Legal
Data Processing Addendum
1. Roles and scope
For personal data contained in Customer Content (as defined in the Terms), the customer is the controller and SuperJumbo is the processor. For data we collect to run our own business — account administration, security operations, service analytics, and future billing — SuperJumbo is an independent controller, governed by the Privacy Policy. This addendum applies to the extent GDPR, UK GDPR, CCPA/CPRA, or similar laws apply to the personal data processed.
2. Subject matter, duration, nature
Processing consists of hosting, storing, backing up, displaying, transmitting, versioning, and exporting Customer Content to provide the Services, for as long as the customer uses them plus the deletion windows in §9. Data subjects are the customer's personnel and collaborators and any individuals whose data the customer includes in its content. The customer is responsible for having a lawful basis for the data it submits.
3. Our obligations as processor
- We process Customer Content only on the customer's documented instructions — which are: the Terms, this addendum, and the actions users take in the product — and never for our own purposes. We do not sell it and do not use it to train AI models.
- Everyone with access to Customer Content is bound by confidentiality obligations.
- We assist the customer, to the extent reasonably possible, with its own obligations: responding to data-subject requests (§8), breach notification, and impact assessments.
- We will inform the customer if we believe an instruction violates applicable data protection law.
- We make available the information reasonably necessary to demonstrate compliance, and will answer reasonable written security questionnaires; summaries of our security measures stand in for on-site audits at our current scale.
4. Security
Measures in force: encryption in transit (TLS) and at rest on our storage providers; httpOnly, revocable sessions; server-side access control and quota enforcement on every request; audit logging of administrative actions; nightly encrypted backups with a fixed 30-day retention; segregation of customer data by account; and a minimal-collection design — no third-party trackers anywhere in the product. We will not materially degrade these protections during a term.
5. Subprocessors
The customer authorizes the subprocessors listed at /legal/subprocessors, each bound by terms at least as protective as this addendum. We will update that page and notify account owners by email at least 30 days before a new or replacement subprocessor processes Customer Content. The customer may object on reasonable data-protection grounds; if we cannot resolve the objection, the customer may terminate the affected Services and we will delete its data per §9. We remain responsible for our subprocessors' performance.
6. International transfers
Customer Content is processed primarily in the United States. Where transfers from the EU/UK require safeguards, the parties rely on our subprocessors' Standard Contractual Clauses and equivalent mechanisms, and the SCCs (module two, controller-to-processor) are deemed incorporated between the customer and us where required by law.
7. Personal data breach
If we become aware of a breach of security affecting Customer Content, we will notify the affected customer without undue delay and within 72 hours, with what we know: the nature of the breach, data and accounts affected, measures taken, and a contact point — followed by updates as facts develop. Notification is not an admission of fault.
8. Data subject requests
If a data subject contacts us directly about data in Customer Content, we will redirect them to the customer and, at the customer's reasonable request, assist with access, correction, deletion, portability, and objection requests using the product's export and deletion capabilities.
9. Return and deletion
During the term, the customer can export its content at any time. On termination, the customer chooses return (export) or deletion; absent a choice, we delete Customer Content from live systems within 30 days of termination, and it leaves encrypted backups within a further 30 days as they expire, except where law requires longer retention.
10. CCPA / CPRA
Where the CCPA/CPRA applies, SuperJumbo is a "service provider": we process personal information only to provide the Services, and we do not sell it, share it for cross-context behavioral advertising, retain it for other purposes, or combine it with data from other sources except as the CCPA permits. We certify that we understand these restrictions.
11. Term, precedence, changes
This addendum lasts as long as we process Customer Content for the customer. If it conflicts with the Terms on data protection matters, this addendum wins. Material changes follow the same 14-day notice process as the Terms, except changes required by law.
12. Contact
legal@archoverflow.com — including requests for a countersigned copy of this addendum.