Data processing agreement

This data processing agreement ("DPA") forms part of the StackOS terms of service between Stack Mode ("Processor") and the customer ("Controller") when StackOS processes personal data on the customer's behalf.

1. Scope

The Processor processes personal data that the Controller and its users add to StackOS, including data about the Controller's clients, contacts, and their website visitors, only to provide the service described in the terms.

2. Instructions

The Processor processes personal data only on the Controller's documented instructions, which are the terms, this DPA, and the Controller's use of StackOS's features.

3. Confidentiality

People authorized to process the data are bound by confidentiality.

4. Security

The Processor maintains appropriate technical and organizational measures, including encryption of secrets at rest, access controls with permission levels, isolation of each client's portal data, and payment processing through Stripe. A current summary is at mystackos.com/security.

5. Subprocessors

The Controller authorizes the subprocessors listed in the privacy policy, including Vercel, Neon, Cloudflare, Resend, Stripe, Plaid, Anthropic, and ElevenLabs. The Processor will give notice of new subprocessors, and the Controller may object on reasonable grounds.

6. Assistance

The Processor will help the Controller respond to requests from individuals exercising their rights, and with security and impact assessments, to the extent reasonable given the nature of the processing.

7. Personal data breaches

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, with the information reasonably available.

8. Deletion and return

On termination, the Controller can export its data during a 30-day read-only period. After that, the Processor deletes it, except where the law requires it to be kept.

9. Audits

The Processor will make available information reasonably necessary to show compliance with this DPA.

10. International transfers

StackOS is hosted in the United States. Where data is transferred from another region, the parties will rely on an appropriate transfer mechanism.

11. Order of precedence

If this DPA and the terms conflict about the processing of personal data, this DPA controls.