Data Processing Addendum

Effective date: [YYYY-MM-DD] · Version: [YYYY-MM-DD]

1. What this addendum is and when it applies

This Data Processing Addendum ("DPA") applies together with the SplitSpoon Terms of Service (the "Terms"). It applies automatically, with no separate signature, whenever your content includes personal data. It covers that personal data only.

Your boring logs and reports often name people: drillers, loggers, engineers and your clients. They can also hold signatures, site addresses and phone numbers. This DPA sets out how we handle that information for you.

Our own records about your account (your sign-in, billing and audit trail) are described in our Privacy Policy. [lawyer: whether account data of the customer's own staff should also fall under this DPA, or stay with the Privacy Policy where SplitSpoon acts as controller.]

2. Definitions

Words defined in the Terms mean the same here: "SplitSpoon", "we", "us", "you" and "the Service". In this DPA:

• "Your content" has the meaning in Terms §6.
• "Customer personal data" means personal data in your content that we process for you through the Service. Annex A describes it.
• "Data protection law" means any privacy or data protection law that applies to that processing. This can include U.S. state laws such as the California Consumer Privacy Act as amended (the "CCPA"), and, if they apply, the EU and UK GDPR. [lawyer: list or leave general]
• "Personal data", "controller", "processor", "data subject" and "processing" have the meanings given in data protection law. Under U.S. state laws, read "controller" as "business" and "processor" as "service provider".
• "Subprocessor" means a company we engage that processes customer personal data for us. Annex C lists them.
• "Personal-data breach" means a breach of security that leads to the accidental or unlawful destruction, loss, change, or unauthorised disclosure of, or access to, customer personal data.
• "Deletion grace period" means the 30 days (720 hours) after your account deletion request, before we delete your account records (Terms §9).

3. Roles

• You are the controller (the "business") of customer personal data. You decide why it is processed and what you upload.
• We are your processor (your "service provider"). We process customer personal data only for you, to run the Service.
• You confirm that you have the right to give us that data, as Terms §6 already requires. This includes any notice to, or consent from, the people named in your documents, and any duty you owe your clients.

4. Your instructions

We process customer personal data only on your documented instructions. Your instructions are:

• the Terms and this DPA; and
• the way you use the Service: what you upload, which features you run, and the settings you choose, such as your retention period.

We will not process customer personal data for any other purpose, unless the law requires it. If it does, we will tell you first, unless the law forbids that. If we believe an instruction breaks data protection law, we will tell you. [lawyer: wording of the "law requires" exception]

5. Our people

Only people who need access to run the Service may have it. Everyone with access is bound by a duty of confidentiality. [owner: today the operator is the owner alone; confirm, and confirm that any future staff or contractor signs a confidentiality agreement.]

6. Security

We protect customer personal data with the measures in Annex B. We may improve them over time, but we will not lower the overall level of protection.

7. Subprocessors

• General authorisation. You authorise us to use the subprocessors in Annex C.
• Our duties. We put each subprocessor under written terms that protect customer personal data at least as well as this DPA does. We remain responsible to you for their work. [lawyer: most providers here offer only their standard terms; is accepting those enough?]
• Changes. Before we add or replace a subprocessor, we will update Annex C at this page and tell account holders by email, at least 30 days ahead. [owner: notice period and method; email, in-app notice, or both.]
• Objection. You may object to a new subprocessor on reasonable data protection grounds, by writing to [email protected] before the change takes effect. We will try to find a solution. If we cannot, you may stop using the Service and delete your account. [lawyer: does an objection that ends in deletion need a refund of unused credits? Credits are otherwise non-refundable under the Refund & Credits Policy.]

8. Helping you with requests and assessments

• Requests from people. If someone named in your documents asks us to see, correct or delete their data, we will pass the request to you and not answer it ourselves, unless the law requires us to.
• Requests we must act on. You will tell us of any request under data protection law that we must act on, and give us what we need to act on it.
• What you can do yourself. You control customer personal data in the Service directly:
  • delete uploaded documents and page images at once, or set how long they are kept (0 to 30 days);
  • delete an extraction session;
  • edit or delete projects and their versions in your vault;
  • delete your whole account. You cannot schedule this yourself while a run is in progress or paused with credits still held, while a payment dispute is open, while a refunded amount is still owed (Terms §7.6), or while your account is suspended; §10 says what happens then.
• What we cannot do. Your projects are encrypted in your browser with your vault key, which we never hold. We cannot search, read, correct or export them for you. Only you can.
• Impact assessments. On request, we will give you the information we have about our processing, so that you can complete a data protection impact assessment or consult a regulator. Annexes A to C are our standard answer.
• Cost. This help is free where it is reasonable. [lawyer: may we charge for extensive help?]

9. Personal-data breaches

• Notice. If we become aware of a personal-data breach, we will tell you without undue delay, and within 72 hours of becoming aware of it. [lawyer: 72 hours, or "without undue delay" alone? Some contracts use 48 hours.]
• How. By email to the address on your account.
• What we will tell you, as far as we know it at the time:
  • what happened and when;
  • which kinds of data and which accounts were involved;
  • the likely consequences;
  • what we have done and will do about it;
  • what you should do;
  • who to contact for more information.
  We will add details as we learn them.
• What we can know. We can tell you which accounts, jobs and files a breach touched, from our records. We cannot tell you which people are named in your documents, because we do not read them. If a breach involves your projects, the attacker sees only data encrypted with your vault key. Job files are different: a person with our server keys could read them.
• Your duties. You decide whether to notify regulators and the people named in your documents. We will help you with the facts.
• No admission. Our notice is not an admission of fault. [lawyer]

10. Deletion or return at the end

• Return. Before you close your account, export what you want to keep. Your projects open and export in the app. Your receipts and credit history are on your account page. Job files are short-lived (Annex A) and are not kept for return. If your account is suspended, Terms §9A says when you can export.
• Export first. Signing in during the deletion grace period cancels the deletion. Export before you request it.
• Deletion. When the 30-day (720-hour) grace period ends, we delete your account records, your sign-in and the key that protects your job files. Stored files are purged within 30 days after that. We also delete your Stripe customer record. [verify before publish: the production Stripe customer-delete key (rk_live) is set; run one test purge] Stripe keeps its own records of past payments under its own legal duties.
• When you cannot schedule it yourself. You cannot schedule a deletion yourself while a run is in progress or paused with credits still held, while a payment dispute is open, while a refunded amount is still owed (Terms §7.6), or while your account is suspended. In those cases, write to us. We delete the account once the run ends, the amount is settled or written off, or the dispute, breach or other reason for the suspension is resolved. If only a run is in the way, we delete it no later than 90 days after your request. [verify: CG-OPDEL built 10-13 on prep/int, not yet deployed. The sweep still waits while credits are held, so the 90-day bound needs the run to end first]
• Backups. We do not rewrite backups. Our encrypted database backups keep copies of your account rows for normally up to 12 months (30 daily and 12 monthly copies), then age out. Our hosting provider also keeps 7 daily images of the server disk, and we keep 4 weekly snapshots, so a copy can last about 4 weeks. These images are protected by the provider's access controls, not by our offline backup key. [owner: code gap CG-SNAP — the 4 weekly snapshots are pruned by hand, and monthly dumps are pruned by count, not age] Backups are used only to restore the Service after a failure, never for any other purpose. [verify: whether a restore re-applies deletions made since the backup; no step in the restore procedure does this today.]
• If the Terms end another way. Terms §9A applies: until the end date you can sign in and export your work, and after it we delete your account as Terms §9 describes, within 90 days, without waiting for a request. If something listed in Terms §9 stops you scheduling a deletion yourself, we delete it once Terms §9 says we can. [verify: CG-OPDEL built 10-13 on prep/int, not yet deployed]
• Legal holds. We may keep the records we need for an open payment dispute, an amount you owe, or a legal claim, use them only for that purpose, and delete them once it is settled. [lawyer: legal-hold wording, e.g. "to establish, exercise or defend legal claims"] [owner: code gap CG-RECORDS — today the purge keeps nothing]

11. Audits and information

• Documents first. On request, once a year, we will answer a reasonable security questionnaire and give you this DPA, its annexes and our security page. These are the evidence that we meet this DPA.
• No on-site audits, except where the Standard Contractual Clauses require them. We run on hosted infrastructure, and we do not otherwise offer on-site inspections. [lawyer: will a written-only audit right satisfy GDPR Art. 28(3)(h) and CCPA "reasonable and appropriate steps"?]
• Independent report. We do not have an independent security certification today. If we obtain one (for example SOC 2), we will share its report under a confidentiality agreement instead. [owner]
• Independent assessor. Instead of an on-site audit, we will, at your cost and no more than once a year, let an independent assessor bound by confidentiality review our controls and give you a report. [lawyer: enough for Virginia-style processor-contract laws, which require assessments or an independent assessor's report?]
• Regulators. If a regulator with authority over you requires an audit, we will cooperate with it. [lawyer]

12. Where data is processed; international transfers

• Where it lives. Our servers and database are in Ashburn, Virginia, USA. Our file storage is in Cloudflare R2's Eastern North America region. AI providers and the other subprocessors in Annex C process data where Annex C says.
• Transfers from the EU, the EEA or the UK. If data protection law treats your upload as a transfer to the USA, the EU Standard Contractual Clauses (Module 2, controller to processor) and the UK International Data Transfer Addendum apply, and are incorporated by reference. [lawyer: module choice, docking, governing law and court for the clauses, the Swiss addendum, and whether the EU-U.S. Data Privacy Framework is an option.] If the Standard Contractual Clauses or the UK Addendum apply and conflict with this DPA or the Terms, the clauses prevail. [lawyer: SCC Clause 12 vs the §15 cap; owner: the U.S.-only option (CG-COUNTRY) removes this]
• Or a U.S.-only Service. [owner: alternatively, limit sign-up to firms in the USA and replace this section with a statement that the Service is not offered outside it. The sign-up flow has no country check today.]

13. U.S. state privacy laws (service-provider terms)

Where the CCPA or a similar U.S. state law applies, we act as your service provider (or processor), and we:

• do not sell or share customer personal data, as those words are used in the CCPA (sharing includes cross-context behavioural advertising);
• do not keep, use or disclose it for any purpose other than providing the Service to you under the Terms, for the business purposes listed in Annex A;
• do not keep, use or disclose it outside our direct business relationship with you;
• do not combine it with personal data we get from anyone else, or collect ourselves, except as those laws allow;
• give it the same level of protection those laws require;
• tell you if we can no longer meet these duties;
• let you take reasonable steps to stop and fix any use of it that these terms do not allow.

We certify that we understand these restrictions and will comply with them. [lawyer: check against the current CCPA regulations and other states' processor-contract requirements.]

14. AI providers

• They are subprocessors. The AI providers in Annex C read the pages you submit. A vision model cannot read an image it cannot see, so they receive the page as plaintext.
• What they receive. Rendered images of the pages you submit, and our extraction instructions. For AI Layer Correlation, the decrypted boring summaries for that request (boring numbers, elevations, depths and soil-type changes) and the name you gave the cross-section go to the AI provider you choose, for that request only. When you ask the AI to re-read one field, we send that page image, the field's current value, any suggested alternatives and the reason it was flagged, for that request only.
• Their retention. The providers may keep inputs and outputs for up to 30 days for abuse monitoring, under their own terms. We do not yet have a zero-data-retention arrangement with either provider. The Max+ tier runs on a model whose provider keeps inputs and outputs for 30 days regardless of any such arrangement. The app shows this notice, and you must acknowledge it, before a Max+ run. [verify: Anthropic's and OpenAI's current API retention terms on the publish date.]
• No training. Our providers do not train their models on our API traffic, under their commercial terms. [verify: the provider terms on the publish date; Terms §6 carries the same flag.]

15. Liability

Our liability under this DPA is subject to Terms §13. Nothing in this DPA limits your obligations under Terms §14 or your liability for your own duties as controller. The Terms §13 carve-out for death or personal injury caused by our negligence, and for fraud, applies here as written there. This does not affect Terms §14. [lawyer: is our cap under Terms §13 acceptable for data protection claims, or should there be a separate cap or a carve-out?]

16. Order of precedence, changes and term

• Precedence. Subject to §12, for the processing of personal data, this DPA controls over the Beta Program Terms and the Terms (which include the Acceptable Use Policy and the Refund & Credits Policy). This DPA adopts only its own Annexes A to C. It does not adopt the Privacy Policy or the security page. [lawyer]
• Changes. Terms §15 applies to changes to this DPA. This DPA shares one version number with the Terms. We will not reduce the protection it gives you without notice.
• Term. This DPA continues for as long as we hold customer personal data, including in backups.

Annex A: Processing details

Retention of customer personal data

Annex B: Security measures

These are the measures the Service has today.

Encryption and keys

• Projects (your vault). Projects, their versions and their names are encrypted in your browser with a 256-bit vault key before they reach us. The vault key is wrapped by a key derived from your passphrase (Argon2id), and by a recovery key shown to you once. We store only ciphertext and the wrapped key. We cannot read your projects.
• Job files. Uploaded documents, rendered page images, extraction checkpoints and results are stored encrypted with AES-256-GCM, under a key unique to your account. Each file's encryption is bound to your account and its storage path.
• Uploads in staging. An upload first lands in a staging area without our per-account encryption. When a run starts, it is checked and moved into encrypted storage, and the staging copy is deleted. An upload that never becomes a run is deleted, usually within an hour and normally within 2 days. [verify: storage-level encryption of the staging area by Cloudflare.]
• Key management. Each account's key is wrapped by a key in Amazon Web Services Key Management Service (KMS). The wrap is bound to your account, so a wrapped key opens only for that account. Unwrapped keys exist only in the memory of our API and extraction worker, for the request or job that needs them. A production setup that loses its KMS setting fails closed; it does not quietly fall back to a local key.
• In memory only. The worker decrypts one page at a time and renders it in memory.

Access control

• Sign-in and two-factor. Sign-in is handled by our authentication provider. Two-factor authentication (authenticator app) is available to everyone. Once you enrol, every request needs it. Administrative access always needs it.
• Tenant isolation. Every account's data is separated at the database level with row-level security, enforced even on the table owner. Your account id comes only from your verified sign-in token, never from a request. File storage paths are checked to belong to your account.
• Separate service roles. The web service, the billing service and the extraction worker connect to the database under separate roles with separate permissions. Only the worker holds the AI provider keys.
• Sessions. You can sign out of every device. An administrator can do the same for an account.

Records

• Audit trail. An audit trail records top-ups, refunds, credit adjustments, admin actions (including an administrator viewing an account), vault changes, some run events and acceptance of a new version of the Terms, each with the time. Vault changes also record the IP address and browser user-agent. Accepting a new version of the Terms records the version, the time, the IP address and the browser user-agent. Acceptance at sign-up records the version and time in the audit history too. Sign-ins (once per session), deletion requests and cancellations, and two-factor enrolment and removal are recorded too, with the IP address and browser user-agent. [verify: built on prep/int, not yet deployed.] [verify: there is no screen in the app that shows you your audit trail yet.]
• Web logs. Our web server logs drop the query string, cookies and authorisation headers, and mask the client IP address. They are kept up to 30 days. Our application server keeps its own access log, with the full client IP address and the request line, until it is rotated out by size (about 30 MB of log, which can take weeks at low traffic), and in the server disk images for about 4 weeks after that [owner: code gap CG-ACCESSLOG removes this].

Backups

• Encrypted database backups. Nightly, encrypted with a public key whose private half is kept offline. They are stored in a separate bucket, under a credential that can reach only that bucket. A 30-day lock stops anyone, including us, from deleting or overwriting recent backups. We keep 30 daily and 12 monthly copies.
• Server disk images. Our hosting provider also keeps 7 daily images of the server disk, and we keep 4 weekly snapshots, so a copy can last about 4 weeks. These images are protected by the provider's access controls, not by our offline backup key. [owner: code gap CG-SNAP — the 4 weekly snapshots are pruned by hand, and monthly dumps are pruned by count, not age]
• Job files and projects are not copied into backups.

Retention and deletion

• Retention windows are in Annex A. Job files expire on your setting (7 days after the run ends by default, 0 to 30 days, or as soon as the run ends; files of a paused run are kept for at least 1 day).
• When the 30-day (720-hour) grace period ends, we delete your account records, your sign-in and the key that protects your job files. Stored files are purged within 30 days after that. The purge also deletes your Stripe customer record (§10), and a check after it confirms no row for your account remains.

Network and browser

• Encrypted connections. Traffic passes through Cloudflare over TLS (version 1.2 or later), and Cloudflare connects to our server with a verified certificate. Browsers are told to use HTTPS only (HSTS).
• Content security policy. The app limits which sites a page may load code from or connect to, and refuses to be framed by other sites.

Access by the operator

• Our administrative tools can suspend an account, adjust credits, and see job and billing records. They have no function that opens your job files, page images or projects.
• Our API and extraction worker can decrypt job files, because they must seal and render them. A person with control of our servers and keys could therefore reach job files while they exist. They could not read your projects.
• We look at a page of yours only if you send it to us. [verify: the "report a bad extraction" button is described on our security page but is not in the app yet.]

Incident response

• We keep a written incident plan. A suspected data or key exposure is our highest severity. We aim to acknowledge it within 15 minutes and act within
  1. The plan covers rotating every secret and key, and signing out every session.

Annex C: Subprocessors

Part 1. Subprocessors that process customer personal data

Part 2. Providers that hold account data, not customer personal data

These process our account and billing records under the Privacy Policy. They are listed here for completeness.

Your browser also loads map tiles and ground elevations directly from the U.S. Geological Survey when you use the map. Our servers are not involved, so it is not our subprocessor.