Data Processing Addendum
Effective date: [EFFECTIVE DATE]
This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Agreement") between MAILRABBIT, LLC. ("Blackacre," "Processor") and the customer identified in the Agreement ("Customer," "Controller"), and governs Blackacre's processing of Customer Data in connection with the Blackacre software service (the "Service").
Customer is a law firm that owes duties of confidentiality to its clients, including under the Illinois Rules of Professional Conduct (in particular Rules 1.6 and 5.3) and comparable rules in other jurisdictions. This DPA is intended to support Customer's compliance with those duties when using the Service. In the event of a conflict between this DPA and the Agreement regarding the processing of Customer Data, this DPA controls.
1. Definitions
"Customer Data" means the documents, contract data, correspondence, personal information, and other content that Customer or its users submit to the Service, together with outputs generated from it.
"Personal Information" means information within Customer Data relating to an identified or identifiable individual, including the buyers, sellers, and other parties named in Customer's matters.
"Process" / "Processing" means any operation performed on Customer Data, including collection, use, storage, transmission, and deletion.
"Subprocessor" means a third party engaged by Blackacre to Process Customer Data on Blackacre's behalf.
2. Roles of the Parties
As between the parties, Customer is the controller of Customer Data and Blackacre is the processor. Blackacre Processes Customer Data only on behalf of, and under the documented instructions of, Customer.
3. Scope and Instructions
Blackacre will Process Customer Data only: (a) to provide and maintain the Service; (b) as further instructed by Customer through its use of the Service; and (c) as required by applicable law, in which case Blackacre will, where legally permitted, inform Customer beforehand. Blackacre will notify Customer if, in its opinion, an instruction violates applicable data-protection law.
4. Confidentiality
Blackacre will treat Customer Data as confidential. Blackacre will ensure that personnel authorized to Process Customer Data are bound by appropriate obligations of confidentiality and access Customer Data only as needed to perform their duties. Blackacre acknowledges that Customer Data may include information subject to attorney-client privilege and the attorney work-product doctrine, and will handle it accordingly.
5. No Training; Limited Use
Blackacre will not use Customer Data to train, fine-tune, or develop any machine-learning or generative model, and will not use Customer Data for any purpose other than providing the Service to Customer. Blackacre will not sell Customer Data and will not use it for advertising.
6. Subprocessors
- Customer authorizes Blackacre to engage the Subprocessors listed in Schedule 1 to Process Customer Data.
- Blackacre will impose on each Subprocessor data-protection and confidentiality obligations no less protective than those in this DPA, including the no-training restriction, and remains responsible for its Subprocessors' performance.
- Blackacre will provide Customer with notice before adding or replacing a Subprocessor. If Customer reasonably objects to a new Subprocessor on data-protection grounds within [NUMBER] days, the parties will work in good faith to resolve the objection; if they cannot, Customer may terminate the affected portion of the Service.
7. Security
Blackacre will implement and maintain appropriate technical and organizational measures designed to protect Customer Data against unauthorized access, disclosure, alteration, and destruction, including those described in Schedule 2. Blackacre will review and update these measures as appropriate.
8. Personal Data Breach
Blackacre will notify Customer without undue delay, and in any event within [NUMBER] hours, after becoming aware of a confirmed breach of security leading to the unauthorized disclosure of, or access to, Customer Data. The notice will describe the nature of the incident, the categories of data involved to the extent known, and the measures taken. Blackacre will reasonably assist Customer with its own notification and mitigation obligations.
9. Assistance to Customer
Taking into account the nature of the Processing, Blackacre will provide reasonable assistance to enable Customer to: (a) respond to requests from individuals seeking to exercise their rights with respect to their Personal Information; and (b) meet Customer's own security, notification, and consultation obligations under applicable law.
10. Audit
Blackacre will make available to Customer information reasonably necessary to demonstrate compliance with this DPA. On reasonable prior written notice, no more than once per year (unless required by a regulator or following a breach), Customer may request an audit, which may be satisfied through Blackacre's then-current security documentation or third-party assessments where available.
11. Return and Deletion
On termination or expiration of the Agreement, Blackacre will, at Customer's choice, return Customer Data in a commonly used format and/or delete Customer Data, and will delete existing copies within [NUMBER] days, except to the extent retention is required by law. Blackacre will confirm deletion on request.
12. Duration
This DPA takes effect on the Effective Date and continues for as long as Blackacre Processes Customer Data on Customer's behalf.
13. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Agreement.
Schedule 1 — Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS Textract, S3, SNS, and Lambda) | Scanned-document analysis and OCR-processing infrastructure | United States |
| OpenAI, Anthropic, and Google | Automated extraction and organization of document content (zero-retention, no-training) | United States |
| Vercel and Supabase | Application hosting, database, authentication, and file storage | United States |
| ntfy | Developer operational alerts | United States |
Schedule 2 — Security Measures
- Encryption of Customer Data in transit and at rest.
- Role-based access controls and the principle of least privilege for personnel access.
- Authentication controls for user accounts.
- Logging and monitoring of access to and processing of Customer Data.
- A human-review gate before transaction data is committed within the Service.
- Contractual zero-retention and no-training terms imposed on Subprocessors that process document content.
- Regular review of technical and organizational measures, and, where required for connected-service scopes, third-party security assessment.
MAILRABBIT, LLC.
Signature: ______________________ Date: __________
Customer
Signature: ______________________ Date: __________