Data Processing Addendum
Last updated: [OWNER: date]
1. Roles
For room content, the customer is the controller and [OWNER: legal entity name] is the processor. For billing and account data about organizers, we act as an independent controller as described in the Privacy Policy.
2. Documented instructions
We process room content only on the customer's documented instructions, which are these terms, the Terms of Service, and the customer's use of the product settings. We tell the customer if we believe an instruction breaks the law.
3. Subprocessors
- Vercel: hosting.
- Upstash: database for room data.
- Resend: sending invitation and account email.
- Stripe: billing and payments (account and billing data only).
- [OWNER: model provider name]: AI processing, Facilitator plan only, when the agent is on.
We will tell customers before adding or replacing a subprocessor. [OWNER: notice period and objection process.]
4. Security measures
- Signed, HttpOnly session cookies.
- Separate keys for each room.
- Rate limits on sign-in and join attempts.
- Encrypted transport (HTTPS).
5. Personal data breach
We will notify the customer without undue delay and within [OWNER: hours, for example 72] hours after we become aware of a breach affecting their room content, with the information we have about it.
6. Confidentiality and staff
People who can access room content are bound by confidentiality duties and access it only as needed to run the service.
7. Deletion on termination
When the customer deletes a room, we delete its data. When the agreement ends, we delete remaining room content on request, and backups expire within 30 days.
8. Audits
On reasonable request, we will give the customer the information needed to show we meet this addendum, and we will cooperate with reasonable audits. [OWNER: audit frequency and cost terms.]
9. International transfers
[OWNER: where data is processed and the transfer mechanism, if any.]
10. Contact
Questions about this addendum: support@virtualoffsite.com.