Chai - Data Processing Addendum (DPA)
This Data Processing Addendum ("DPA") forms part of, and is subject to, the Terms of Service (the "Agreement") between Chai Management LLC, a North Carolina limited liability company ("Chai" or "Processor"), and the customer ("Customer" or "Controller"). It applies where Chai processes Personal Data on Customer's behalf in providing the Services. If there is a conflict between this DPA and the Agreement regarding the processing of Personal Data, this DPA controls.
1. Definitions
"Applicable Data Protection Laws" means all privacy and data-protection laws applicable to the processing of Personal Data under the Agreement, including, as applicable, the California Consumer Privacy Act as amended (CCPA/CPRA), other US state privacy laws, and the EU/UK General Data Protection Regulation ("GDPR").
"Personal Data," "Processing," "Controller," "Processor," "Data Subject," and "Personal Data Breach" have the meanings given in Applicable Data Protection Laws. "Customer Data" has the meaning in the Agreement. "Subprocessor" means a third party engaged by Chai to process Personal Data.
2. Roles and scope of processing
2.1 As between the parties, Customer is the Controller (or a processor acting on behalf of its own controllers) of the Personal Data contained in Customer Data, and Chai is the Processor (or subprocessor).
2.2 Instructions. Chai will process Personal Data only (a) to provide and support the Services, (b) in accordance with Customer's documented lawful instructions (the Agreement and Customer's use and configuration of the Services constitute such instructions), and (c) as required by law - in which case, where permitted, Chai will inform Customer first. Chai will notify Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws.
2.3 No sale; limited use (CCPA/CPRA). Chai will not sell or share Personal Data, will not retain, use, or disclose it for any purpose other than performing the Services (or as otherwise permitted by CCPA/CPRA), and will not combine it with data from other sources except as permitted. Chai certifies it understands and will comply with these restrictions.
2.4 The subject matter, duration, nature, and purpose of processing, the types of Personal Data, and the categories of Data Subjects are described in Annex I.
2.5 Customer's responsibilities. As Controller, Customer is solely responsible for: (a) the lawfulness of the Personal Data it enters and of its collection, and for having a valid legal basis and all required consents and notices; (b) deciding what Personal Data to put into the Services and whether the Services are appropriate for it, including complying with Customer's own privacy policy, internal policies, and any carrier, vendor, employer, or confidentiality obligations; (c) issuing lawful instructions; and (d) configuring roles, permissions, and retention within the Services, and exporting its own copies. Chai does not review or monitor Customer Data for lawfulness or for compliance with Customer's obligations, and has no duty to do so. Deletions made by Customer or its users may be permanent and are Customer's responsibility.
3. Chai's obligations
Chai will: (a) ensure persons authorized to process Personal Data are bound by confidentiality; (b) implement and maintain the technical and organizational security measures described in Annex II, appropriate to the risk; (c) taking into account the nature of processing and information available to it, assist Customer, by appropriate measures, in fulfilling Customer's obligations to respond to Data Subject requests and to ensure security, breach notification, and (where applicable) data-protection impact assessments; and (d) make available to Customer information reasonably necessary to demonstrate compliance with this DPA.
4. Personal Data Breach
Chai will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data, provide information reasonably available to it, and take reasonable steps to mitigate and cooperate with Customer. Chai's notification is not an acknowledgment of fault or liability.
5. Subprocessors
5.1 Customer provides a general authorization for Chai to engage the Subprocessors listed in Annex III to process Personal Data.
5.2 Chai will impose data-protection obligations on each Subprocessor that are no less protective than those in this DPA, and remains responsible for its Subprocessors' performance.
5.3 Chai will give Customer at least 30 days' notice of any intended addition or replacement of a Subprocessor. Customer may object on reasonable data-protection grounds within 15 days; the parties will work in good faith to resolve the objection, and if they cannot, Customer may terminate the affected Services per the Agreement.
6. Data Subject rights
Chai will, insofar as reasonably possible, assist Customer with appropriate technical and organizational measures to respond to Data Subject requests. If Chai receives a request directly from a Data Subject, it will not respond except to confirm the request relates to Customer, and will promptly forward it to Customer.
7. International transfers
Chai and its subprocessors process Customer Data in the United States. Where Customer requires the transfer of personal data subject to the EU or UK GDPR, the parties will agree in writing on an appropriate transfer mechanism (such as the Standard Contractual Clauses) before such processing.
8. Audits
Chai will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits by Customer or its mandated auditor. To minimize disruption and protect other customers' confidentiality, audits will occur on at least 30 days' prior written notice, no more than once per 12 months (except as required by a supervisory authority or following a Breach), during business hours, subject to confidentiality, and may be satisfied by Chai's then-current third-party reports, certifications, or a written questionnaire response.
9. Return and deletion
On termination or expiry of the Services, Chai will, at Customer's choice, delete or return Customer Data and delete existing copies within 30 days, except to the extent retention is required by law (in which case Chai will protect it and process it only as required for that purpose).
10. Liability
Each party's liability arising out of or related to this DPA, whether in contract, tort, or any other theory, is subject to the exclusions and limitations of liability set out in the Agreement. This DPA does not increase either party's liability beyond what the Agreement permits.
11. General
This DPA is governed by the same law as the Agreement (unless Applicable Data Protection Laws require otherwise). Except as amended here, the Agreement remains in full force. There are no third-party beneficiaries.
Annex I - Details of Processing
- Controller / data exporter: Customer (the business using the Services).
- Processor / data importer: Chai Management LLC, a North Carolina limited liability company ("Chai").
- Subject matter: provision of the Chai Services (Chai-CRM and/or Chai-HR).
- Duration: the term of the Agreement, plus the deletion period in Section 9.
- Nature and purpose: hosting, storage, and processing of Customer Data to provide CRM and/or HR software functionality (e.g., managing quotes, production, follow-ups, clients/prospects, employees, documents, deadlines, and related records) and related support.
- Types of Personal Data (as entered by Customer): names, contact details (email, phone, address), employment and HR records, payroll/chargeback data, documents, and insurance-related records (e.g., policy, quote, or production information).
- Special categories of data: Chai does not request special-category data; Customer should not input it unless the parties agree in writing and additional safeguards are in place.
- Categories of Data Subjects: Customer's employees, staff, clients, customers, prospects, and business contacts.
Annex II - Technical and Organizational Security Measures
*(Describe Chai's actual measures - verify and complete before use.)*
- Encryption in transit: all traffic served over HTTPS/TLS.
- Tenant isolation: each customer's data is namespaced and isolated server-side; access is scoped to the authenticated session's own workspace.
- Authentication & access control: hashed passwords; signed, expiring session tokens with revocation; role-based permissions (admin / manager / rep); owner-gated sensitive actions.
- Least privilege & secrets: application secrets stored in the platform's secret store; access to production limited to authorized personnel.
- Infrastructure: hosted on Cloudflare's platform (which provides infrastructure-level security and encryption at rest for the managed database).
- Logging & monitoring: request and error logging.
- Backups & recovery: managed database backups are provided by the hosting platform.
- Vendor management: subprocessors are contractually bound to protect data.
Annex III - Approved Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, infrastructure, CDN, database | United States |
| Stripe, Inc. | Payment processing / billing | United States |
| Resend | Transactional / account email | United States |
*Current as of August 23, 2026. See Section 5 for how changes are notified.*