Data Processing
Addendum

Draft. This document is the initial pre-launch version of the Nine·Tails Data Processing Addendum. It will be reviewed by counsel and the subprocessor list will be cross-checked against the production stack before any paid customer signs up. If your agency requires a signed copy, write to hello@ninetailsagency.com — we will execute via DocuSign.

1. Parties and incorporation

This Data Processing Addendum ("DPA") is between the customer ("Controller") and Nine Tails ("Processor," "Nine·Tails"). It is incorporated by reference into the Terms of Service the Controller has accepted at ninetailsagency.com/legal/terms.

This DPA applies whenever the Controller's use of the Service results in Nine·Tails processing Personal Data of the Controller's end clients, employees, or other identified or identifiable natural persons (collectively, "Data Subjects").

2. Definitions

Capitalized terms not defined here have the meanings given in the GDPR (Regulation (EU) 2016/679) and the UK GDPR.

• Personal Data — any information relating to an identified or identifiable natural person.
• Processing — any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• Subprocessor — any third party engaged by Nine·Tails to process Personal Data on behalf of the Controller.

3. Subject matter and duration

Nine·Tails processes Personal Data on the Controller's behalf for the duration of the active subscription, plus a 30-day window for export, plus any retention required by law.

4. Nature and purpose of processing

Processing is limited to what is necessary to provide the Service:

• Ingesting metric data from advertising and analytics platforms the Controller authorizes.
• Generating draft reports that may include the Controller's end-client name and the period covered.
• Delivering reports the Controller approves to recipient email addresses the Controller specifies.
• Operational record-keeping (audit logs, billing, security incident response).

5. Categories of Personal Data

Typically: end-client business name, business email address, period covered. Reports do not generally include the Personal Data of the Controller's end customers (i.e. the agency's clients' clients) — they are aggregate metric reports. If a Controller intentionally embeds end-customer Personal Data into a Report, the Controller is solely responsible for the lawful basis to do so.

6. Categories of Data Subjects

• The Controller's employees who hold accounts in the Service.
• The Controller's end clients (the agency's clients) who receive Reports.

7. Controller obligations

The Controller is responsible for the lawful basis for processing — including, where required, obtaining valid consent from Data Subjects. The Controller will provide its own privacy notices to Data Subjects.

8. Processor obligations

Nine·Tails will:

• Process Personal Data only on documented instructions from the Controller, including with regard to international transfers.
• Ensure persons authorized to process Personal Data are bound by confidentiality.
• Implement appropriate technical and organizational measures (Section 11).
• Assist the Controller in meeting its obligations under Articles 32–36 of the GDPR.
• On termination, delete or return Personal Data within 30 days, except where retention is required by law.

9. Subprocessors

The Controller authorizes Nine·Tails to engage the subprocessors listed in Appendix A. We will notify the Controller of any new subprocessor at least 30 days before engagement; the Controller may object on reasonable grounds during that window.

Nine·Tails imposes data-protection obligations on each subprocessor that are no less protective than those in this DPA, and remains liable for the subprocessors' performance.

10. International transfers

Where Personal Data is transferred outside the EEA / UK to a country without an adequacy decision, the parties rely on the Standard Contractual Clauses (Module 2: Controller-to-Processor) approved by the European Commission, as incorporated by reference here. Equivalent UK addendum applies for UK transfers.

11. Security

Without limiting Section 8, Nine·Tails will implement and maintain:

• Encryption of Personal Data in transit (TLS) and at rest.
• Access control limiting production access to a small number of named engineers.
• Audit logging of administrative access to production systems.
• Incident-response procedures with notification to the Controller within 72 hours of confirmed breach.
• Periodic review of subprocessors and the technical-and-organizational-measures (TOM) baseline.

12. Data Subject requests

If a Data Subject exercises their rights (access, correction, deletion, portability, restriction, objection) directly with Nine·Tails, we will forward the request to the Controller without responding on its own initiative. Nine·Tails will assist the Controller in responding to such requests.

13. Audit

Nine·Tails will provide the Controller, on request and not more than once per twelve months, with a copy of its most recent SOC 2 / ISO 27001 attestation if available, or with reasonable written evidence of compliance with this DPA. Audits beyond that scope are subject to mutual agreement, advance notice, and reimbursement of reasonable costs.

14. Liability

Liability under this DPA is subject to the limitations in the Terms of Service. This DPA does not extend the parties' overall liability cap.

15. Governing law

This DPA is governed by the laws of the State of Florida, USA, except that for processing subject to GDPR or UK GDPR, the relevant European or UK supervisory authority's jurisdiction is preserved.

---

Appendix A — Subprocessors

| Subprocessor | Service | Location | |---|---|---| | Vercel | Application hosting + edge delivery | United States | | Neon | Managed Postgres database | United States | | Upstash | Redis (rate limiting, caching) | United States | | Clerk | Authentication | United States | | Stripe | Payment processing | United States / Ireland | | Anthropic | Large-language-model API for report drafting | United States | | Resend | Transactional email delivery (planned) | United States |

The current list is mirrored at ninetailsagency.com/legal/privacy §5. Adding a subprocessor follows the notice procedure in Section 9 above.

Contact

For DPA execution, audit requests, or related matters — write to hello@ninetailsagency.com.