respond to Data Subject requests in a timely manner

    4. LimeSpot Obligations

    LimeSpot agrees to:

    • Process Personal Data, including any transfer of it to another country, only on documented instructions from the Client, unless a law LimeSpot is subject to requires otherwise, in which case LimeSpot informs the Client of that requirement before processing unless that law prohibits the notice
    • Ensure personnel are bound by confidentiality obligations
    • Implement appropriate technical and organizational security measures
    • Assist the Client in responding to Data Subject requests
    • Assist the Client, taking into account the nature of the processing and the information available to LimeSpot, with data protection impact assessments and prior consultations with a supervisory authority that concern the services
    • Inform the Client without delay if LimeSpot believes an instruction infringes data protection law
    • Delete or return Personal Data upon termination of services
    • Make available information necessary to demonstrate compliance

    If LimeSpot cannot deliver the notice of a legal requirement described in the first item above because the Client's Account was deleted or its contact address redacted, LimeSpot records that and proceeds without the notice. The preceding sentence does not apply to a legal requirement that Article 28(3)(a) of the EU GDPR or the UK GDPR governs; under such a requirement, LimeSpot informs the Client of the requirement before processing unless, where the EU GDPR governs, Union or Member State law to which LimeSpot is subject or, where the UK GDPR governs, the law of the United Kingdom or of a part of it prohibits that notice on important public-interest grounds.

    5. Data Subject Rights

    LimeSpot will assist the Client in fulfilling obligations to respond to Data Subject requests, including requests for:

    • Access to Personal Data
    • Rectification of inaccurate data
    • Erasure of Personal Data
    • Restriction of processing
    • Data portability
    • Objection to processing

    Data Subjects may contact LimeSpot's Data Protection Officer at [email protected] for any inquiries.

    6. Sub-processors

    LimeSpot may engage Sub-processors to assist in providing services, and the Client gives general authorization for that. LimeSpot keeps the list of current Sub-processors on this page. Because LimeSpot's services change often, the Client should review this page periodically. At least 30 days before an intended addition or replacement begins processing Personal Data, LimeSpot will inform the Client in writing of the intended change and post it here with the intended date of the change. The Client may object during that 30-day period on reasonable data-protection grounds. The intended addition or replacement will not begin processing Personal Data during that period or while a timely objection remains unresolved. If the Client objects, the parties will work in good faith to resolve the objection, and if they cannot, the Client may terminate the affected service. If the Client does not object during that period, continued use of the affected service after that period is acceptance of the change. Each Sub-processor will be bound by written contract to data-protection obligations equivalent to those binding LimeSpot, and LimeSpot remains responsible to the Client for the Sub-processor's performance.

    Apart from disclosures the Client instructs or applicable law requires, LimeSpot shares Personal Data only with its Sub-processors listed below. Anthropic, OpenAI and Google, the AI model providers listed below, receive it under business or API terms that bind each of them to use it only to provide its service to LimeSpot and not to use it to train AI models, and each keeps it no longer than the period stated for it below.

    Current Sub-processors (list last changed November 4, 2026):

    • Microsoft Azure (cloud infrastructure and data storage)
    • Elasticsearch, Inc. (hosting, storage and processing of search and analytics data; United States)
    • Invero Inc. (Microsoft cloud solution provider through which LimeSpot's Azure subscription is managed; Canada)
    • Cloudflare, Inc. (hosting and storage for limespot.com and LimeSpot's AI service, bot protection, and Workers AI model hosting, where content is not kept after the request unless LimeSpot stores it; United States)
    • Twilio Inc., SendGrid (transactional and service email delivery; United States)
    • Anthropic, PBC (AI model provider for LimeSpot's AI and agentic features, such as auditing a store, generating recommendations and content, and carrying out tasks a Client asks for; API content kept up to 30 days; United States)
    • OpenAI, L.L.C. (AI model provider for LimeSpot's AI and agentic features, such as auditing a store, generating recommendations and content, and carrying out tasks a Client asks for; API content kept up to 30 days; United States)
    • Google LLC, Gemini API, paid tier (AI model provider for LimeSpot's AI and agentic features, such as auditing a store, generating recommendations and content, and carrying out tasks a Client asks for; API content kept up to 55 days; United States)
    • Intercom, Inc. (customer support and messaging; United States)

    For the LimeSpot browser extension and the store audits it runs, LimeSpot decides the purposes and means of processing and acts as controller; that processing is governed by the Privacy Policy, not by this DPA, which covers Personal Data LimeSpot processes on the Client's behalf.

    7. Security Measures

    LimeSpot implements appropriate technical and organizational measures, including:

    • Encryption of Personal Data at rest and in transit over public networks
    • Access controls and authentication mechanisms
    • Regular security assessments and audits
    • Incident response and breach notification procedures
    • Employee training on data protection

    8. Data Breach Notification

    In the event of a Personal Data breach, LimeSpot will notify the Client without undue delay and provide information about the nature of the breach, categories of data affected, and measures taken to address it.

    9. International Data Transfers

    Personal Data may be transferred to and processed in the United States, Canada, or Europe. LimeSpot ensures appropriate safeguards are in place for international transfers, including Standard Contractual Clauses where required and, for data subject to UK law, the ICO International Data Transfer Addendum.

    10. Data Retention

    LimeSpot retains Personal Data only for as long as necessary to provide services or as required by law. Upon termination of services, LimeSpot will, at the Client's choice, delete or return Personal Data within 90 days unless retention is required by law. The services terminate when the Client's store removes LimeSpot from its e-Commerce Platform or when the Client asks LimeSpot to delete or return the Personal Data. Until then, including after the agreement between LimeSpot and the Client ends while the store keeps LimeSpot installed, this DPA continues to govern the Personal Data LimeSpot holds. Copies of Personal Data in backups, which LimeSpot keeps only to recover from a disaster and does not access or use in normal operation, are deleted as those backups expire on their fixed cycle; if a backup is restored, LimeSpot's regular deletion deletes that Personal Data again.

    11. Audit Rights

    Upon reasonable request and subject to confidentiality obligations, LimeSpot will make available information necessary to demonstrate compliance with this DPA and allow for audits conducted by the Client or an appointed auditor.

    12. Contact Information

    For questions about this DPA or data protection practices:

    Data Protection Officer: [email protected]

    Legal inquiries: [email protected]

    Related Documents: Privacy Policy | Terms of Service