Data Processing Addendum

In this Addendum:

• "Controller" means the customer who determines the purposes and means of processing personal data using the Service.
• "Processor" means (pending registration), sole proprietorship, Singapore, which processes personal data on behalf of the Controller.
• "Data Subjects" means the individuals whose personal data is processed.
• "Applicable Data Protection Law" means GDPR, UK GDPR, CCPA, and any other applicable data protection legislation.

This Addendum forms part of the Terms of Service between Controller and Processor and applies where Processor processes personal data on behalf of Controller in connection with the Service. Processor processes personal data only on Controller's documented instructions and for no other purpose.

Processor processes the following categories of personal data:

• Account data: names and email addresses of Controller's team members.
• Access-gate data: HMAC-hashed IP addresses and timestamps of scan events.
• QR payload content: stored as ciphertext, accessible only to the Controller.

Processor does not process special categories of data as defined by Applicable Data Protection Law unless explicitly instructed by Controller.

Controller represents and warrants that it has a lawful basis to provide personal data to Processor and that it has obtained any required consents from Data Subjects.

Processor will:

• Process personal data only on documented instructions from Controller.
• Ensure persons authorized to process personal data have committed to confidentiality.
• Implement technical and organizational measures as described in Annex A.
• Not engage sub-processors without Controller's prior written consent or as listed in Annex B.
• Assist Controller in responding to Data Subject rights requests.
• Delete or return all personal data on termination of the Service.
• Provide Controller with information necessary to demonstrate compliance with this Addendum.

Processor maintains the following technical and organizational measures (see also Privacy Policy §6):

• AES-256-GCM encryption of all payload data at rest.
• TLS 1.2+ for all data in transit.
• Envelope encryption with keys managed by AWS KMS; decrypted keys held in process memory only.
• Role-based access controls and audit logging for administrative operations.
• Regular security reviews and vulnerability assessments.

The current list of sub-processors (cloud infrastructure, database, key management, email delivery, payment processing), with their purpose, data category, and region, is published at /subprocessors. Processor will give 30 days notice before adding or replacing a sub-processor that processes personal data covered by this Addendum.

Agent-initiated content processing. Controller may grant a machine credential the qr:content:read permission, which allows an AI agent acting for Controller to read the decrypted content of Controller’s QR payloads through the API or the MCP endpoint. Controller acknowledges that exercising this permission causes that content, which may include personal data of Data Subjects who are not Controller’s own users, to be transmitted to the model provider that Controller’s agent uses. That provider is selected by Controller and is Controller’s own sub-processor, not Processor’s: Processor does not select it, has no agreement with it, and cannot recall content once it has been read. Controller is responsible for establishing a lawful basis and any required agreement with that provider, and for disclosing the transfer in its own records of processing. Processor’s obligations are to make the permission separate from every other read permission so that it cannot be granted inadvertently, to record each such read in Controller’s audit trail, to apply a per-credential volume limit, and to honour revocation immediately.

Personal data may be transferred to and processed in countries outside the European Economic Area. Processor ensures that such transfers comply with Applicable Data Protection Law, including using Standard Contractual Clauses where required.

Processor will assist Controller in fulfilling Data Subject requests (access, rectification, erasure, portability, objection) within 5 business days of receiving a request from Controller.

Processor will notify Controller of a personal data breach without undue delay and in any event within 48 hours of becoming aware of it, providing sufficient information for Controller to meet its notification obligations.

This Addendum is governed by the same law as the Terms of Service unless Applicable Data Protection Law requires otherwise.

To execute a DPA with (pending registration), sole proprietorship, Singapore, contact (pending registration). A signed DPA supersedes the template terms on this page for the executing parties.