Data processing addendum

This addendum is between ZeroWidth, LLC, an Illinois company in the United States, as processor, and the customer, as controller. The customer controls the personal data it brings into hosted ZeroWidth, and ZeroWidth processes that data for the customer.

It covers the California Consumer Privacy Act as amended by the CPRA, and other US data protection laws, where they apply to the customer's personal data. Hosted ZeroWidth serves customers in the United States; when we serve other regions, we'll offer the terms their laws require, such as the EU Standard Contractual Clauses.

For accounts, billing and security, ZeroWidth is a controller in its own right, as the privacy policy describes.

ZeroWidth processes the customer's personal data to provide hosted ZeroWidth to the customer: reading what the customer brings in, keeping the customer's record of decisions, and showing it to the people the customer allows. It does so for as long as it holds the customer's personal data, under the terms and the deletion schedule in section 7.

The people the data is about are the customer's members, employees and contractors, people invited to interviews, and anyone named in what the customer brings in. The personal data is whatever the customer chooses to bring in, such as names and email addresses, conversations and files, and what ZeroWidth reads from them.

We process the customer's personal data only on the customer's documented instructions, including on transfers, unless the law requires otherwise, in which case we tell the customer first unless the law forbids it. Everyone who can process the customer's personal data is bound to keep it confidential.

The data is kept on Google Cloud, in the United States. We don't use the customer's personal data to train AI models, and every request to a hosted model asks for a host that keeps nothing and doesn't train on what's sent. A team's admin can download the team's data at any time.

We help the customer meet its obligations on security, breach notification and the assessments the law requires, as far as the information we have allows. We make available the information needed to show we meet this addendum, and contribute to audits on reasonable notice and at a reasonable frequency, unless a supervisory authority requires otherwise.

We protect the customer's personal data with measures suited to the risk, including encryption in transit and at rest, keeping each team's data apart, removing secrets before any AI model reads text, backups, and a plan for handling incidents. Our staff see a team's data only when the team's admin grants access, for a limited time, or to investigate a report of abuse, and every look is recorded.

The customer authorizes the subprocessors on the subprocessor list. Each is bound by terms that protect the data at least as well as this addendum, and we remain responsible for them as for ourselves.

We give each hosted team's admins reasonable advance notice before a new subprocessor starts. The customer may object on reasonable grounds, and if we can't resolve the objection together, the customer may end the affected service.

We tell the customer without undue delay, and within 72 hours, of becoming aware of a personal data breach affecting the customer's data, with what the law requires as far as it is known, and updates as we learn more.

If someone asks us directly about the customer's personal data, we refer them to the customer and help the customer answer, including with access, correction, erasure, restriction, portability and objection. We don't answer for the customer.

When a team's owner asks, ZeroWidth locks the team at once and deletes the team 7 days later. Any admin of the team can cancel during those 7 days. Backups holding the team's data are gone 7 days after that. At the end of the service, the customer can export its data, and the team is then deleted on this schedule, unless the law requires us to keep something.

When the customer asks us to erase a person, we destroy what that person said or wrote, and hide every decision and claim that names them from every view and from export. Our sealed reading of those records is kept as part of the record. Destroyed words leave backups within 7 days.

For California residents' personal information, ZeroWidth is a service provider. We don't sell or share it, use or keep it outside our business relationship with the customer, or combine it with other personal information except as service providers may.

Email contact@zerowidth.ai with "DPA" in the subject for a copy signed by ZeroWidth. We may update this addendum when the law or the service changes, with reasonable notice to each hosted team's admins before a material change takes effect.