Data Processing Addendum

1. What this addendum covers

• Subject matter: the contents of the documents you create or upload, their field values, and the names and email addresses of the signers you add.
• Purpose: storing your documents, sending them to your signers, collecting signatures and delivering the signed PDFs.
• People concerned: you, your signers and anyone named in your documents.
• Duration: while you use the Service, and then for the retention periods in our Privacy Policy (for example 7 years for completed documents).

We are an independent controller, not your processor, for account, billing and security data and for the audit-trail evidence (IP addresses, devices and timestamps) that we create as evidence of how a document was signed. Our Privacy Policy covers that data.

2. Our commitments

• We process the data only to provide the Service and on your documented instructions, which are these terms and how you use the Service.
• Everyone who works with the data is bound by confidentiality.
• We protect the data with appropriate technical and organisational measures, including encryption of stored files and access controls.
• We tell you without undue delay after we become aware of a personal data breach affecting your data.
• We help you, where we reasonably can, to answer requests from people exercising their data protection rights and with your other obligations under data protection law.
• When the retention period ends, we delete the data, except for what the law requires us to keep and the certificate and audit trail described in our Privacy Policy.
• We give you the information reasonably needed to show that we meet this addendum.

3. Sub-processors

You agree that we may use these sub-processors, each under its own data processing terms:

• Vercel: website and application hosting
• Neon: database hosting
• Cloudflare: encrypted file storage (R2)
• Resend: transactional email
• Upstash: rate limiting

We will tell you before we add or replace a sub-processor, so that you can object.

4. International transfers

Where data from the European Economic Area or the United Kingdom is transferred to a country without an adequacy decision, the European Commission's Standard Contractual Clauses and the UK Addendum to them apply.

5. Contact

Send questions about this addendum to info@karmakoders.com.