This Data Processing Addendum ("DPA") forms part of the GoCanonical Terms of Service (the "Terms") between Canonical Labs, Inc., a Delaware corporation, 2261 Market Street, STE 10849, San Francisco, CA 94114 ("GoCanonical", "we", "Processor" or "Service Provider"), and the business that installs Clue ("you", "Controller" or "Business"). Accepting the Terms accepts this DPA. Words defined in the Terms have the same meaning here.
1. Definitions
- Data Protection Laws: all laws that apply to the processing of Personal Data under this DPA, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended by the CPRA ("CCPA") and similar US state laws.
- Personal Data: any information relating to an identified or identifiable natural person that we process for you through Clue. It is mainly Buyer Data.
- Processing, Controller, Processor, Data Subject, Personal Data Breach and Supervisory Authority have the meanings given in the GDPR. "Business", "Service Provider", "Sell" and "Share" have the meanings given in the CCPA.
- Sub-processor: a third party we engage to process Personal Data for you.
- SCCs: the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
- UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner, version B1.0.
2. Scope and roles
2.1 You are the Controller (or Business) of Buyer Data. We are your Processor (or Service Provider). We process Buyer Data only to provide Clue to you.
2.2 For the account and usage data of your Dashboard users, and for billing records, we are an independent controller, as described in our Privacy Policy. This DPA does not apply to that data.
2.3 Annex I describes the processing: its subject matter, duration, nature and purpose, the types of Personal Data and the categories of Data Subjects.
3. Your instructions
3.1 We process Personal Data only on your documented instructions. The Terms, your settings in Clue and this DPA are your complete instructions at the time you accept them. Further instructions must be in writing and consistent with the Terms.
3.2 We will tell you if, in our opinion, an instruction breaches Data Protection Laws. We may then suspend that processing until you change or confirm the instruction.
3.3 We do not process Buyer Data for consumer reporting or eligibility decisions (credit, employment, housing or insurance), and you must not instruct us to. The permitted purpose is in Terms Part B.
3.4 You are responsible for having a lawful basis for the processing and for giving any notice to your buyers that the law requires.
4. Confidentiality
Everyone we authorise to process Personal Data is bound by a duty of confidentiality, and access is limited to people who need it to provide, secure or support Clue.
5. Security
5.1 We maintain the technical and organisational measures in Annex II, designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
5.2 We may update those measures, but we will not materially reduce the overall level of protection during the term.
6. Sub-processors
6.1 You give us general authorisation to engage the Sub-processors listed at https://gocanonical.com/subprocessors (Annex III).
6.2 We give you at least 30 days' notice by email before we add or replace a Sub-processor. To receive notices, email support@gocanonical.com.
6.3 You may object on reasonable data protection grounds within those 30 days by emailing support@gocanonical.com. We will try in good faith to resolve the objection. If we cannot, you may uninstall Clue and we will refund the unused part of any prepaid plan period and any unused purchased boost credits. That is your sole remedy for an objection.
6.4 We impose on each Sub-processor data protection obligations that protect Personal Data to the same standard as this DPA, and we remain liable for each Sub-processor's performance of those obligations.
7. Data Subject requests and assistance
7.1 If a Data Subject asks us directly about Buyer Data, we will tell you within 5 business days and will not respond ourselves except to direct the person to you, unless the law requires otherwise.
7.2 We handle Data Subject requests manually. When you ask, we will find, delete or provide a copy of the lookup results and IP observations we hold for a named buyer within 30 days.
7.3 We refresh the opt-out list of our person-record source and delete matching results from our cache at least every 30 days.
7.4 Taking into account the nature of the processing and the information available to us, we will reasonably assist you with data protection impact assessments, prior consultations with a Supervisory Authority, and your security and breach obligations. Assistance beyond what Clue provides as standard is at your cost.
8. Personal Data Breach
8.1 We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting your Personal Data.
8.2 The notice will describe, as far as we then know: the nature of the breach; the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed; and a contact point. We will send updates as we learn more.
8.3 We will take reasonable steps to contain and remedy the breach. We will not make a public statement that names you without your consent, unless the law requires it.
8.4 Our notice is not an admission of fault or liability.
9. International transfers
9.1 Stored Personal Data stays in the United States (AWS us-east-1). Our AI provider may process requests in the United States or other countries where it operates.
9.2 EEA. Where a transfer of Personal Data from the EEA to us is a restricted transfer, the SCCs are incorporated into this DPA by reference, completed as follows: Module Two (controller to processor) applies, and Module Three (processor to processor) applies to onward transfers to Sub-processors; clause 7 (docking) applies; under clause 9, Option 2 (general written authorisation) applies with the notice period in section 6.2; the optional wording in clause 11 does not apply; under clause 13, the competent Supervisory Authority is the one that is competent for you; under clauses 17 and 18, the law and courts of Ireland apply. Annexes I to III of this DPA complete the annexes to the SCCs.
9.3 UK. For restricted transfers from the UK, the UK Addendum applies, incorporating the SCCs as completed in section 9.2. Table 1 is completed with the parties' details in this DPA, Tables 2 and 3 with sections 9.2 and Annexes I to III, and under Table 4 either party may end the UK Addendum as its section 19 allows.
9.4 Switzerland. For restricted transfers from Switzerland, the SCCs apply as completed in section 9.2, with the Swiss Federal Data Protection and Information Commissioner as the competent Supervisory Authority, and references to the GDPR read as references to the Swiss Federal Act on Data Protection.
9.5 We do not rely on the EU-US Data Privacy Framework.
9.6 If the SCCs and this DPA conflict, the SCCs prevail.
10. Deletion and return
10.1 When you uninstall Clue, we delete Personal Data as set out in the retention table in our Privacy Policy (section 7) and Terms B12. We keep only the records listed there (such as Stripe object ids, hashed identifiers, verdicts and usage records).
10.2 The synced copy of your Stripe data stops receiving data on uninstall and is deleted within 30 days of uninstall. Radar data follows the same clock, or is deleted sooner when Stripe requires.
10.3 Backups that held deleted data are not restored to production and expire on their normal schedule. Automated database backups expire within 7 days.
10.4 Before you uninstall, you may ask us for a copy of the Personal Data we hold for you, and we will provide it within 30 days.
11. Audits and information
11.1 We will make available the information reasonably necessary to demonstrate compliance with this DPA, by answering your reasonable written security and privacy questionnaires once a year.
11.2 We are working toward a SOC 2 Type II report. Once one is issued, we will make it available under a confidentiality agreement, and it will serve in place of questionnaires where it covers the request.
11.3 An onsite audit is available only where a Supervisory Authority requires it or after a Personal Data Breach, on at least 30 days' notice, during business hours, no more than once a year, under confidentiality, and at your cost.
12. CCPA
12.1 We are a Service Provider. We process Personal Information only for the business purposes in the Terms.
12.2 We do not Sell or Share Personal Information; do not retain, use or disclose it outside the direct business relationship with you or for any purpose other than the business purposes in the Terms; and do not combine it with personal information we receive from others or collect ourselves, except as the CCPA permits.
12.3 We will comply with the CCPA and provide the same level of privacy protection it requires. We will notify you if we can no longer meet our obligations. You may take reasonable and appropriate steps to stop and remediate unauthorised use of Personal Information.
12.4 We certify that we understand and will comply with these restrictions.
13. Stripe data
You remain bound by your agreement with Stripe. We handle Stripe Radar data only as your agent, for your own fraud prevention, as Terms B8.3 describes.
14. Liability and precedence
14.1 Each party's liability under this DPA is subject to the limits and exclusions in the Terms, except where Data Protection Laws or the SCCs do not allow them.
14.2 On the processing of Personal Data, this DPA prevails over the Terms. The SCCs prevail over both.
14.3 This DPA lasts as long as we process Personal Data for you.
Annex I: Description of processing
| Data exporter | The business that installs Clue, as Controller. Contact: the email of its Stripe account |
| Data importer | Canonical Labs, Inc., 2261 Market Street, STE 10849, San Francisco, CA 94114, as Processor. Contact: support@gocanonical.com |
| Data Subjects | The Controller's customers and prospective customers (buyers) |
| Personal Data | From Stripe: name, email, phone, billing and shipping addresses, receipt email, customer and payment history, refunds and disputes, limited card details (brand, last four digits, country, funding type, fingerprint, 3-D Secure result), Radar reviews, scores and early fraud warnings, and the IP address recorded on a payment. From lookups: signals about the email, phone, address and IP, public property records for an address, and person-record matches |
| Sensitive data | None intended |
| Frequency | Continuous while Clue is installed |
| Nature | Collection from Stripe, storage, lookups with Sub-processors, scoring, AI-written summaries, display to the Controller, deletion |
| Purpose | Assessing fraud and payment risk on the Controller's own transactions |
| Retention | As set out in Privacy Policy section 7 and section 10 of this DPA |
| Sub-processor transfers | As listed in Annex III, for the purposes listed there |
Annex II: Technical and organisational measures
- Encryption: data is encrypted in transit (TLS) and at rest (AWS-managed encryption).
- Request authentication: every request from the Stripe Dashboard carries a Stripe signature, which we check before doing anything. The merchant account is taken only from that signature.
- Tenant isolation: stored lookups and synced data are held per Stripe account and are never served to another merchant.
- Least privilege: Clue has read-only permissions on the merchant's Stripe account. Credentials and keys are held in AWS Secrets Manager. Production deploys run through CI with short-lived credentials.
- Data minimisation: each lookup receives only the inputs it needs. The AI model never receives raw email addresses, phone numbers, IP addresses or licensed record values, and cannot set the verdict.
- Logging and monitoring: operational logs, and alarms that notify our staff.
- Availability: automated database backups, kept for 7 days.
- Retention and deletion: automatic deletion on uninstall and on the schedules in the Privacy Policy.
- Personnel: access is limited to people who need it and is bound by confidentiality.
- Vulnerability handling: a public reporting channel (https://gocanonical.com/security).
Annex III: Sub-processors
The list at https://gocanonical.com/subprocessors, as updated under section 6.