Data Processing Addendum

Effective Date: July 25, 2026

This Data Processing Addendum ("DPA") applies to business customers on whose behalf DTCDecoder processes personal data. It supplements our Terms of Service and Privacy Policy. A signed copy for enterprise agreements is available on request.

Roles

Where you use DTCDecoder to process personal data of your own customers or employees, you act as the data controller and DTCDecoder acts as a data processor, processing that data only on your documented instructions.

Scope and Purpose

Processing is limited to providing the Services — including AI-assisted diagnostics, account management, and support — for the duration of your use of the platform.

Sub-processors

We engage trusted sub-processors to deliver the Services, including:

• Creem — payment processing (Merchant of Record)
• Anthropic — AI diagnostic processing
• Supabase — database, authentication, and file storage
• Vercel — application hosting

We require sub-processors to provide data-protection commitments consistent with this DPA.

Security

We maintain commercially reasonable technical and organizational measures to protect personal data, including access controls, encryption in transit, and restricted, verified access to purchased files.

Data Subject Requests

We will provide reasonable assistance to help you respond to requests from individuals to access, correct, delete, or restrict their personal data.

International Transfers

Where personal data is transferred across borders, we rely on appropriate safeguards recognized under applicable data-protection law.

Breach Notification

We will notify you without undue delay after becoming aware of a personal-data breach affecting your data.

Return and Deletion

On termination, we will delete or return personal data processed on your behalf, except where retention is required by law.

Contact

To request a signed DPA or ask about data processing, email support@dtcdecoder.com.