Data processing addendum

Who this is between

This addendum is between your company and C-Level Solutions, a California general partnership. It adds to the terms. In this addendum, "we" means the seller and "you" means your company.

Who decides what

You decide what personal data goes in the app and why. We handle that data only to run the service, and only as you tell us through the app, the terms and this addendum.

What data this covers

• Names, email addresses and seats on your org chart
• Your objectives, goals, A3s, one-on-ones, KPI readings and reports, with any personal data people write in them
• Logins and two-step sign-in
• An audit log of changes and a record of each visit our staff make
• The text of each email the app sends

Don't load controlled data, such as ITAR, CUI or health records. We have not assessed the app for that data.

Our access to your data

Our staff can enter your company only with your consent. A new company has no consent on file. A company admin gives or withdraws consent on the Vendor access page, and withdrawing ends every visit at once. A signed contract can set your company to block visits or to require your approval for each visit.

Each visit goes on your company's own record, and your company admins read it. A visit is not read-only: our staff in a visit can make changes. Each private note they open goes on that record, and the record never shows the note's text. If you give no consent, or withdraw it, no staff member can read private notes.

The app has no AI feature, so it sends your company's records to no AI model and trains none. An AI agent working for us may read email you send us. We haven't published a rule on whether an AI agent may hold a staff login.

We bind our staff to keep your data confidential.

Subprocessors

The subprocessor list names each outside service that handles your data, and the privacy notice says what each one receives.

We add a new service to the list and email your company's admins at least 30 days before it starts to handle your data. If you object, you can cancel under the terms.

Security

The security page lists what exists and what does not exist yet. We have no SOC 2 report and no outside security test. We have not tested or published encryption for a production system.

If a breach happens

We have no written commitment on breach notice today.

We email your company's admins without undue delay after we confirm a breach that affects your data. We say what we know, and we add to it as we learn more.

Helping with requests

If a person asks your company about their data, your company admins can read and export what the app holds. The record is append-only, and the app has no tool that removes one person's rows.

If a person asks us directly about a record that belongs to your company, we pass the request to your company's admins. The privacy notice describes how a person asks.

Where data is stored

Planned, and not yet confirmed: the database in the Supabase region closest to Vercel's iad1 region, in the US East. We confirm the region at plan step S5.2. See the privacy notice.

This addendum covers US customers. It has no terms for moving data out of the EU or the UK.

Export and deletion

A company admin can download the company's data at any time. Private notes other people wrote stay out of the file, and so do tokens and login secrets.

One company admin can ask to delete the company. A 30-day wait follows, and any company admin can cancel during the wait. After the wait, a scheduled job deletes the logins and every row of that company, audit log included. We keep one record: the company ID, a hash of its name, and two dates. We have no production backups yet, so we can't say how long deleted data stays in a backup.

Checking our work

Your company admins can read the record of each visit we make, and the company's export holds the raw rows. We have no audit report to give you.

You can ask us written questions about how we handle your data, once a year, and we answer them.

Liability

The liability limit in the terms covers this addendum too. If this addendum and the terms disagree about personal data, this addendum wins.

Questions

Write to support@runhoshin.com.