Data Processing Addendum

1. Parties and scope

This Data Processing Addendum ("DPA") forms part of the Terms of Service between SubDoc (operated by Jalwan K., an individual) and the customer that holds a SubDoc workspace ("Customer"). It applies to personal data that Customer or its vendors submit to SubDoc, such as vendor contact details and the contents of uploaded documents (for example certificates of insurance and W-9 forms). For that data Customer is the controller (or business) and SubDoc is the processor (or service provider). If the Terms and this DPA conflict on the handling of personal data, this DPA controls.

2. Processing instructions

SubDoc processes personal data only to provide, secure, and support the Service as described in the Terms and Privacy Policy, and on Customer's documented instructions, which include Customer's use of the Service's features. SubDoc does not sell the data, does not use it for advertising, and does not train AI models on it. SubDoc will tell Customer if it believes an instruction breaks the law.

3. Confidentiality and security

People at SubDoc who can access personal data are bound by confidentiality obligations and access it only as needed to run and support the Service. SubDoc maintains reasonable technical and organizational safeguards, including encryption in transit and at rest, access controls, workspace-level data separation, and activity logging, as described on the Security page.

4. Subprocessors

Customer authorizes SubDoc to use these subprocessors. Each processes data only to deliver its part of the Service.

• OpenAI: automated text extraction from uploaded documents.
• Supabase: managed database.
• Cloudflare (R2): encrypted file storage.
• Heroku and Vercel: application hosting.
• Resend: email delivery.
• Paddle: payments and billing as Merchant of Record (relevant to account holders, not vendor documents).
• Google and Intuit: only if Customer connects Google Calendar or QuickBooks Online.

SubDoc will update this list when providers change and will post the change here. Customer may object to a new subprocessor on reasonable data-protection grounds by emailing [email protected] within 30 days of the change; if the parties cannot resolve it, Customer may stop using the Service and delete its workspace.

5. Assistance, requests, and incidents

• SubDoc will reasonably help Customer respond to access, correction, deletion, and similar requests from individuals, and will forward to Customer any such request it receives about Customer's data.
• SubDoc will notify Customer without undue delay after confirming a security incident that affects Customer's personal data, and will provide the information it reasonably has to help Customer meet its own notification duties.
• SubDoc will reasonably assist with Customer's data protection assessments where the law requires it.

6. Return and deletion

Customer can export its workspace data and delete its workspace at any time. Deleting a workspace removes its records and stored files; copies in infrastructure providers' backups age out on their backup cycle. SubDoc may keep data it must retain by law.

7. Location and transfers

SubDoc's providers may process data in the United States and other countries. Where the law requires a transfer mechanism, such as standard contractual clauses, SubDoc will enter into it on Customer's written request.

8. Information and audits

On reasonable written request, SubDoc will give Customer the information needed to show it follows this DPA, such as its current subprocessor list and a description of its security practices. Customer's other audit rights are limited to what the law requires.

9. Liability and contact

Each party's liability under this DPA is subject to the limitations in the Terms. Questions or requests about this DPA: [email protected].