# Data Processing Addendum

> This addendum is part of the [Terms of Service](/terms) between **Uplevel Digital Services, LLC** ("Uplevel", "we") and your company ("Customer"). It describes how we process the personal information your company puts into hellojade, and it is accepted for the company by its owner or an admin when the company turns on a paid subscription.

## 1. Roles {#roles}

For personal information in Customer Data — for example, the names, phone numbers, email addresses and messages of your leads, customers and team — your company decides why and how it is processed, and Uplevel processes it **on your company's behalf**. Under state privacy laws, your company is the "business" or "controller" and Uplevel is its "service provider" or "processor". Our own account, billing and security records about the people who use hellojade are covered by our [Privacy Policy](/privacy) instead.

## 2. Instructions {#instructions}

We process Customer Data only to provide, secure and support the Service, as the Terms of Service, this addendum and your company's use and settings in the app direct, and as the law requires. If we believe an instruction breaks the law, we will tell you.

## 3. What we will not do {#restrictions}

We will not:

- sell Customer Data, or share it for cross-context behavioral or targeted advertising;
- keep, use or disclose it for any purpose other than providing the Service to your company, or outside our direct business relationship with your company;
- combine it with personal information we receive from anyone else, except as the law allows a service provider to; or
- use it to train artificial-intelligence models.

We certify that we understand and will follow these restrictions, and we will tell you if we can no longer meet our obligations under the state privacy laws that apply.

## 4. Our people {#personnel}

Only staff who need access to provide or support the Service have it, they are bound to keep Customer Data confidential, and staff access to your company's records is itself recorded.

## 5. Subprocessors {#subprocessors}

Your company authorizes us to use the service providers listed in the [Privacy Policy](/privacy#sharing) — today Vultr (hosting and backups), Stripe (payments), Sinch (text messages and calls), Google (Business Profile and push notifications), Apple and Mozilla (push notifications), and Anthropic (the Claude AI service used by the features the Privacy Policy names). Each is bound to protect the information it processes and to use it only to provide its service to us. We will update that list before we add or replace a provider, and the new version of this addendum or the Privacy Policy will be shown in the app for acceptance. If your company objects to a new provider on reasonable data-protection grounds, it may cancel under the Terms of Service.

## 6. Security {#security}

We maintain technical and organizational measures appropriate to the risk, including encrypted connections, passwordless sign-in with single-use links and passkeys, role-based permissions, mutually authenticated connections between our servers, encrypted database backups, and a record of staff access. The Privacy Policy's [security section](/privacy#security) describes them.

## 7. Security incidents {#incidents}

If we confirm a breach of security that leads to unauthorized access to, or loss or disclosure of, your company's Customer Data, we will tell your account owner **without undue delay**, describe what happened and what we are doing about it as the facts become known, and help your company meet any notice obligations it has.

## 8. Helping with people's requests {#requests}

If someone asks us to access, correct or delete their personal information held in your company's account, we will pass the request to your company rather than answer it ourselves, unless the law requires otherwise. We will help your company answer the requests it receives, using the tools in the app or by acting on your company's written instructions.

## 9. Location {#location}

We store and process Customer Data in the United States.

## 10. Deletion and return {#deletion}

Your company can delete its own data in the app, and can ask us for an export of its data at any time while its account is open and for one year after it closes. After that year we delete Customer Data, and copies in backups are deleted as those backups age out, unless the law requires us to keep something.

## 11. Information and reviews {#audits}

We will give your company the information reasonably necessary to show that we meet this addendum — for example, answers to a reasonable security questionnaire, once a year or after a security incident.

## 12. Liability and order {#order}

This addendum is subject to the limitation of liability in the Terms of Service. If it conflicts with the Terms of Service about personal information, this addendum wins.

## Contact {#contact}

Uplevel Digital Services, LLC, Naperville, Illinois, United States. Privacy and data requests: [go@hellojade.ai](mailto:go@hellojade.ai).