Data Processing Addendum

1. Roles and scope

Controller: the business organization. Processor: P3Analytica (operated from Quebec, Canada). We process the personal data your members and the people you track put into the Service (for example, contacts, applications, workforce records) for the purpose of providing the Service to you, and for no other purpose except as required by law.

Individuals on personal plans are themselves the controllers of their own data; this DPA is aimed at business-organization controllers.

2. Subprocessors

We use the following subprocessors to deliver the Service. Each is bound by data-protection terms appropriate to its role:

• Supabase (database, authentication, file storage) — hosted on AWS in the US (us-west-2, Oregon). • Vercel (application hosting, serverless/edge compute, request logs) — global edge with US-based infrastructure. • Stripe (payment processing) — Stripe is the payment processor; it holds payment-instrument data. We store only Stripe identifiers and payment amounts, never card numbers. • Resend (transactional email delivery) — sends account, billing, and notification emails.

We will give notice of new subprocessors so you can object on reasonable data-protection grounds before they begin processing your data.

3. Technical and organizational measures

We maintain measures appropriate to the risk, including: • Per-organization data isolation enforced at the database layer (row-level security), so one organization cannot read another’s data. • Two-factor authentication (TOTP / AAL2) available on accounts. • Encryption in transit (TLS) and at rest (provided by Supabase / AWS). • Least-privilege administration — the privileged admin console is restricted to the founder; there is no broad internal access to customer data. • Signature-verified payment webhooks, so paid access is only ever granted on a cryptographically verified event from Stripe.

These describe our current practices and may evolve as the Service matures.

4. Assisting with data-subject requests

Taking into account the nature of the processing, we will assist you in responding to data-subject requests (access, rectification, erasure, restriction, portability, objection). Account holders can edit much of their own profile data directly; for other requests, contact pooria.sedd@p3analytica.com and we will help you fulfil your obligations.

5. Personal-data breach notification

If we become aware of a personal-data breach affecting your data, we will notify you without undue delay and, in any event, within 72 hours of becoming aware, with the information you need to meet your own notification obligations. [Window to be confirmed by P3Analytica.]

6. Return and deletion

On termination, and on your instruction, we will delete or return your personal data, except where retention is required by law. Account deletion follows a soft-delete then scheduled hard-delete process (a deletion date is recorded and the data is purged on schedule). A suspended business organization’s data is retained — not deleted — so access can be restored on renewal; deletion happens on a confirmed termination/deletion request.

7. International transfers

Your data is processed and stored in the United States (Supabase / AWS us-west-2) and may transit US-based infrastructure (Vercel). Where personal data of individuals in Quebec, Canada, or the EU/EEA is transferred outside their jurisdiction, the transfer is disclosed here and made under appropriate safeguards. [Data-residency wording and any standard contractual clauses to be confirmed by P3Analytica.]

8. Duration

This DPA applies for as long as we process personal data on your behalf under the Terms of Engagement.