Data Processing Addendum

1. Scope

This addendum is part of the Simplest1 Terms of Service. It applies whenever you keep personal data about other people on a Simplest1 site: a blog's commenters and subscribers, a help desk's customers, Hiring's candidates, a CRM's contacts, a form's answers.

2. Roles

• You, the customer who holds the Simplest1 account, decide what personal data your site collects and why. You are the controller.
• We, Intelliworks Inc., a Canadian company doing business as Simplest1, keep and process that data only to run your site for you. We are the processor.
• The people your site keeps data about (your readers, customers, candidates and contacts) are the data subjects.

3. Processing on Your Instructions

• We process personal data only on your instructions. Your instructions are these terms, your settings, and what you and your team do on your site or through its API.
• We do not sell it, rent it, use it to advertise, or use it to train any model. We do not look at it except to run, secure, support or back up the service, or when the law requires it.
• If an instruction of yours would, in our view, break the law, we tell you and may decline to follow it.

4. What We Process and Why

• Contact details: names, email addresses and phone numbers that you or your visitors enter, to keep the records your app keeps and send the mail you ask it to send.
• Content: posts, comments, tickets, messages, notes, applications and form answers, to store and show what your site holds.
• Files: uploads, attachments, CVs and images, to store them and serve them to the people you allow.
• Email: mail your site sends, to deliver it.
• Email to your site: mail sent to your site's addresses, or forwarded there from an address of yours, received through Cloudflare, to receive it and thread it into conversations.
• Technical data: IP addresses, browser details and a daily visitor hash for page counts, to secure the service, limit abuse and count visits without tracking people.

Each site's data lives in its own database file, separate from every other site's.

5. Confidentiality

Only the people who need access to run the service have it, and they are bound to keep the data confidential.

6. Security

We keep the data safe with measures fit for the risk, including: a separate database for each site; encrypted connections (TLS) for every request; sign-in by emailed link or passkey, with no passwords to steal; protection against cross-site request forgery, injection and cross-site scripting; rate limits; an audit log of who changed what; and offsite backups. Our security page describes how we protect the service.

7. Subprocessors

You allow us to use these subprocessors. Each is bound by a written agreement that protects the data at least as well as this addendum does.

• Cloudflare, Inc.: the network edge every request passes through (TLS, protection from attacks), email sending, the form guard (Turnstile) and backup storage (R2). It also receives the mail sent to your site's addresses. Where: its global network; backups in R2.
• Leaseweb: the server that runs Simplest1 and holds every site's live data. Where: Montreal, Canada.
• Stripe, Inc.: payments for your Simplest1 plan (your billing details only, never your site's data). Where: the United States and elsewhere.
• OpenAI: where you turn Assist on, the text or image a writer asks Assist about, or the messages of a conversation a team member asks Assist to answer or summarize, a customer's included, to write the suggestion. Nothing else is sent, and OpenAI does not use it to train its models. It keeps it for at most 30 days, to watch for abuse. Where: the United States.

We tell you at least 30 days before we add or replace a subprocessor, by email and on this page. If you object on reasonable grounds and we cannot resolve it, you may close your account.

8. Requests from the People You Serve

Your site gives you the tools to answer a person who asks to see, correct, export or delete their data: the export of your whole site, and Settings, Erasure, which forgets in one step everything your site keeps under an email address. Where a tool does not reach, we help you on request.

If a person writes to us directly about your site, we pass the request to you and do not answer it ourselves unless you ask us to.

9. Deletion and Backups

• You may delete any record at any time. A record erased through Erasure stays erased: if your site is ever restored from a backup, the people erased are erased again before the site opens.
• When you close a site, you have 30 days to export everything. After that, the site's data is deleted, and the backups that still hold it expire 30 days later.
• Backups are kept for 30 days and then deleted. Within those 30 days, they are used only to restore the service or your site.

10. Security Breaches

If we learn of a breach of security that leads to the loss, change or disclosure of, or access to, your site's personal data without authority, we tell you without undue delay, and in any case within 72 hours of learning of it, by email to the account's owner.

The notice says what happened, what data and how many people it touches as far as we know, what we have done, and what you may need to do. We keep you informed as we learn more, and help you meet your own duties to notify regulators and the people concerned.

11. Audits

On request, once a year, we answer a reasonable security questionnaire and give you the information needed to show that we meet this addendum.

12. International Transfers

Your data is stored on servers in Canada and the United States. Your site's live data is kept on our server in Montreal, Canada. Your billing details are kept by Stripe, in the United States and elsewhere. What a writer or a team member asks Assist about is processed by OpenAI in the United States. Requests, email and backups pass through or are kept on Cloudflare's global network, and may be processed outside Canada. Where the law of your country requires safeguards for such a transfer, we rely on the safeguards each subprocessor offers.

13. Duration

This addendum lasts as long as we process personal data for you. When it ends, section 9 applies.

14. Contact

Questions about this addendum? Contact us at [email protected].

For help with your account, a site or billing, write to us at support.simplest1.com.