Data Processing Addendum

This Data Processing Addendum (“DPA”) adds to the Terms of service between you (“Customer,” the business using Keepsel) and Crater Ink Studios LLC (the “Processor”), which makes Keepsel. It applies to personal information about your own customers that you put into Keepsel, yourself or through Suli: for example, a buyer’s name and shipping address on an order, or in a spreadsheet of past sales you import. For that information, you are the controller (the “business”) and Keepsel is your processor (your “service provider”).

Keepsel processes your customers’ personal information only to provide the service to you, on your instructions, and not for its own purposes, except as this DPA allows or the law requires. When a question to Suli needs an order’s details, Suli sends them to our AI provider to answer it (see the Data Usage & AI Policy). Your customers’ personal information is never used to train AI models and is never part of any counts, totals or other statistics.

You confirm that you have the right to put the information into Keepsel, that you have given your customers any notices and obtained any consents the law requires, and that your instructions to us comply with the law.

Keepsel does not sell or share your customers’ personal information, does not keep, use or disclose it for any purpose other than providing the service (or as the law otherwise allows), and does not combine it with other data except as allowed. Keepsel will: (a) tell you if it decides it can no longer meet its obligations under privacy law or this DPA; (b) let you take reasonable and appropriate steps to stop and fix any unauthorized use of the information; and (c) reasonably help you answer verifiable requests your customers send you about their information.

Keepsel maintains reasonable administrative, technical and organizational security measures appropriate to the information.

Keepsel uses the sub-processors listed below (the same providers the Privacy policy names) to provide the service. It places data-protection obligations on each that are substantially similar to those in this DPA, and gives notice of any new or replacement sub-processor before it begins processing, with an opportunity to object. If you reasonably object to a new sub-processor on data-protection grounds, your remedy is to cancel the affected subscription; if you do not object before the sub-processor begins processing, you are treated as having accepted it.

Keepsel will tell you without undue delay after becoming aware of a breach affecting your customers’ personal information, and will reasonably cooperate with you in meeting your own notification obligations.

When your account closes, or when you ask, Keepsel will delete or return your customers’ personal information, except where the law requires it to be kept or it exists for a limited time in routine backups.

hello@keepsel.com