Data Processing Agreement

1.1 This Data Processing Agreement (the “DPA”) forms part of the service agreement between StackShard Ltd., operating as Less Work Reaching Humans (“LWRH”, “we”), and the client named in that agreement (the “Client”, “you”).

1.2 It applies to all business data that LWRH processes on the Client's behalf in the course of building, running and maintaining the Client's assistant (“Client Data”).

1.3 The service agreement may set additional or different terms for particular services. Where the two documents conflict on the handling of Client Data, the service agreement governs unless it expressly says otherwise.

2.1 The Client remains responsible for Client Data and for meeting the privacy obligations that apply to its business. LWRH handles Client Data as a service provider for the Client.

2.2 Where a counterparty uses the terms “controller” and “processor”, the Client is the controller and LWRH is the processor for the purposes of this DPA.

2.3 The Client is responsible for having the authority to provide Client Data to LWRH and for the accuracy of the instructions it gives.

3.1 LWRH may process Client Data to provide, maintain, secure and improve the Client's service, to follow the Client's instructions, and to meet legal obligations.

3.2 LWRH does not use Client Data for its own purposes. LWRH does not sell Client Data, does not share it for advertising, and does not use it to train models made available to any other party.

3.3 LWRH may decline or pause an instruction that appears unlawful, unsafe, outside the agreed service, or technically impracticable.

4.1 Client Data is limited to what the assistant needs to perform its tasks: customer records, pricing, job history, operating rules and exceptions, and documents the Client supplies.

4.2 The individuals whose personal information may appear in Client Data are the Client's customers, staff, suppliers and contacts.

4.3 LWRH does not accept health records, legal files, or regulated financial data unless the parties expressly agree otherwise. The Client must tell LWRH before supplying sensitive or unusual categories of data.

5.1 Client Data is processed and stored on dedicated hardware located in Canada. Each Client's data and assistant are kept on hardware not shared with another LWRH client.

5.2 The language model used to perform judgment steps within a task runs on that same Canadian hardware. Client Data is not transmitted to any third-party model provider.

5.3 LWRH's service is designed so that Client Data is not transferred outside Canada for processing, backup or monitoring. The communications and billing exceptions are described in clauses 6.2 and 6.3.

6.1 LWRH engages the subprocessors listed in the table below. The Client consents to their engagement on entering the service agreement.

6.2 Commands and notifications exchanged between the Client and the assistant pass through Telegram, whose servers are outside Canada. Client Data is not transmitted through Telegram. This is the sole exception to clause 5.3 and is disclosed on the Trust Centre page of the LWRH website.

6.3 Billing is handled by Stripe, which processes the Client's billing contact and payment details outside Canada. No Client Data is provided to Stripe. A Client who prefers that no billing details leave Canada may arrange payment by cheque or electronic transfer instead.

6.4 LWRH may add or replace service providers as the service changes. Material changes affecting Client Data will be communicated where reasonably practicable or where required by law.

6.5 Third-party services operate under their own terms and practices. LWRH selects and uses them with reasonable care but does not guarantee their availability or conduct beyond obligations imposed by applicable law.

7.1 LWRH treats Client Data as confidential and does not disclose it to any third party except as set out in this DPA or as required by law.

7.2 Access to Client Data is limited to people who reasonably need it to provide, maintain or secure the service.

7.3 LWRH manages access using its normal security and personnel practices.

7.4 LWRH may disclose Client Data where required by law. Notice will be given only where legally permitted and reasonably practicable.

8.1 LWRH uses safeguards it considers appropriate to the nature of the service and the sensitivity of Client Data. These may include access controls, encryption in transit, dedicated hardware and operational logs.

8.2 Tasks that involve money or contact with a Client's customer are subject to limits fixed when the assistant is built, including maximum values, approved recipients and rate floors. The assistant stops and asks rather than proceeding past a limit.

8.3 The Client remains responsible for maintaining any manual processes it considers necessary for its business.

9.1 If LWRH receives a request from an individual concerning personal information in Client Data, LWRH may refer that person to the Client.

9.2 Any help requested from LWRH is subject to applicable law, reasonable scope, technical availability, and any fees or terms agreed with the Client.

10.1 LWRH will notify the Client of a breach affecting Client Data when required by applicable law.

10.2 Any notice will contain information reasonably available to LWRH at the time. Information may be updated as the matter is investigated.

10.3 The Client remains responsible for its own reporting and notification obligations. Any assistance from LWRH is subject to applicable law, reasonable scope and availability.

10.4 LWRH will respond to regulators as required by applicable law.

10.5 Breach reports may be sent to privacy@stackshard.com at any time.

11.1 LWRH keeps Client Data while needed to provide the service and may retain it afterward for a limited period under its normal deletion, backup, security and record-keeping processes.

11.2 LWRH may retain information where reasonably needed for legal obligations, security, disputes, backups or legitimate operational records. Deletion from backups may occur through normal backup rotation.

11.3 A Client may request an export or earlier deletion. LWRH will consider the request subject to technical availability, reasonable scope, applicable law, outstanding obligations and any terms agreed with the Client.

11.4 Billing and payment records may be retained for the period required by tax, accounting or other applicable law.

11.5 Operational and security logs may be retained for periods LWRH considers appropriate for operating, securing and supporting the service.

12.1 LWRH may provide limited information about its data-handling practices where it considers that appropriate or where applicable law requires it.

12.2 This DPA does not give the Client a general right to inspect systems, premises, logs, security materials, confidential information or records relating to another person.

13.1 This DPA takes effect when the service agreement takes effect and continues for as long as LWRH holds Client Data.

13.2 The Client may terminate in accordance with the service agreement, and the exit terms are set out in that agreement rather than being introduced here.

13.3 Terms that by their nature should continue after termination remain in effect for as long as relevant.

13.4 If LWRH is acquired, merges, reorganizes or ceases to trade, Client Data may be transferred as part of that event where permitted by law. Notice will be given where required by law or reasonably practicable.

14.1 This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada applicable in it, and the parties submit to the courts of Ontario.

14.2 Nothing in this DPA limits either party's obligations under PIPEDA or applicable provincial privacy legislation, including Quebec's Law 25 where it applies.

15.1 Notices to LWRH under this DPA are given in writing to privacy@stackshard.com.

15.2 Notices to the Client are given in writing to the contact named in the service agreement.

15.3 Notices are treated as received according to the service agreement or applicable law.

16.1 LWRH may update this DPA as its services, practices or legal obligations change. Notice of material changes will be given where required by the service agreement or applicable law.

16.2 Each published version is dated. The version signed with the Client's service agreement governs the relationship with that Client.