Data Processing Addendum

1. Roles

Customer is the business, or controller, of Personal Information in Customer Data. OpsIntel is its service provider, or processor, under the California Consumer Privacy Act as amended (“CCPA”) and other applicable privacy laws.

2. Instructions and limits

OpsIntel processes Personal Information only to provide the Services under the Customer Agreement and Customer’s documented instructions. OpsIntel will not:

• sell or share Personal Information, as the CCPA defines those terms;
• retain, use or disclose it for any purpose outside the direct business relationship with Customer, except as the CCPA permits;
• combine it with personal information from other sources, except as the CCPA permits a service provider to;
• use it for cross-context behavioral advertising.

OpsIntel certifies that it understands and will comply with these restrictions, and will notify Customer if it can no longer meet its CCPA obligations. Aggregated, de-identified data under the Customer Agreement is not Personal Information, and OpsIntel will not attempt to re-identify it.

3. Personnel

Only personnel who need access to provide the Services may process Personal Information, and each is bound by confidentiality duties.

4. Subprocessors

Customer authorizes OpsIntel to use these subprocessors, each processing in the United States:

• Railway Corporation: application hosting
• Supabase, Inc.: database, file storage and sign-in
• Resend, Inc.: email delivery
• Anthropic, PBC: AI processing for answers and summaries
• Stripe, Inc.: billing and payments

OpsIntel gives at least 15 days’ notice before adding or replacing a subprocessor. Customer may object on reasonable data protection grounds, and if the parties cannot resolve the objection, Customer may terminate the affected Services and receive a refund of prepaid fees for the unused term.

OpsIntel binds each subprocessor to data protection terms at least as protective as this addendum and remains responsible for its subprocessors. OpsIntel uses AI providers only under terms that prohibit training their models on Customer Data.

5. Security

OpsIntel maintains the administrative, technical and physical safeguards described in Annex A, and keeps them at least as protective during the term.

6. Security incidents

OpsIntel notifies Customer without undue delay, and in any case within 72 hours, after confirming unauthorized access to, or disclosure of, Customer’s Personal Information. The notice describes what is known and the steps taken. OpsIntel gives Customer reasonable assistance with any notices Customer must give.

7. Assistance and audits

OpsIntel helps Customer respond to requests from consumers and employees to know, delete or correct their information. Where that requires significant effort, it charges a reasonable fee. OpsIntel also provides information Customer reasonably needs to show compliance with privacy law. Customer may audit compliance through OpsIntel’s written answers and available reports, once a year or after a security incident.

8. Deletion and return

Customer may export Customer Data for 30 days after termination. OpsIntel then deletes Customer Data within 90 days, except copies law requires it to keep. Copies in backups are deleted as the backups expire on their normal schedule and stay protected until then.

9. Location

OpsIntel processes Customer Data in the United States unless Customer agrees otherwise in writing.

10. Annex A: Security measures

• Encryption: data is encrypted in transit with TLS and at rest by the hosting and database providers. Source system credentials are additionally encrypted with AES-256-GCM using keys held only on the server.
• Customer separation: each customer’s data is separated in the database with row-level security, and every request is checked against the signed-in user’s organization and assigned stores.
• Access control: users sign in through managed authentication. Access within a customer is role-based and limited to assigned stores. OpsIntel staff access to production is limited to those who need it.
• Read-only sources: source systems are accessed read-only wherever the source allows it.
• Logging and monitoring: administrative actions are recorded in an audit log, and the Services are monitored for errors and unusual activity.
• Backups: the database provider keeps regular encrypted backups.
• Vulnerability management: dependencies are kept up to date, and code changes go through review and automated tests before release.