Data Processing Addendum
This is an operationally grounded DPA draft for counsel review. It is not an executed agreement and must not be presented as one.
Roles and instructions
The customer is controller or processor, as applicable, for customer content; Claim Pal processes that content on documented instructions to provide the service. Each party remains responsible for data it controls for account administration, billing, security, and legal compliance.
Processing schedule
Subject matter: hosted claim-to-credit workflows. Duration: the subscription plus approved retention periods. Data subjects: customer users, vendor contacts, claim participants, and people in submitted records. Data includes identity, contact, role, invoice, OCR, product, photo, annotation, message, decision, credit, audit, device, security, support, and billing information.
Processing operations
Collection, storage, organization, extraction, comparison, transmission to authorized participants, display, retrieval, reporting, support, backup, security monitoring, billing, deletion, and return. Claim Pal must not sell customer content or use it for unrelated advertising.
Security measures
Role-based access and organization row-level security; private object storage and expiring access; encryption in transit and provider-managed encryption at rest; server-held secrets; audit trails; webhook verification; input validation; rate limits; monitoring; backups; incident handling; access review; and secure release controls.
Subprocessor schedule
Supabase: database, authentication, storage, and server functions. Vercel: web hosting and server execution. Claim Pal private PaddleOCR infrastructure: invoice OCR; Google Cloud Document AI only when the configured fallback is enabled. Stripe: subscription, usage billing, tax, and payment records. Resend: transactional email. Expo: mobile build, update, and push delivery. Sentry: redacted diagnostics. PostHog: optional consent-gated analytics. Legal entities, locations, safeguards, and notice periods require account verification and counsel approval.
Assistance and incidents
Claim Pal will reasonably assist with data-subject requests, security inquiries, impact assessments, and regulator consultations. Confirmed personal-data breaches follow the approved incident process and contractual notice period; that period remains open for counsel.
Deletion, return, and legal hold
At termination or documented instruction, Claim Pal will export, delete, or de-identify eligible customer content subject to backup cycles, immutable billing and audit records, fraud prevention, disputes, and legal holds. The final retention table and backup deletion window must be attached before execution.
Audit and transfers
Claim Pal will provide appropriate compliance information and a controlled audit process protecting other tenants and platform security. International transfers use the mechanism approved for the parties and locations. Audit frequency, costs, SCC modules, UK addendum, and supplementary measures remain counsel decisions.
Execution requirements
Counsel must approve contracting entities, signatures, agreement precedence, jurisdictions, breach timing, liability relationship, deletion timetable, audit terms, transfer annexes, security exhibit, and verified subprocessor register before this DPA can be offered or signed.