This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the customer (“Customer”, “you”) and Do The Thing LLC, a New Mexico limited liability company that operates Unpleat (“Unpleat”, “we”). It applies when we process personal data on your behalf as part of the Service, and it takes effect automatically when you accept the Terms. If you need a signed copy, email [email protected].
1. Definitions
“Data Protection Laws” means the laws that apply to the processing of Customer Personal Data, including the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act. “Customer Personal Data” means personal data contained in Customer Content (as defined in our Terms) that we process on your behalf. Terms such as “controller”, “processor”, “data subject”, “personal data breach” and “processing” have the meanings given in the GDPR.
2. Roles
For Customer Personal Data, you are the controller (or a processor acting for your own controller), and Unpleat is your processor (or sub-processor). For US state laws, Unpleat acts as your “service provider” or “processor”. Unpleat processes account and billing information about you as a controller under its Privacy Policy, outside the scope of this DPA.
3. Details of the processing
| Subject matter | Providing the Service: recording web workflows and turning them into videos, guides, voiceovers and live tours, and hosting and publishing them. |
|---|---|
| Duration | For the term of your use of the Service, plus the deletion period in section 10. |
| Nature and purpose | Collection (through the Chrome extension, when you record), storage, processing into tutorials, voice generation, hosting and publication as you choose. |
| Data subjects | People whose personal data appears in the pages you record or the content you create, such as your employees, your users and customers, and your contacts. |
| Categories of data | Whatever is displayed on the pages you record or included in your content, for example names, email addresses, usernames, messages and other account information, as well as page addresses. Text typed into form fields is masked and not recorded. |
| Special categories | Not intended. You agree not to record special categories of personal data (such as health data) or payment card data unless you have a lawful basis and appropriate safeguards. |
4. Your instructions
We process Customer Personal Data only on your documented instructions, which are these Terms, this DPA and your use and configuration of the Service, unless the law requires otherwise, in which case we’ll tell you first unless the law forbids it. We’ll inform you if we believe an instruction breaks Data Protection Laws. We do not sell Customer Personal Data, use it for our own purposes, or combine it with other data except as needed to provide the Service.
You are responsible for the lawfulness of the processing you instruct, including having a lawful basis and giving any required notices to data subjects.
5. Confidentiality
We ensure that anyone authorized to process Customer Personal Data is bound by confidentiality obligations and accesses it only as needed to provide and support the Service.
6. Security
We implement appropriate technical and organizational measures to protect Customer Personal Data, described in Annex 2. We may update them as long as the overall level of protection is not reduced.
7. Sub-processors
You authorize us to engage the sub-processors listed in Annex 1. We impose data protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance. We’ll notify you by email at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds, we’ll work with you in good faith to find a solution; if we can’t, you may terminate the affected Service and receive a refund of prepaid fees for the remaining period.
8. Assistance
Taking into account the nature of the processing, we’ll assist you, as far as reasonably possible, with responding to data subject requests (you can also edit or delete Customer Content directly in the Service), with security, with notifying breaches, and with data protection impact assessments and consultations with authorities relating to the Service. If a data subject contacts us directly about Customer Personal Data, we’ll refer them to you.
9. Personal data breaches
We’ll notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We’ll provide the information you reasonably need to meet your own obligations, update you as we learn more, and take reasonable steps to contain and remedy the breach.
10. Deletion and return
You can delete Customer Content at any time in the Service. When your account is closed, you can ask us for a copy within 30 days; after that, we delete Customer Personal Data from our active systems within 30 days and from backups within 90 days, unless the law requires us to keep it.
11. Audits
We’ll make available the information reasonably necessary to demonstrate our compliance with this DPA, including answering reasonable security questionnaires. Where that isn’t sufficient, or a supervisory authority requires it, you may audit our compliance at your own cost, with at least 30 days’ notice, during business hours, no more than once a year, and under confidentiality obligations.
12. International transfers
Unpleat is based in the United States. Where Customer Personal Data is transferred from the EEA to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 (Module Two: controller to processor, or Module Three: processor to processor, as applicable), which are incorporated by reference. For those clauses: the optional docking clause (Clause 7) applies; under Clause 9, option 2 (general authorization) applies with the notice period in section 7 of this DPA; the optional language in Clause 11 does not apply; under Clauses 17 and 18, the law and courts of Ireland apply; and Annexes I and II are completed by section 3 and Annexes 1 and 2 of this DPA. For transfers from the United Kingdom, the UK International Data Transfer Addendum applies, and for transfers from Switzerland, the clauses apply with references adapted to Swiss law, with the Swiss Federal Data Protection and Information Commissioner as the competent authority.
13. Liability and precedence
Each party’s liability under this DPA is subject to the limitations in the Terms, as far as Data Protection Laws allow. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data; if the Standard Contractual Clauses conflict with this DPA, the clauses prevail.
Annex 1: Sub-processors
| Sub-processor | Purpose | Data |
|---|---|---|
| Our web hosting provider | Servers, database and file storage | All Customer Content |
| Cloudflare, Inc. (United States) | Content delivery, DNS and security | Content passing through our websites |
| ElevenLabs (premium voices only) | Text-to-speech | Voiceover text for steps that use a premium voice |
| MailerSend (by MailerLite) | Transactional email | Names and email addresses in invitations and notifications |
Annex 2: Security measures
- Encryption in transit: all connections to the Service use HTTPS (TLS).
- Data minimization: text typed into form fields is masked by the recorder, and password fields are never recorded. Recording only happens when a user starts it, in the tab being recorded.
- Access control: each customer’s content is only accessible to their own account (and to the people they publish it to). Administrative access to systems is limited to authorized personnel.
- Credentials: passwords, extension keys and one-time links are stored only as secure hashes. Sign-in is protected against forged requests, and repeated attempts are limited.
- Network protection: a content delivery network with DDoS protection and a web application firewall in front of the Service.
- Monitoring and logging: security-relevant events are logged and reviewed when investigating issues.
- Deletion: content deleted by customers is removed from active systems within 30 days, and from backups within 90 days.
- Incident response: breaches are investigated, contained and notified as described in section 9.