Processor/service-provider terms offered when a customer requires a DPA or to establish CCPA service-provider status. Not part of default signup.

Data Processing Addendum

This Data Processing Addendum ("DPA") supplements the Terms of Service between you ("Controller") and Valor Hart LLC ("Processor") when applicable data protection law requires a data processing agreement. This DPA applies only when explicitly executed by both parties.

1. Roles and Scope

You are the Controller of the personal data you upload to and process through the Service. Valor Hart acts as the Processor, processing personal data solely on your behalf and in accordance with your documented instructions as set forth in the Terms of Service and this DPA.

2. Processing Purpose

Valor Hart processes personal data only for the purpose of providing the Service as described in the Terms of Service. We do not process personal data for our own purposes beyond what is necessary to operate, maintain, and improve the Service.

3. Security Measures

Valor Hart implements and maintains appropriate technical and organizational measures to protect personal data, including: encryption in transit and at rest, access controls, audit logging, regular security assessments, and incident response procedures. These measures are described in further detail in our Privacy Policy.

4. Subprocessors

Valor Hart uses the following categories of subprocessors: cloud hosting (Vercel, Supabase), payment processing (Stripe), and communication services. A current list of subprocessors is available upon request. We will notify you of any changes to subprocessors and provide you an opportunity to object. All subprocessors are bound by contractual obligations at least as protective as this DPA.

5. Data Breach Notification

In the event of a personal data breach, Valor Hart will notify you without undue delay (and in any event within 72 hours of becoming aware) and provide sufficient information for you to meet your own notification obligations under applicable law.

6. Data Subject Rights

Valor Hart will assist you in responding to requests from data subjects exercising their rights under applicable data protection law, including rights of access, rectification, erasure, restriction, portability, and objection.

7. Deletion and Return

Upon termination of the Service agreement, Valor Hart will, at your election, return or securely delete all personal data processed under this DPA, except to the extent retention is required by applicable law.

8. CCPA Service Provider

To the extent the California Consumer Privacy Act ("CCPA") applies, Valor Hart acts as a "Service Provider" as defined by the CCPA. Valor Hart does not sell personal information and does not retain, use, or disclose personal information for any purpose other than performing the services specified in the Terms of Service.

9. Contact

For DPA-related inquiries: support@valorhartllc.com