Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between you (“Customer” or “Controller”) and DoWorkWithAI (“we,” “us,” or “Processor”). It governs our processing of Personal Data on your behalf in connection with the Service.

1. Definitions

Capitalized terms not defined here have the meaning given in our Terms of Service or Privacy Policy. “Personal Data,” “Processing,” “Controller,” “Processor,” “Sub-processor,” and “Data Subject” have the meanings given to them under the EU/UK GDPR and equivalent state privacy laws (CCPA/CPRA in California, VCDPA in Virginia, CPA in Colorado, and similar statutes), as applicable.

2. Roles & Scope

For Personal Data you provide to us through your use of the Service (account data, lesson progress, prompt drafts, support messages), you are the Controller and we are the Processor. We process Personal Data only:

• To deliver the Service to you and your authorized users.
• To provide support, troubleshoot, prevent abuse, and meet legal obligations.
• For aggregated, de-identified analytics that do not identify you or your users.
• As otherwise instructed by you in writing.

3. Categories of Data & Data Subjects

Categories of Personal Data we process on your behalf: name, email, hashed password, payment metadata (Stripe handles card data; we never see it), lesson and module progress, prompt drafts and saved prompts, support messages, IP address and device metadata for security and analytics.

Categories of Data Subjects: you (the account holder) and any authorized end users you grant access to under your subscription.

4. Sub-processors

We use the following Sub-processors to deliver the Service. We remain responsible to you for their performance under this DPA.

We will give reasonable notice (via email to your account address or an update to this page) before adding or replacing a Sub-processor. If you reasonably object to a new Sub-processor on data-protection grounds, you may terminate your subscription and we will provide a pro-rated refund for the unused portion.

5. Security Measures

We maintain technical and organizational measures appropriate to the risk, including:

• Encryption in transit (TLS 1.2+) for all traffic to and from the Service.
• Encryption at rest for the database and file storage (managed by Supabase).
• Row-level security and least-privilege access controls on all customer data.
• Hashed and salted passwords; passwords never stored in plain text.
• Automatic security patches and managed runtime via Vercel.
• No card data ever touches our servers; payments are processed by Stripe (PCI DSS Level 1).
• Application-level health monitoring and uncaught-error capture so we can detect and respond to incidents quickly.
• Internal access to production data limited to the founders and required for support, troubleshooting, and security only.

6. International Data Transfers

Personal Data is stored and processed in the United States. If you or your users access the Service from outside the US, your data will be transferred to and processed in the US. Where a transfer of Personal Data from the EEA, UK, or Switzerland to the US would otherwise be restricted, we rely on the Standard Contractual Clauses (SCCs) and any applicable supplementary measures. Customers who require a counter-signed SCC addendum may request one at the contact below.

7. Data Subject Rights

We will provide reasonable cooperation and assistance, taking into account the nature of the processing, to help you respond to requests from Data Subjects to exercise their rights under applicable data-protection law — including rights of access, correction, deletion, restriction, portability, and objection. Where it is technically feasible for you to action the request directly through your account (for example: editing your profile, deleting your account, exporting your saved prompts), you should do so first.

8. Personal Data Breach Notification

We will notify you without undue delay (and in any event within 72 hours of becoming aware) of any confirmed Personal Data Breach affecting Personal Data we process on your behalf. The notification will include, to the extent then known: the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed to address it.

9. Audits

On reasonable written request and not more than once per year (except where required by law), we will make available information necessary to demonstrate compliance with this DPA, including the Sub-processor list above, our security measures, and any third-party attestations or reports we hold. For customers above a contractual threshold or where required by applicable law, we will negotiate a bilateral on-site or remote audit on commercially reasonable terms.

10. Return & Deletion of Personal Data

On termination of your subscription, you may export your account data through the Service. After 90 days of inactivity following termination, we will delete or de-identify Personal Data we process on your behalf, except where retention is required by law (for example, transaction records required by tax or financial-reporting rules).

11. Liability

Each party’s liability arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitations and exclusions of liability set out in our Terms of Service.

12. Order of Precedence

In the event of a conflict between this DPA and the Terms of Service or Privacy Policy, this DPA controls with respect to the processing of Personal Data on your behalf.

13. Counter-signed DPAs & Questions

For a counter-signed DPA, an SCC addendum, a security questionnaire response, or any other data-protection question, contact support@doworkwithai.com.