Data Processing Addendum

The Professional is the controller or business of Client Records. Kinda Salty Studio, LLC is the processor or service provider. This DPA covers personal information processed by us on the Professional’s behalf through Kioku. It does not govern Account Data for which we act as controller.

We will process Client Records only to provide, secure, maintain, and support Kioku; comply with the Terms and this DPA; follow reasonable documented instructions consistent with the service; or comply with law. We will notify the Professional if we believe an instruction violates applicable privacy law, unless prohibited.

• Subject: hosting and operation of a client memory system.
• Duration: the Professional’s use of Kioku plus deletion and backup periods.
• People: the Professional’s clients, staff, contacts, and other people described in Client Records.
• Data: contact details, notes, preferences, service history, services, photos, tasks, and informational financial history.
• Purpose: providing Kioku on the Professional’s instructions.

Sensitive data is not required. The Professional must not submit it unless lawful, necessary, and appropriate safeguards and notices are in place.

The Professional warrants that its instructions and Client Records comply with law. It is responsible for lawful bases, notices, consent, photo and likeness permissions, minor-client requirements, data accuracy, retention decisions, and rights requests.

We restrict Client Record access to authorized personnel and providers that need it for service delivery and are bound by appropriate duties. We maintain reasonable technical and organizational measures described in theSecurity Overview. No measure eliminates all risk, and that overview creates no certification, warranty, or service level.

The Professional gives general authorization for the providers on ourSubprocessor List. We require applicable data-protection obligations from providers and remain responsible for our obligations under this DPA. We may update the list by posting changes. A Professional with a reasonable privacy objection may contact jwmcclung@gmail.com; if no reasonable alternative is available, its remedy is to stop using the affected feature or terminate Kioku use.

Taking account of the nature of processing, we will provide reasonable assistance available through Kioku or on request so the Professional can respond to privacy-rights requests. If we receive a request directly about Client Records, we will direct the individual to the Professional and will not respond substantively unless legally required.

We will notify the Professional without unreasonable delay after confirming a breach of Client Records for which notice is required by applicable law. We will provide information reasonably available to support the Professional’s obligations. Notice is not an admission of fault. The Professional is responsible for notices to its clients unless law assigns that duty to us.

On request during use or within 30 days after termination, we will provide reasonable assistance exporting available Client Records. We will delete or de-identify Client Records on instruction, subject to legal duties, technical feasibility, backups, and security needs. Archive and soft-delete fields exist today; hard deletion is handled on request rather than through an automated self-service tool.

For applicable state privacy laws, we act as a service provider or processor. We will not sell or share Client Records, retain, use, or disclose them outside the business purposes in the agreement, combine them with personal information from unrelated sources except as legally permitted, use them for targeted advertising, or train AI models on them. Each party will comply with the obligations applicable to its role.

On reasonable written request no more than once yearly, and subject to confidentiality, we will provide information reasonably needed to demonstrate compliance. If required by applicable law, the Professional may request a proportionate review at its expense that avoids disruption and protects other customers and security. Third-party reports may be used instead of an onsite review when appropriate.

This DPA lasts while we process Client Records. If it conflicts with the Terms on Client Record processing, this DPA controls. Liability limits in the Terms apply to this DPA to the maximum extent allowed by law. We may update this DPA with the Terms; continued use after the effective date accepts the update.