Data Processing Addendum (summary)

(1) In this document "Controller" means the customer using the Service and "Processor" means VanillaX Inc..

(2) For its own account and organization data the Company acts as a controller under the Privacy Policy; for third-party personal data the customer supplies, it acts as a processor under this document.

(3) This is a summary. Customers who need a signed processing agreement can request the standard contract at admin@vanillax.co. Once signed, that contract prevails over this document.

(1) The Processor processes personal data only on the Controller's documented instructions — this document, the Terms of Service, and requests made through the Service screens and the API.

(2) The Processor does not use personal data beyond the entrusted purpose and does not disclose it to third parties. In particular it does not use it to train, fine-tune or evaluate AI models.

(3) The Processor limits the staff who handle personal data to the minimum and binds them to confidentiality.

(4) If the Processor considers an instruction unlawful, it tells the Controller without delay and may suspend that instruction.

(5) The Controller is responsible for having a lawful basis for collection and handles data subject requests in the first instance. The Processor cooperates to a reasonable extent on request.

The Processor maintains the following.

(1) The Processor uses the following sub-processors to the extent needed to run the Service. By accepting this document the Controller authorises them.

(2) The Processor imposes obligations equivalent to this document on each sub-processor and remains directly liable to the Controller for their processing.

(3) Before adding or changing a sub-processor the Processor updates this document 30 days in advance and emails organization owners and admins. The Controller may object on reasonable grounds within 14 days; if no agreement is reached, it may terminate without penalty.

(1) Of the sub-processors, Vercel, Google, OpenAI and Brave process in the United States; Supabase stores in the Seoul region of Korea with operational access from the United States. Full detail is in the cross-border transfer table in Article 7 of the Privacy Policy.

(2) The Controller is responsible for reflecting these transfers in its own privacy policy and, where required, for informing data subjects or obtaining their consent.

(1) The Processor notifies the Controller without delay, and in any case within 24 hours, of becoming aware of a breach or a suspected breach.

(2) The notification includes, so far as known: the categories and volume of data affected, when and how it happened, the harm identified, what the Processor has done, what the Controller can do, and a contact point.

(3) The Processor provides the material the Controller needs to meet its own notification and reporting duties under Article 34 of PIPA, and cooperates with them.

(1) Once a year the Controller may ask the Processor for evidence that these protections are in place; the Processor provides it in writing within 30 days.

(2) Where a supervisory authority investigates or a serious incident occurs, the Processor cooperates without that annual limit.

(3) On-site audits are agreed in advance as to scope, timing and cost, and are conducted so that no other customer's data is exposed.

(1) The Controller can delete an individual inspection in the Service or through the API, which destroys the related uploads and results immediately.

(2) When the agreement ends the Processor returns or destroys personal data at the Controller's choice. If no return is requested, it destroys the data within 30 days of the end date.

(3) Return is provided as output downloads (report, images, JSON) and must be requested within 30 days of the end date.

(4) Copies remaining on backup media expire once the backup retention cycle (up to 30 days) passes. Data that must be retained by law is kept with restricted access for that period.

(5) The Processor confirms completion of destruction in writing on request.

(1) Where a data subject suffers loss because the Processor breached this document, the Processor is treated as an employee of the Controller and bears liability under Article 26(6) of PIPA.

(2) As between the Controller and the Processor, the liability cap in Article 17 of the Terms of Service applies, except for a breach caused by the Processor's wilful misconduct or gross negligence.

(3) The Controller bears the loss arising from entering personal data without a lawful basis for collecting it.

This document takes effect on 2026-09-03. To request the standard signed processing agreement, write to admin@vanillax.co.