Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Terms of Service between Tuanilabs LLC ("TuaniBiz", "we") and the business that uses TuaniBiz ("you"). It applies to the personal information we process on your behalf when we provide the service ("your customer data"). If this DPA and the Terms disagree about your customer data, this DPA applies.

Roles

• For your customer data, you decide why and how it is processed (you are the "business" or "controller"), and we process it for you (we are your "service provider" or "processor").
• For the information about you and your account that we use for our own purposes, such as billing and security, we act on our own account, as our Privacy Policy describes.

What we process

• Purpose: to provide the service you use: hosting your website, taking bookings, answering chats, calls and social messages with AI, taking messages and sending alerts to your team, quotes, invoices and payments through Stripe, team scheduling and chat, statistics for your website, AI-written content for your business, and keeping all of that secure and free of spam.
• People concerned: your customers and prospective customers, visitors to your website, people who call you or message your social accounts, your employees and contractors, and anyone your customers mention.
• Types of information: names and contact details; service addresses; appointment and job details; messages, chat conversations and call transcripts; call audio while a call is in progress; quote, invoice and payment details (Stripe collects card numbers; we never receive them); the IP address and browser used for security and as evidence when a payment is disputed; team schedules, time off and time clock entries; team chat messages, photos, videos and voice notes; and reviews.
• Sensitive information: the service is not designed for it. You must not use it to collect health information or other sensitive information.
• Duration: for as long as you use the service, and then until the information is deleted under our retention schedule (see Deletion at the end of the service).

Your instructions

We process your customer data only on your instructions: these Terms and this DPA, and the way you set up and use the service. If we believe an instruction breaks the law, we will tell you. You are responsible for having the right to give us your customer data and for giving your customers and staff the notices, and obtaining the consents, the law requires of you, including consent for texts and notices for call recording. Every website we host links a privacy notice that describes what it collects; review it and tell us if it is not accurate for your business.

Service-provider commitments

For your customer data, we will not:

• sell it or share it for cross-context behavioral advertising;
• keep, use or disclose it for any purpose other than providing the service to you, or outside our direct business relationship with you, except as the law allows a service provider to;
• combine it with personal information we receive from other businesses or collect on our own, except where the law allows. One such use: the reputation of a phone number reported as spam or a robocaller by one business helps block it for others.

We will comply with the California Consumer Privacy Act and other privacy laws that apply to us as your service provider, give your customer data the protection those laws require, tell you if we can no longer meet these commitments, and let you take reasonable steps to stop and remedy any use of your customer data that breaks them.

Confidentiality

Only people who need your customer data to provide or support the service can access it, and we require them to keep it confidential. [To be completed by the owner: confirm that every person with access has signed confidentiality terms.]

Security

We protect your customer data with the measures in the Security measures section below. No method of storing or sending information is completely secure, and we do not guarantee security. We do not currently hold third-party security certifications.

Subprocessors

• You authorize us to use the subprocessors listed on our Subprocessors page. We require each of them, by contract, to protect your customer data and to use it only to provide its services to us. [To be completed by the owner: confirm a data processing agreement is in place with each subprocessor.]
• Before we add or replace a subprocessor, we update that page and tell account owners by email at least [To be confirmed by the owner: 30] days ahead. If you object on reasonable data-protection grounds, tell us; if we cannot address your objection, you may cancel the affected part of the service.
• These are not our subprocessors, because you choose them and your agreement with them governs: Facebook and Instagram, your own Google account and Google Analytics property, AI assistants you connect to your dashboard, and Stripe when it processes your customers' card payments under your own Stripe agreement.

Helping you with requests

• If one of your customers sends us a request to see, correct or delete their information, we pass it to you through our Privacy Center process and do not answer it ourselves unless you ask us to or the law requires it.
• When you need to answer a customer's request, we help you find, export, correct or delete that person's information in the service in time to meet the deadline the law gives you.
• We also give you the information you reasonably need to show that you comply with privacy laws regarding our processing.

Security incidents

If we confirm a security incident that affects your customer data, we will tell you without undue delay, and no later than [To be completed by counsel: notice deadline] after confirming it. We will tell you what we know about what happened and what information was affected, take reasonable steps to contain it, and help you meet any duty you have to notify others.

Deletion at the end of the service

• While you use the service, you can download your data from My account in your dashboard, or ask for it through the Privacy Center.
• After your last paid period ends, we delete your customer data under the retention schedule in our Privacy Policy: normally 90 days after the end of that period, after we warn you. You can ask us to delete it sooner.
• We may keep what the law requires, such as financial records, what we need to resolve a dispute or chargeback, and the numbers on our do-not-text list. Backups are deleted when they expire on their own schedule.
• We are rolling out automated enforcement of the retention schedule in stages; each automated deletion first runs in report-only mode before it deletes anything.

Audits

Once a year, on written request, we will answer a reasonable security questionnaire and give you the information reasonably needed to show that we meet this DPA. [LEGAL REVIEW: scope of audits, and whether on-site audits are offered.]

Where your data is processed

We and our subprocessors process your customer data in the United States and, for some subprocessors, in other countries, as listed on our Subprocessors page.

No health information; no business associate agreement

TuaniBiz is not HIPAA compliant, and we do not sign business associate agreements. You must not use the service to collect, store or send protected health information, and nothing in this DPA makes us your business associate.

Liability

Each party's liability under this DPA is subject to the limitation of liability in the Terms of Service.

Security measures

These are the measures in place for your customer data:

• Encryption in transit: our websites and APIs are served only over HTTPS, with HTTP Strict Transport Security.
• Encryption at rest: our database, file storage and hosting providers encrypt the disks that hold the data.
• Database access: every table has row-level security with no access for anonymous or signed-in public roles, apart from affiliates reading their own records. Only our servers, holding a secret key, can read or write your customer data.
• Sign-in: PINs are stored only as salted hashes. Sign-in and sensitive changes can require a one-time code sent by text. Session cookies cannot be read by page scripts, are sent only over HTTPS, and can be revoked.
• Access control: the account owner controls billing and the team. Managers see only the locations they are assigned. Each team member has their own worker portal link, which can be protected with a PIN.
• Our staff: access is limited by role. Support access to a business's dashboard is time-limited and recorded in an audit log.
• Monitoring: an audit log of sensitive actions, kept 400 days; security events, kept 90 days; automated monitoring that alerts us to suspicious activity; and rate limits on public forms and APIs.
• Integrations: messages from Stripe, Meta, Zoom, our email provider and our phone carrier are verified by their signatures before we act on them.
• Files: team chat photos, videos and voice notes are kept in private storage and opened through short-lived links. Other uploaded files can be opened only through their long, hard-to-guess addresses.
• Minimization: we never receive full card numbers; website statistics are kept without IP addresses; and secrets such as PIN hashes are removed from what the dashboard sends to browsers.
• Backups: our database provider keeps backups. [To be completed by the owner: how long backups are kept.]

Contact

Questions about this DPA, or a request under it: dennis@tuanibiz.com.