DRAFT — REQUIRES COUNSEL REVIEW BEFORE PUBLICATION. This document was generated for internal drafting purposes. It is not legal advice, has not been reviewed by an attorney, and must not be published, distributed, or relied upon until qualified counsel has reviewed and approved it.

Data Processing Addendum

Draft · last generated 2026-07-25 · not yet reviewed by counsel

Most customers will not need to execute this document. In the Software's default local-first mode, OrgTool is not a processor of your organizational or HR data — that data never reaches our systems. This DPA exists for the narrower cases where it may matter: the account/billing data path, and any customer whose procurement process requires a DPA on file regardless.

1. Scope

This Addendum applies only to the personal data OrgTool actually processes on the customer's behalf: account holder name and email, and billing/subscription metadata associated with a licence. It does not apply to organizational, personnel, compensation, or demographic data entered into the Software, which is processed entirely on the customer's own device and is never received by OrgTool in the Software's default mode.

2. Roles

For the data in scope under Section 1, OrgTool acts as a processor and the customer as controller. [PLACEHOLDER — counsel to confirm this characterization is correct under applicable law (GDPR/CCPA/other) given the narrow scope above.]

3. Sub-processors

Our payment processor, for billing data. If the customer opts into AI analysis with their own API key, Anthropic processes the content the customer's browser sends directly to it for that request — this is initiated by the customer's own action and configuration, not by OrgTool as processor of customer-controlled data. [PLACEHOLDER — counsel to confirm whether Anthropic should be listed as a sub-processor here or characterized differently given the direct-from-browser, customer-key architecture.]

4. Security measures

See our Security page for the technical architecture. Relevant to this Addendum: account/billing data is stored by our processor(s) under their respective security programs; [PLACEHOLDER — counsel/security to add specifics once processor(s) are finalized].

5. International transfers

[PLACEHOLDER — to be completed once hosting regions for account/billing infrastructure are finalized.]

Contact

legal@orgtool.io