Data Processing Addendum

1. What this addendum covers

This Data Processing Addendum (the "DPA") is part of the Terms of Service between Launcheazy Inc, doing business as Dmand AI, and each customer. It applies whenever we process Customer Personal Data to provide the Platform, and it takes effect when the customer accepts the Terms or an Order Form that refers to them. No separate signature is needed.

It does not cover Profile Data, the business profiles in our own database, which we collect and license as an independent business under our Privacy Policy. It also does not cover the account and billing details of customers and their Users, which we handle as a business under that policy.

If this DPA and the Terms disagree about Customer Personal Data, this DPA applies. An Order Form may add to it.

2. Words with a defined meaning

Customer Personal Data

Personal information in the Customer Data we process for a customer: the people in lists it uploads, CRM records it syncs, emails and replies in its mailboxes, call records, notes, sequences and the outputs of AI features it runs.

Privacy Laws

The US federal and state laws that apply to the processing of Customer Personal Data, including the California Consumer Privacy Act and the comprehensive privacy laws of other states.

Subprocessor

A provider we engage that processes Customer Personal Data to help us provide the Platform.

Security Incident

A breach of our security that leads to the accidental or unlawful loss, alteration, disclosure of, or access to, Customer Personal Data.

Other terms

Business, service provider, controller, processor, consumer, personal information and sale or sharing have the meanings the Privacy Laws give them.

3. Who decides and who processes

For Customer Personal Data, the customer is the business or controller: it decides why and how the data is processed. Dmand AI is the customer’s service provider or processor: it processes the data only for the customer. Each of us follows the Privacy Laws that apply to its role. The customer is responsible for having a lawful basis and giving any notices needed to collect Customer Personal Data and to contact the people in it.

4. Details of the processing

Purpose

Providing the Platform to the customer: storing and showing records, enrichment the customer requests, AI research and drafts, sequences, sending and tracking email, calls, CRM sync, integrations, support and security.

Nature

Collection through uploads and integrations, storage, organization, retrieval, transmission, enrichment and deletion, as the customer directs through the Platform.

People

The customer’s prospects, contacts, customers, candidates and other people in its records, and its own Users.

Types of data

Names, job titles, employers, work and other contact details, CRM fields the customer maps, email content and metadata, call logs and any call recordings, notes, tasks and AI outputs.

Sensitive data

None. Customers may not upload or sync protected health information or other sensitive personal information.

Duration

The term of the Agreement, then until deletion as Return and deletion of data describes.

5. Processing only on your instructions

We process Customer Personal Data only on the customer’s documented instructions. The Agreement, the settings the customer chooses in the Platform and its written requests to support are its instructions. If we believe an instruction breaks a Privacy Law, we will tell the customer and may decline to follow it. If the law requires us to process Customer Personal Data in another way, we will tell the customer first unless the law forbids it.

6. Our commitments as a service provider

These are the commitments the California Consumer Privacy Act and similar state laws require of a service provider.

Dmand AI will not:

1. sell or share Customer Personal Data;
2. keep, use or disclose it for any purpose other than providing the Platform to the customer under the Agreement, or outside our direct business relationship with the customer;
3. combine it with personal information we receive from anyone else or collect ourselves, or add it to our database, except as the Privacy Laws allow a service provider to;
4. use it to train AI models, ours or anyone else’s.

We will give Customer Personal Data the level of privacy protection the Privacy Laws require, tell the customer if we can no longer meet our obligations under them, and let the customer take reasonable steps to stop and fix any unauthorized use. We understand these restrictions and will comply with them.

7. Our staff

Only staff and contractors who need Customer Personal Data to run, support or secure the Platform can access it, through role-based access controls, and each is bound by written confidentiality obligations. Our staff do not read the content of emails in customer mailboxes except with a User’s agreement for a specific message, where needed to investigate a security problem or abuse, or where the law requires it.

8. Security measures

We protect Customer Personal Data with technical and organizational measures suited to the risk, including:

1. Encryption in transit with TLS 1.2 or higher, and at rest with AES-256 for databases, file storage and backups.
2. Hosting on Google Cloud in the United States, in a private network that is reached only through Cloudflare, with a web application firewall.
3. Access to production systems limited to named staff, through Zero Trust access with multi-factor authentication, and logged.
4. Access tokens for connected mailboxes, CRMs and other apps encrypted at rest. We never receive the passwords for those accounts.
5. Daily encrypted backups with point-in-time recovery.
6. Automated vulnerability alerts and scanning, with critical and high severity issues fixed as soon as they are found.
7. Logs of sign-ins, API activity, admin actions and data exports.
8. An incident response procedure for finding, containing and recovering from incidents.

We may update these measures as long as the overall level of protection does not go down.

9. Subprocessors

1. Authorization. The customer allows us to use the Subprocessors listed on Subprocessors.
2. Terms. Each Subprocessor is bound by a written agreement with data protection terms at least as protective as this DPA, as they apply to the service it provides. We remain responsible for our Subprocessors.
3. New Subprocessors. We will update the Subprocessors page and email account owners at least 30 days before a new Subprocessor starts processing Customer Personal Data.
4. Objections. A customer may object to a new Subprocessor on reasonable data protection grounds by writing to hello@dmand.ai within that 30 days. We will work with the customer in good faith to find a solution. If we cannot, the customer may end the affected part of the Platform and we will refund the fees it prepaid for the rest of the term for that part.

10. Where Customer Personal Data is stored

We store Customer Personal Data on Google Cloud in the United States. Our staff and contractors, including team members in India, may access it only to run, support and secure the Platform, under the controls in Our staff. Our Subprocessors process it in the United States.

11. Help with privacy requests and assessments

1. Requests from people. If a person asks us to act on Customer Personal Data, we pass the request to the customer and do not answer it ourselves unless the customer asks us to. Customers can find, export, correct and delete records in the Platform; where they cannot, we help.
2. Assessments. We give the customer the information about the Platform it reasonably needs for a data protection or risk assessment the Privacy Laws require of it.
3. Authorities. If a regulator or court asks us for Customer Personal Data, we tell the customer, unless the law forbids it, and disclose only what the law requires.

12. Security incidents

If we confirm a Security Incident affecting a customer’s Customer Personal Data, we will notify the customer without undue delay, and in any event within 72 hours of confirming it, by email to its account owner. We will tell the customer what happened, the data and people affected as far as we know them, what we are doing about it and who to contact, and we will update the customer as we learn more. We will take reasonable steps to contain the incident and reduce its effects, and help the customer meet its own notice obligations. Notice of an incident is not an admission of fault.

13. Return and deletion of data

1. During the term. Customers can export and delete their Customer Data in the Platform at any time, or ask us to.
2. When the Agreement ends. The customer can export its Customer Data for 30 days. After that, or within 30 days of the customer’s written request to delete, we delete Customer Personal Data from our production systems.
3. Backups. Backup copies are not used after deletion and age out within 90 days.
4. What we may keep. Only what the law requires us to keep, for as long as it requires, protected as this DPA describes.

14. Information and audits

Once a year, on 30 days written notice, we will answer a customer’s reasonable written security questionnaire and share our security documentation, under confidentiality. If a Privacy Law requires an audit beyond that, or a regulator asks for one, the customer may have an independent auditor that is bound by confidentiality review our compliance with this DPA, on 30 days written notice, during business hours, at the customer’s cost and in a way that does not disrupt the Platform or reveal other customers’ data.

15. Protected health information

Dmand AI is not a covered entity or business associate under HIPAA, and this DPA is not a business associate agreement. Customers must not upload, sync, send or record protected health information through the Platform, as the Acceptable Use Policy says.

16. Liability, term and changes

The limits of liability in the Terms of Service apply to this DPA. It lasts as long as we process Customer Personal Data for the customer. We may update it to follow changes in the Privacy Laws or the Platform; we post the new version here with a new effective date and email account owners at least 30 days before a material change takes effect. A change will not reduce the protection of Customer Personal Data.

17. Contact

Company

Launcheazy Inc

Mail

Privacy requests, Launcheazy Inc, 360 S Baywood Ave, San Jose, CA 95128

Email

hello@dmand.ai