This DPA is between the Runstamp customer ("Customer") and The Plain Works Co.,Ltd. ("Processor"). Processor's privacy requests go to hello@runstamp.com.
1. Scope and local boundary
This DPA forms part of the Runstamp Terms or Order Form ("Agreement") when Processor handles personal data submitted to hosted Runstamp features on Customer's behalf ("Customer Personal Data"). Customer is controller/business and Processor is processor/service provider. It does not apply to source documents or outputs processed entirely by local Runstamp packages that are never transmitted to Processor.
Hosted/commercial Runstamp is offered only to business customers in the United States and Canada, excluding Quebec, and is not offered or targeted in the EU, EEA, or UK. This DPA does not incorporate EU/UK standard contractual clauses. The parties must execute appropriate terms before intentionally expanding covered processing to a territory that requires them.
2. Instructions and restrictions
Processor will process Customer Personal Data only for selected hosted operations, support, security, and related delivery under the Agreement, product configuration, and written instructions to hello@runstamp.com. Processor will notify Customer if an instruction appears unlawful unless prohibited.
Processor will not sell/share Customer Personal Data, use it outside the direct business relationship, combine it with unrelated third-party data except as legally permitted to deliver the Service, use it for targeted/cross-context behavioral advertising, or train general-purpose AI models on it.
3. Customer obligations
Customer will provide lawful instructions, notices, consents, and only necessary data; configure connector scopes and destinations; protect credentials; and handle privacy requests. Customer will not submit restricted data under the Terms without specific written approval and must determine whether local or hosted deployment meets its legal, security, residency, and retention requirements.
4. Processor obligations
Processor will bind authorized personnel to confidentiality; maintain Annex II safeguards; assist with verified privacy requests, breach response, security assessments, and legally required impact assessments; keep reasonable compliance records; disclose government demands where allowed and reasonably challenge disproportionate requests; and notify Customer if it cannot meet applicable processor restrictions.
5. Subprocessors and customer providers
Customer generally authorizes providers at /legal/subprocessors. Processor imposes appropriate written protections and remains responsible as required. Processor gives 30 days' notice before a new subprocessor materially handles Customer Personal Data, except urgent security, legal, availability, or continuity needs may shorten notice. Customer may object on reasonable data-protection grounds within 14 days. If unresolved, Customer may terminate the affected hosted feature and receive a prorated refund for prepaid unused fees for it.
Customer-selected storage, repositories, AI providers, workspaces, e-signature services, CRMs, chat destinations, and webhooks under Customer's own account are not automatically Processor subprocessors.
6. Security incident
Processor will notify Customer without undue delay after confirming a reportable unauthorized access, acquisition, alteration, loss, or destruction of Customer Personal Data. Notice includes available nature, scope, likely consequences, and mitigation. Processor reasonably assists Customer's required notices. Notice does not admit fault.
7. Requests and audit
Processor will route Customer Personal Data requests to Customer unless authorized and reasonably assist through available controls. No more than annually, Customer may request current security/compliance information. If insufficient and law requires more, a confidential independent auditor may conduct a narrow audit during business hours at Customer's expense without accessing another customer's data. Extra review is permitted after a material incident or regulator demand.
8. Return, deletion, and retention
Customer may export available hosted data during the term. Once an authenticated hosted-account deletion is accepted, no discretionary grace period applies and live erasure is scheduled without avoidable delay. Unbound staging remains up to 24 hours, generated hosted artifacts 7 days, security logs 90 days, usage/audit records 24 months, successful/failed webhook records 60/90 days, and isolated backups up to 35 days after live deletion. Legal holds, incidents, fraud, disputes, and mandatory billing/tax records may extend affected data. Retained data remains protected and is deleted when the exception ends.
9. Cross-border processing
Customer authorizes processing in Korea, the United States, and listed provider locations. Processor uses contracts, encryption, access controls, minimization, and vendor review appropriate to the transfer. For Canadian information, Processor provides reasonable foreign-processing information and assists Customer's transparency duties. Korean PIPA outsourcing/overseas-transfer transparency is addressed through this DPA, Privacy Policy, and Subprocessors page where applicable.
10. U.S. state terms
Under CCPA/CPRA and analogous state law, Processor acts as Customer's service provider or processor for Annex I purposes and accepts required purpose, no-sale/no-sharing, confidentiality, security, assistance, audit, deletion, and remediation restrictions. Customer may take reasonable steps to stop and remediate unauthorized use after notice.
11. Liability and precedence
The Agreement's liability limits apply as law permits. This DPA lasts while Processor handles Customer Personal Data and controls over the Agreement on such processing. Express open-source licenses continue to govern local components and do not make Processor responsible for Customer's local environment.
Annex I — Processing
| Item | Detail |
|---|---|
| Subject | Hosted account, licensing, managed document operations, connectors, artifacts, webhooks, support, and security |
| Duration | Agreement term plus Section 8 lifecycle |
| Nature | Collection, storage, transformation, generation, verification, delivery, support, restriction, and deletion |
| Data subjects | Customer personnel and people represented in Customer-selected hosted inputs, outputs, connectors, or support uploads |
| Data | Business contacts, account/license IDs, document content, templates, output, approval/receipt data, connector/webhook data, usage and audit metadata |
| Restricted data | Not permitted without separate written approval |
| Frequency | Customer-initiated or continuous for enabled hosted services |
Annex II — Safeguards
- managed authentication, tenant/organization authorization, roles, and protected administration;
- TLS in transit and provider-managed encryption at rest;
- secret storage, scoped connectors, and protected entitlement-signing material;
- signed offline certificates verified with public-key cryptography;
- structured audit records, rate limits, monitoring, incident response, and vulnerability handling;
- backups/recovery subject to published lifecycle and deletion controls;
- vendor review and appropriate subprocessor agreements;
- deployment/dependency review and strict separation of local-only from hosted processing; and
- personnel confidentiality, access review, and retention jobs with monitoring.
Annex III — Contact
Privacy requests: hello@runstamp.com
Accepted with the Agreement. Request a countersigned copy at hello@runstamp.com.