Data Processing Addendum

1. Scope and roles

This Addendum applies when Cancelbox, Inc. processes personal data contained in your Stripe connection, cancellation sessions, or related workspace records on your behalf. You are the controller (or processor for your own customer). Cancelbox is the processor (or sub-processor). Cancelbox account data is covered by the Privacy Policy as controller, not this DPA.

Subject matter: hosting and processing subscription and cancellation data to operate Churn Routes and reporting. Duration: the subscription term plus the retention window. Nature: storage, matching, display, Stripe API calls you trigger, logging. Types of data: names, emails, plan and price context, reasons, optional feedback, identifiers. Data subjects: your subscribers and, where included, your staff listed on a customer record.

2. Instructions

Cancelbox will process that personal data only to provide the service, as described in the product documentation, and as you instruct through the dashboard or API—including applying a billing action a subscriber accepts. We will not use processor data for our own marketing. If we believe an instruction violates applicable law, we will tell you.

3. Confidentiality and security

• Personnel with access are bound by confidentiality.
• Encryption in transit (TLS) and encryption of Stripe tokens at rest.
• Session tokens are hashed before persistence.
• Workspace isolation with row-level security.
• Audit logs are append-only.
• Test and live Stripe environments are stored separately.

Details live on the Security page. You are responsible for member access, your Stripe account permissions, and the copy you show to subscribers.

4. Subprocessors

You authorize the subprocessors at /subprocessors. We will post new subprocessors there and, for material additions, notify workspace owners at least 14 days in advance where practical. You may object on reasonable data-protection grounds. If we cannot accommodate the objection, you may stop the affected processing or terminate the unused portion of a prepaid term.

5. Assistance

Taking into account the nature of processing, we will help you respond to data-subject requests, DPIAs, and consultations with authorities, at reasonable cost if the work is beyond standard self-serve tools. End-customer requests should go to you first.

6. Personal-data breaches

We will notify you without undue delay after becoming aware of a personal-data breach affecting processor data, and provide information we can reasonably share so you can meet your own notification duties. Security reports: security@cancelbox.co.

7. Return and deletion

After the service ends, we will delete or return processor data in the workspace within 30 days, except data we must keep for legal, security, or dispute reasons, or backups that expire on a rolling cycle. Stripe remains your system of record for billing.

8. Transfers, audits, and order of precedence

For restricted transfers from the EEA, UK, or Switzerland, the parties incorporate the applicable Standard Contractual Clauses / UK Addendum, with Cancelbox as data importer. You may request a reasonable security summary once per 12 months under NDA. On conflict, this DPA controls for processing of processor data; the Terms control for everything else.

Contact: privacy@cancelbox.co or legal@cancelbox.co.