Data processing addendum
Processing terms for personal data an organization places in its private A.P. DO IT workspace.
Version 2026-10-21.2
1. Scope, roles and instructions
This addendum forms part of the Terms when Mythos Quill Press LLC d/b/a MythosWebStudio processes personal data on the customer organization’s behalf. The customer determines its purposes and lawful instructions; we act as processor for that workspace data. Our independently managed listing catalog, account administration and billing are addressed in the Privacy notice rather than treated as customer-directed workspace processing.
The instructions are to host, organize, secure, retrieve and export authorized business-contact/prospect records, notes, searches, assignments and related activity for the subscription’s duration and the agreed closure period. Data subjects are the business contacts and authorized users the customer lawfully includes. No sensitive or children’s data is authorized. The customer controls its inputs, access instructions and lawfulness, and must give required notices and honor applicable rights.
2. Our processing duties
We process customer workspace personal data only on documented service instructions or as law requires, and notify the customer of a legal requirement unless prohibited. We alert the customer if an instruction appears unlawful. People authorized to handle the data must be subject to confidentiality duties. We maintain reasonable administrative, technical and physical safeguards appropriate to the data, including tenant access controls, protected credentials and secure transport.
We do not use customer workspace data for unrelated advertising, a public contact catalog or general-purpose model training. We assist reasonably with rights requests, security incidents, legally required notices and data-protection assessments, considering the processing and information available to us. A confirmed incident affecting customer workspace personal data is reported without undue delay with available relevant information and updates; we do not delay required notice until an investigation is finished.
3. Subprocessors and locations
The customer authorizes Supabase for database/authentication hosting, Vercel for application hosting and delivery, and Resend where transactional delivery is needed for the service. The provider disclosures in the Privacy notice describe the information involved. We require appropriate written processing/confidentiality protections from subprocessors and remain responsible for our obligations under this addendum.
Before appointing a new subprocessor for customer workspace personal data, we give account contacts at least 30 days’ notice and an opportunity to object on reasonable data-protection grounds. We work to resolve an objection; if no reasonable solution is available, the customer may end the affected service and receive an applicable unused prepaid-period refund. We do not transfer data to a location requiring additional legal safeguards without those safeguards. No optional paid add-on is authorized by this clause.
4. Rights, return and deletion
Forward workspace-related rights instructions to hello@mythoswebstudio.dev. We assist the customer and do not disclose another tenant’s information. On the customer’s lawful instruction, we stop the affected processing and return an available portable copy or delete the requested workspace data, subject to necessary verification and law. At the end of service, request return or deletion before closure; active-system deletion follows the Privacy notice’s 30-day verified-closure period.
Data required by law is restricted to that purpose. Restricted backups expire under their disclosed rolling schedule; deletion and suppression instructions must be reapplied before restored data is used. Retained minimal billing/legal records are handled in our controller role as explained in the Privacy notice. A user cannot instruct us to delete a shared organization’s records without authority.
5. Information, assessment and precedence
On a reasonable request, we make available information in our possession needed to demonstrate these processing obligations and cooperate with a reasonable assessment by the customer or an appropriately qualified independent assessor. Arrangements must protect other customers, confidential security information and service availability, and do not limit an assessment or disclosure required by law. We provide available assessment results relevant to the request.
Neither party is relieved of liability imposed by applicable data-protection law because of this addendum. This addendum prevails over conflicting general Terms for customer workspace personal-data processing. Notices and instructions use hello@mythoswebstudio.dev; the Terms’ governing-law provisions apply subject to mandatory law.