Data processing agreement

1. The customer is the controller, and CapitolMath, a sole proprietorship based in California (“CapitolMath”), is the processor, of the personal data described in Annex 1 (“customer personal data”).
2. “Data protection law” means every law that applies to that processing, including where relevant the GDPR, the UK GDPR, and US state privacy laws such as the CCPA. Terms like “controller”, “processor” and “personal data breach” have the meanings those laws give them.
3. Under US state laws, CapitolMath acts as a service provider or processor. It won't sell or share customer personal data, or use it outside the direct business relationship with the customer.

1. CapitolMath processes customer personal data only to provide the service, and otherwise on the customer's documented instructions. The terms, this agreement, and the customer's use and configuration of the service are those instructions.
2. If the law requires other processing, CapitolMath will tell the customer first unless the law forbids it. If it believes an instruction breaks data protection law, it will say so.
3. CapitolMath sends customer personal data to an AI model only when a member uses an AI feature or receives the Weekly digest, and only what that request or digest needs, through the subprocessor listed for it. Neither CapitolMath nor that subprocessor uses it to train models. The customer's Owners and Admins can turn off AI writing of the Weekly digest; its digests are then facts only, and once it's off, nothing more is sent to the model for them.

Everyone at CapitolMath who can access customer personal data is bound by confidentiality, and has access only as their work requires. Staff access to a customer's account is recorded in that account's audit log, where the customer can see it.

CapitolMath maintains the technical and organizational measures in Annex 2, and may improve them, but won't reduce the overall protection they give during the agreement.

1. The customer authorizes CapitolMath to use the subprocessors on the subprocessors page. Each is bound by written terms that protect customer personal data at least as well as this agreement, and CapitolMath remains responsible for their performance. The one exception is the U.S. Census Bureau, a federal agency whose public geocoder has no such terms: it receives only the map point of an address a person chooses in Find my legislators, never the address or who chose it.
2. CapitolMath will give at least 30 days' notice before a new subprocessor receives customer personal data, by updating that page and by email to everyone who has asked to be notified.
3. The customer may object on reasonable data-protection grounds within that period. We'll then work in good faith on an alternative; if there isn't one, the customer may end the affected service and receive a pro-rata refund of prepaid fees for it.

1. Taking into account the nature of the processing, CapitolMath will help the customer respond to people exercising their data-protection rights. Owners and Admins can already view, correct and remove members, and download the audit log.
2. If CapitolMath receives such a request directly about customer personal data, it will pass it to the customer and not answer it itself, unless the customer asks it to.
3. CapitolMath will give reasonable help with data protection impact assessments and consultations with regulators that concern the service.

CapitolMath will notify the customer's Owners without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting customer personal data. The notice will describe what happened, the data and people likely affected, the likely consequences, and what's being done, and will be followed up as more is learned. Notifying the customer is not an admission of fault.

1. Before closing the account, an Owner can download an export of the account's data.
2. After the account closes, CapitolMath deletes customer personal data within 90 days. Database backups roll off within a further 7 days.
3. The account's audit log is append-only and hash-chained, so it can't be edited or trimmed entry by entry. It is erased whole, 90 days after the account closes. A small record that the erasure happened is kept — the account ID, how many entries there were, the final hash, and when and on whose approval it was erased — with no personal data in it.
4. CapitolMath may keep data longer only where the law requires it or a legal hold applies, and then only for that purpose, and will tell the customer unless it's forbidden to.

1. CapitolMath will make available the information reasonably needed to show it meets this agreement: the trust center, the security page, answers to security questionnaires (normally within five business days), and any certification or audit report it holds.
2. If that isn't enough, or a regulator requires it, the customer may audit CapitolMath's compliance no more than once a year, with 30 days' notice, during business hours, under confidentiality, and at its own cost.

Customer personal data is stored and processed in the United States. Where data protection law requires a transfer mechanism for personal data leaving the EEA, the UK or Switzerland, the parties will rely on the European Commission's Standard Contractual Clauses (controller-to-processor module) and the UK Addendum, which CapitolMath will countersign on request to support@capitolmath.ai.

1. This agreement lasts as long as CapitolMath processes customer personal data.
2. Liability under this agreement is subject to the limits in the terms of service.
3. We may update this agreement to reflect changes in law or in the service, with at least 30 days' notice to account Owners of any change that reduces the customer's protection.

• Hosting: DigitalOcean, United States. Database encrypted at rest; all connections over TLS.
• Access control: sign-in through PropelAuth; roles and licenses enforced on the server for every request; scoped, revocable API keys.
• Secrets: API keys stored only as a keyed hash (HMAC-SHA-256); webhook signing secrets encrypted with AES-256-GCM; invitation tokens stored only as hashes. Passwords and card numbers are never received.
• Accountability: an append-only, hash-chained audit log per account, including staff access; a history of each account's entitlements.
• Change control: changes only by reviewed pull request to a protected branch, gated on automated checks, tests and a full build; dependency advisories monitored.
• AI boundary: every model call goes through one module of the application, and an automated check fails the build if any other code calls a model.
• Data minimization: analytics without IP addresses; retention limits enforced automatically (see the data map).
• Resilience: managed database with automatic daily backups kept for 7 days.
• Incidents: breach notification within 72 hours (section 7); vulnerability reports through the disclosure policy.