Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between CheckMyDoc (“Processor”) and the customer team that signs up to use the Service (“Controller”). It applies whenever CheckMyDoc processes personal data on the Controller's behalf in providing the Service. Capitalized terms not defined here have the meaning given in our Terms of Service.

1. Roles and scope

For documents that the Controller (and its team members) upload to the Service, the Controller is the data controller and CheckMyDoc is the data processor. CheckMyDoc processes Personal Data only on documented instructions from the Controller, including the configuration the Controller chooses in the Service.

2. Subject matter and duration

• Subject matter: processing of contracts and related Personal Data the Controller submits to the Service for review.
• Duration:for the term of the Controller's use of the Service, plus a 30-day purge window after a hard-delete request or account closure.
• Nature and purpose: classification, AI-assisted review, retrieval through the dashboard, audit logging, and incidental processing necessary to provide the Service.

3. Categories of data subjects and Personal Data

The Personal Data processed under this DPA may include:

• Contracting parties— names, addresses, signatures, and contact details of individuals named in the documents the Controller uploads.
• Authorized users— names, email addresses, role assignments, and access logs of the Controller's team members.
• Other personal data incidentally contained in the contracts uploaded (compensation figures, dates of birth, identifiers), subject to the same protections as the rest of the document.

The Controller is responsible for ensuring it has a lawful basis for sharing this Personal Data with us. CheckMyDoc is not designed for processing special category data under GDPR Article 9 (health, biometric, etc.); the Controller agrees not to upload content that contains material amounts of such data without prior written agreement.

4. Sub-processors

The Controller authorizes CheckMyDoc to engage the sub-processors listed at checkmydoc.co/security. As of the date above, those are:

• Anthropic, PBC— AI inference (United States). Anthropic is currently the sole model provider processing Customer Data. Requests include team and user metadata for traceability; Anthropic does not use Customer Data to train its models. If we add or change model providers we will give the notice described below before Customer Data reaches a new one.
• Cloudflare, Inc.— object storage of uploaded documents and CDN (multi-region).
• Railway Corp.— application compute and managed Postgres (European Union, EU West region).
• Flitt— card payment processing. Card details are submitted from the data subject's browser directly to Flitt; CheckMyDoc receives only order and subscription identifiers and never handles card data.
• Resend Labs, Inc.— transactional email (United States, European Union).
• Sentry & PostHog— error monitoring and product analytics.

CheckMyDoc enters a data-protection agreement with each sub-processor that imposes protections at least as protective as those in this DPA. We will provide at least 30 days' prior notice to the Controller of any new or replacement sub-processor and give the Controller the opportunity to object on reasonable data-protection grounds. Where the Controller objects in good faith, the parties will work in good faith to resolve; if no resolution can be reached, the Controller may terminate the affected portion of the Service for convenience.

5. Security measures (Article 32)

• Encryption in transit— TLS 1.2 or higher for all traffic between user agents, our servers, and our sub-processors.
• Encryption at rest— AES-256 for object storage and database volumes.
• Access controls— role-based access on every team account; server actions verify session and team membership before reading documents; production access restricted to a small number of engineers.
• Audit logging— every document upload, review run, role change, and deletion is recorded with actor, IP address, user agent, and timestamp.
• Confidentiality— all CheckMyDoc personnel are under written confidentiality obligations.
• Resilience— encrypted database backups taken daily and tested for restore.
• Secure development— code review on every change, automated dependency vulnerability scanning, and security review for changes that touch authentication or data access.

6. Personal-data breaches

CheckMyDoc will notify the Controller without undue delay, and in any event within 48 hours of becoming aware, of any Personal-Data Breach affecting the Controller's data. The notification will include, to the extent then known, a description of the nature of the breach, the categories and approximate volume of data subjects and records affected, the likely consequences, and the measures we've taken or propose to take. We will cooperate with the Controller's investigation and any required regulator or data-subject notification.

7. Data subject requests

The Controller is responsible for responding to data-subject requests under applicable law. CheckMyDoc will provide reasonable assistance, including making available within the Service the tooling needed to access, rectify, restrict, or delete Personal Data, and supplying information necessary to demonstrate compliance.

8. International transfers

CheckMyDoc's primary infrastructure is in the United States. Where the Controller is located in the EEA, UK, or Switzerland, the parties incorporate the European Commission's 2021 Standard Contractual Clauses (Module 2 — controller to processor, where the importer is a processor) by reference. Annex I.A identifies the parties; Annex I.B describes the processing as in § 2 above; Annex I.C identifies the supervisory authority of the Controller's establishment; Annex II is the security measures in § 5; Annex III is the sub-processor list in § 4.

For UK transfers, the parties incorporate the UK International Data Transfer Addendum to the EU SCCs. We've completed a Transfer Impact Assessment for our US-based sub-processors and made it available on request to privacy@checkmydoc.co.

9. Audits

On request, CheckMyDoc will provide the most recent SOC 2 Type II report (or, before the first such report, equivalent third-party assurance). The Controller may conduct an audit of CheckMyDoc's compliance with this DPA no more than once per twelve-month period, with at least 30 days' written notice, during regular business hours, in a manner that does not unreasonably interfere with our operations, and at the Controller's expense. Where a regulator requires more frequent or invasive audits, the parties will cooperate in good faith.

10. Return and deletion of Personal Data

On termination of the Service, the Controller may export its data through the dashboard for 30 days. After that window, CheckMyDoc will delete the Controller's Personal Data from primary systems within 30 days and from backups in the ordinary course of backup rotation (no longer than 90 days), except as required by law for retention of billing or audit records.

11. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations of liability set out in the Terms of Service, treated as a single aggregate cap covering both the Terms and this DPA.

12. Order of precedence

In the event of conflict between this DPA and the Terms of Service, this DPA prevails with respect to data-protection matters. In the event of conflict between this DPA and the SCCs, the SCCs prevail.

13. Contact

Email privacy@checkmydoc.co for DPA questions, sub-processor list updates, or audit requests. For general support, email hello@checkmydoc.co.