Data Processing Agreement

Last Modified on 2nd August, 2026

Introduction

This Data Processing Addendum ("DPA") forms part of the Terms and Conditions between VistoureAI Technologies Private Limited ("VistoureAI") and the Business Customer ("Customer") using the Services.

This DPA applies where VistoureAI processes Personal Data on behalf of the Customer in the course of providing its Services, to the extent such Data is subject to European Data Protection Laws (including GDPR) and India's Digital Personal Data Protection Act, 2023 (DPDPA) and the Digital Personal Data Protection Rules, 2025.

1. Definitions

Terms used in this DPA shall have the meanings given to them in the GDPR and DPDPA. "Services", "Terms and Conditions", and "Privacy Policy" shall have the meanings given to them in the Terms and Conditions.

2. Relationship of the Parties

The parties acknowledge and agree that with regard to the Processing of Personal Data, Customer is the Controller and VistoureAI is the Processor. VistoureAI will process Personal Data only on documented instructions from the Customer, including with regard to transfers of personal data to a third country or an international organisation.

3. International Data Transfers

3.1 Processing Locations: Customer acknowledges that VistoureAI utilizes the following cloud infrastructure for data processing and storage:

• Amazon Web Services (AWS), United States — primary server infrastructure and persistent data storage.
• Replicate, United States — AI inference and GPU compute runtime for image and video processing API requests.
• Decart AI, United States — real-time video processing for live camera streaming features.

3.2 Standard Contractual Clauses (SCCs): For transfers of Personal Data from the EU/EEA, UK, or Switzerland to countries that do not ensure an adequate level of data protection, the parties agree to be bound by the 2021 EU Standard Contractual Clauses (Module Two: Controller-to-Processor), which are incorporated into this DPA by reference.

3.3 Safeguards: VistoureAI implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as detailed in our Privacy Policy and security documentation.

4. Data Protection Guarantees

VistoureAI guarantees that:

• User-provided images, photographs, videos, and camera data processed through the Services are not used to train, fine-tune, or improve any AI models — whether by VistoureAI or by our third-party AI processing providers.
• Camera video data used for live camera streaming features is streamed in real time and is not stored on VistoureAI's servers. The video is discarded by the AI provider immediately upon session completion.
• Images, videos, and prompts submitted for AI inference are automatically cleared by us and our AI processing providers within the periods described in Privacy Policy §3C.

5. Sub-Processing

Customer provides a general authorization for VistoureAI to engage sub-processors to support the delivery of the Services. The current authorized sub-processors are:

VistoureAI will inform the Customer of any intended changes concerning the addition or replacement of sub-processors, thereby giving the Customer the opportunity to object to such changes.

6. AI Compliance and Ethics

6.1 Prohibited practices (EU AI Act Art. 5): VistoureAI does not use emotion recognition, biometric categorization (e.g., ethnicity or gender inference), or manipulative or subliminal techniques. Our AI-powered image, video, and live camera streaming features perform visual garment overlay and body-pose mapping only; they do not constitute facial recognition or biometric identification.

6.2 User and deployer guidance (EU AI Act Art. 4): We provide guidance on intended use, limitations, known risks, and appropriate human oversight in our Terms and Conditions and Privacy Policy.

7. Contact

For any inquiries regarding this DPA or data processing practices, please contact us at support@vistoureai.com.