Data Processing Addendum

We sign a standard Data Processing Addendum with every paid customer. It commits us to process Customer Data only on your documented instructions, apply the technical and organizational safeguards described on our Security page, use only the subprocessors we publicly list, notify you of new ones at least 30 days in advance, help you respond to data-subject requests, notify you without undue delay of any incident, and return or delete Customer Data on termination. The full text incorporates the EU Standard Contractual Clauses where cross-border transfers apply.

Email [email protected] with the subject DPA request and include:

• Your legal entity name (the signing party on your side).
• Your account email or tenant identifier on Ceres.
• Whether you want our standard DPA or have your own template you'd like us to review.

We countersign our standard DPA within one business day. Custom DPAs take up to five business days depending on review complexity.

The DPA applies as long as you have an active subscription. It terminates automatically when your subscription ends, except for surviving obligations (audit cooperation, return of Customer Data, confidentiality of what we learned while serving you).

On your behalf, we may process:

• Contact details of people inside your organization who use the Portal (name, work email, role).
• Identifiers of IM channels and accounts you connect (Slack channel ID, Discord guild ID, etc.).
• Content of briefings, approvals, and outbound messages — which may include personal data about third parties if you configure a connector that surfaces it.
• Activity logs tied to your tenant (schedules triggered, approvals granted, errors).
• If you run a members area on a site we host for you: the email addresses of the people you admit to it (added by you, or taken from paid orders), the pages each may open, and records of their sign-ins.

We do not knowingly receive special categories of data (e.g. health, biometric, or children's data). If your planned use case touches those categories, stop and email [email protected] so we can assess together.

• Your employees and contractors who use the Portal.
• Your customers, prospects, or other third parties surfaced through connectors you configure.
• People you admit to a members area, such as your students, buyers or subscribers.

When you restrict pages on a site we host for you to people you list, you are the controller of those people's email addresses and we process them for you only to run their sign-in: to email a one-time sign-in link to a listed address, to keep that person signed in to your site, and to let you review and remove access. We never use these addresses for our own marketing.

• A person you remove, or who has no access left, is deleted 90 days after their access was last revoked, or 90 days after they were added if they never had access.
• Sign-in links are deleted 7 days after they expire, and sessions 7 days after they expire or are ended.
• The sign-in event log, which holds a keyed hash of each address and no readable address, is deleted after 400 days.
• Everything above is deleted when you delete the site or your account.

You are responsible for having a lawful basis to admit each person and for answering their requests; we help you do so as described above. Sign-in emails are sent through the email subprocessor on our Security page.

For EU and UK customer data transferred outside the EEA/UK, we rely on the EU Commission's Standard Contractual Clauses (Module Two: controller-to-processor) and, where relevant, the UK's International Data Transfer Addendum. The SCCs are incorporated by reference in our DPA; they prevail over any conflicting provision.

The current list of subprocessors is published on our Security page. You can subscribe to email notifications for subprocessor changes at that link.

For all DPA-related matters — new requests, amendments, subprocessor objections, audit cooperation — email [email protected].