Data Processing Addendum

1. Scope and roles

This addendum forms part of the Terms of Service (the “Agreement”) between the Checkbox contracting entity named in the signature block (“Checkbox”) and the customer named there (“Customer”). For personal data about Customer’s own subscribers, shoppers and recipients that Customer routes to Checkbox (“Customer Personal Data”), Customer is the controller (or “business”) and Checkbox is the processor (or “service provider”). Account data about Customer’s own team is covered by the Privacy Policy.

2. Details of processing

• Subject matter and purpose: checking and monitoring Customer’s subscription sign-up, renewal, notice and cancellation flows; recording consent receipts and evidence; sending notices and hosting pages at Customer’s direction.
• Categories of data subjects: Customer’s shoppers and subscribers, and recipients of notices sent through Checkbox.
• Types of personal data: email addresses and message content of emails routed to Checkbox; consent records (the disclosure shown, the agreement, time, and the reference Customer supplies); subscription settings and lifecycle events from the connected billing platform; page captures (form inputs are excluded). No special categories of data are intended to be processed.
• Duration: for the term of the Agreement and the retention periods on the Trust center, including write-once evidence retention.

3. Checkbox’s obligations

• Process Customer Personal Data only on Customer’s documented instructions, including the Agreement and Customer’s configuration of the service.
• Not sell or share Customer Personal Data, and not retain, use or disclose it for any purpose other than providing the service, as required of a service provider under the California Consumer Privacy Act.
• Ensure that people authorized to process Customer Personal Data are bound by confidentiality.
• Maintain the technical and organizational measures described on the Security page and the Trust center.
• Assist Customer, taking into account the nature of the processing, with requests from data subjects, including erasure of consent receipts through the API.
• Notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and in any case email Customer’s account owner within 24 hours of declaring a serious incident (as described on the Trust center), with the information reasonably available, updating it as more becomes known.
• On termination, delete Customer Personal Data except evidence held in write-once storage, which is deleted when its retention period ends, and data the law requires us to keep.
• Because the evidence vault is write-once, personal data inside evidence (for example, a captured email) cannot be erased before its retention period ends (7 years by default); requests to erase it are completed when that period ends. Consent receipts can be erased at any time through the API.
• Make available information reasonably necessary to demonstrate compliance with this addendum, on written request and no more than once a year.

4. Subprocessors

Customer authorizes the subprocessors listed below and on the Trust center. Checkbox will update that list when it adds a subprocessor, giving Customer the opportunity to object; binds each subprocessor to data-protection terms no less protective than these; and remains responsible for their performance as provided in the Agreement.

• Render: Application hosting and the managed PostgreSQL database. Location: United States (Oregon).
• Amazon Web Services (S3): Write-once evidence vault (S3 Object Lock) and nightly database backups. Location: United States (us-west-2, Oregon).
• Postmark: Sending account email, alerts and Checkbox Notices; receiving email at capture addresses. Location: United States.
• Anthropic: Reading disclosure text with a language model to help assess it. Location: United States. When LLM-assisted reading is enabled.
• Sentry: Error reporting for server failures. Location: United States. When error reporting is enabled.
• GitHub and Google: Sign-in with GitHub or Google. Location: United States. Only if you choose that sign-in method.

5. Location and transfers

Customer Personal Data is processed in the United States. Where the law requires a transfer mechanism for data leaving another jurisdiction, the parties will agree on one in the signed copy.

6. Customer’s obligations

Customer is responsible for having a lawful basis and any notices or consents needed to route personal data to Checkbox, for the instructions it gives, and for its own compliance with the laws that apply to its subscription program. This addendum does not make Checkbox responsible for that program.

7. Liability and precedence

Each party’s liability under this addendum is subject to the exclusions and limitations of liability in the Agreement. If this addendum conflicts with the Agreement on the processing of Customer Personal Data, this addendum controls on that point only.

Questions about this addendum: support@checkbox.site. Security reports: security@checkbox.site.