Data Processing Addendum (DPA)
DRAFT — pending legal review. This DPA forms part of the Terms of Service.
This DPA applies where Cleaner OS processes personal data on behalf of a Customer (the "controller") in providing the service. Cleaner OS acts as processor (and, under U.S. state laws, as a service provider).
1. Processing
We process personal data only to provide the service and on the Customer's documented instructions (including these Terms), and not for our own purposes, and we will not sell it or combine it with other data except as permitted by law and the Terms.
2. Confidentiality & personnel
Personnel authorized to process personal data are bound by confidentiality and trained on data protection. Internal access to Customer Data is least-privilege, read-only by default, reason-gated, time-limited, and logged (break-glass model).
3. Sub-processors
The Customer authorizes the use of sub-processors. These are the sub-processors we use today:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, authentication, file storage, realtime | US |
| Vercel, Inc. | Web hosting, and the AI Gateway that routes our AI requests | US |
| OpenAI, L.L.C. | AI text processing, via the Vercel AI Gateway, under zero-data-retention | US |
| Anthropic, PBC | AI text processing, via the Vercel AI Gateway, under zero-data-retention | US |
| Google LLC | AI text processing (Vertex AI), via the Vercel AI Gateway, under zero-data-retention | US |
| Resend, Inc. | Transactional email delivery and inbound email receipt | US |
| Geoapify GmbH | Geocoding and travel-time (maps) | EU |
AI processing. Every AI request is sent under zero-data-retention terms: the provider does not retain the content and does not use it to train models. We send only the minimum needed for the feature in use.
Not currently used. We do not process payments, so there is no payment sub-processor. We do not send SMS, so there is no SMS sub-processor. We do not transcribe voice, so there is no speech sub-processor. If any of these are introduced, they will be added here with notice under this section before they go live.
We will give notice of new sub-processors and a chance to object as required. [Confirm notice period, e.g., 30 days.]
4. Security
We implement technical and organizational measures appropriate to the risk — see Annex B.
5. Data subject requests
We will assist the Customer, taking into account the nature of processing, in responding to data subject requests, and will forward to the Customer any request we receive directly.
6. Personal data breach
We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and provide information reasonably needed for the Customer's obligations.
7. Audits
We will make available information reasonably necessary to demonstrate compliance, including third-party reports where available (see Security), subject to confidentiality.
8. Return & deletion
On termination, we will delete or return Customer Data within [30] days, except as required by law.
9. Where processing happens
Processing takes place in the United States. Cleaner OS is offered only to US businesses. One sub-processor, Geoapify GmbH, is located in the EU and receives only the addresses needed to geocode a property and compute travel time — no other Customer Data leaves the US.
10. Liability
Liability under this DPA is subject to the limitations in the Terms.
Annex A — Details of processing
Subject matter: provision of the Cleaner OS platform. Duration: the subscription term. Nature & purpose: hosting, scheduling, communications, and AI-assisted operations. Categories of data subjects: Customer's clients, cleaners, and personnel. Categories of data: contact details, service addresses, access notes (including access codes), schedules, job photos, amounts invoiced, cleaner pay rates and computed earnings, and communications. Special/sensitive categories: home access information and home photos.
Annex B — Technical & organizational measures
Encryption in transit and at rest; multi-tenant isolation via row-level security, proven by an automated test suite that blocks release on failure; least-privilege access and role-based controls; platform credentials held in a dedicated secrets manager (this covers our own operational secrets — Customer Data, including access notes, is stored in the database under the controls above, not in a separate vault); append-only audit logging; break-glass support access (stated reason + server-set expiry + logging + notice to the account owner); zero-data-retention terms with every AI sub-processor; backups; vulnerability management; vendor due diligence; incident response. [Expand with counsel/security as the program matures.]
Annex C — Sub-processors
As listed in §3 above, maintained current at [/legal/dpa#subprocessors].