Data Processing Agreement

1.Parties, and what this agreement is

This Data Processing Agreement is between Brendan Jones, carrying on business as Orca Jones, a sole proprietorship based in British Columbia, Canada ("we", "us", "Sitka") and the workspace that has agreed to it ("you", the "Controller"). It supplements our Terms of Service and applies wherever you process personal information about your own clients using Sitka.

Canadian privacy law does not use the terms "controller" and "processor" as its statutory vocabulary the way some other jurisdictions' laws do, but the underlying split is the one PIPEDA and the BC Personal Information Protection Act (PIPA) both draw: you are the organization accountable for your clients' personal information, and we are the service provider who processes it on your behalf, under your instructions, to deliver the features you use. This document uses "Controller" and "Processor" as convenient labels for that same split, not as an import of foreign statutory terms.

This document does not require a countersigned copy to take effect between us: it applies automatically once you accept the Terms of Service. If your own compliance process needs a signed PDF for your records, email legal@sitkasystems.ca and we will countersign a copy in this same form. Sitka's contract tool annotates PDFs; it does not run a signing workflow, so that exchange happens by email rather than inside the product.

2.Scope and purpose of processing

We process personal information you enter or upload solely to provide the Sitka service to you: to store your client and listing records, to generate the drafts and reports you review and approve, to run the AI tools you use, and to support the features described in our Terms of Service. We do not process it for our own independent purposes, and we do not use it to train AI models or to build any dataset shared across tenants.

The duration of processing is the life of your subscription, plus the retention periods and deletion mechanics described in our Privacy Policy and below.

3.Data subjects and categories of personal information

The data subjects are the people your workspace holds records about: your clients (buyers and sellers), and, incidentally, other individuals named in documents you upload, such as a co-signer named in a contract PDF or an owner named in a strata document.

The categories of personal information are those set out in the "What we collect" section of our Privacy Policy under "Client records", "Listings and activity", and "Files you upload": name, contact details, mailing address, buyer/seller status, budget range, area of interest, contact preference, optionally a spouse or partner name, date of birth, and anniversary date, referral source, free-text notes and tags, and the content of any strata or contract document you upload.

We do not expect, and Sitka is not built to hold, special categories of information such as government identification numbers, banking credentials, or health records. Our Acceptable Use Policy asks you not to upload these.

4.Your instructions, and our processors

You instruct us to process personal information by using the product: entering a client record, uploading a document, generating a report, and approving it for sending are all instructions within the scope of this agreement. We will not process personal information for a purpose outside that scope without a further instruction from you, or unless required by law, in which case we will tell you first unless the law prohibits it.

We may engage sub-processors to help deliver the service, listed below. Engaging any of them is itself carried out under your general authorization given by entering into this agreement, subject to the notice commitment below.

5.Sub-processors

These are all of them, verified against the codebase rather than assumed. Each sees only what its role requires.

• Anthropic (United States) - AI text generation and document analysis. Sees prompt content for the feature in use: client and listing details for reports, strata document contents for analysis, listing details and photos for marketing copy, and assistant queries.
• Leonardo.Ai (United States) - virtual staging image generation. Sees the room photograph uploaded for staging and the styling instruction. The source photo and the generated image are deleted from Leonardo's systems as soon as the generation completes, whether it succeeded or failed.
• Supabase (database in Canada, ca-central-1; the vendor is US-headquartered) - database, authentication, and file storage for the whole platform.
• Vercel (United States, Vercel's default region) - application hosting, and the temporary storage transient uploads pass through before deletion.
• Stripe (United States) - payment processing. Sees billing and card details directly; we do not.
• Resend (United States) - outgoing transactional email sent from our own address, used when you have not connected your own Google account.
• Google (United States) - OAuth sign-in, and, only where you connect it, send-only Gmail access (the gmail.send scope) so reports can send from your own address.

Most of these operate principally in the United States, so personal information processed through them may be accessible to foreign courts and authorities under those countries' laws. We require each of them to provide, through their own commercial or contractual terms, a level of protection for that information comparable to what PIPEDA and PIPA require of us. Our own database and file storage are hosted in Canada (ca-central-1) and the application runs in the United States (Vercel's default region).

If we add or replace a sub-processor that will handle personal information, we will give you at least 30 days notice by updating this page and emailing your account address, before the change takes effect. If you object on reasonable data-protection grounds, tell us within that notice period and we will work with you to find a resolution.

6.Security measures

These are the measures actually built into the platform, not a generic list:

• Every tenant-scoped database table has row-level security enabled, with policies that derive the tenant from the authenticated session rather than from a value a client could supply. A query made on behalf of one workspace cannot return another workspace's rows. This is enforced in code and covered by an automated cross-tenant isolation test suite that runs on every change and blocks a release if it fails.
• Uploaded files that persist (staged photos, contract PDFs, workspace logos) live in private Storage buckets, scoped to the owning workspace by the same tenant-derivation pattern, reachable only through short-lived signed links generated for a signed-in seat on that workspace.
• Credentials we hold on your behalf, meaning the OAuth tokens for a connected Gmail account, are stored as encrypted secrets in a managed secrets vault (Supabase Vault), accessed only through server-side functions. They are never in a plaintext column and never in an environment variable.
• Every write to workspace data is recorded in an append-only audit log: who did it, what changed, when, and the IP address it came from.
• The application sits behind an authentication check that runs before any page or route handler, and the session is revalidated against the authentication provider on every request rather than trusted from a cookie alone.
• Card details never touch our systems; Stripe holds them.
• Rate limits apply to authentication, the public lead-capture form, and AI-backed endpoints.

Draft note: this list states measures that exist in the code today and were verified against it while writing this document. It does not certify compliance with a named security framework (SOC 2, ISO 27001, or similar) - no such certification exists for a business of this size, and this document does not claim one.

7.Assistance with data subject requests

You are responsible for responding to your own clients when they exercise a privacy right against you, such as asking what you hold about them or asking for a correction or deletion. Most of your workspace's data is already accessible and editable directly in the product, and you can export your clients and listings to CSV yourself at any time without our involvement.

Where you need our help, for example locating a record across the platform's own operating logs, we will provide reasonable technical assistance. Email legal@sitkasystems.ca and we aim to acknowledge within two business days.

If a data subject contacts us directly about your workspace's data (for example, a client of yours who does not have your contact details), we will forward the request to you promptly and will not respond on your behalf without your instruction, except where we are legally required to.

8.Breach notification

If we become aware of a breach of security safeguards affecting personal information you have entrusted to us, we will notify you without undue delay after we become aware of it, with enough detail for you to assess the impact and meet your own notification obligations to your clients and, where the real-risk-of-significant-harm threshold under PIPEDA or PIPA is met, to the applicable privacy regulator.

Our Security page describes our own detection, assessment, and regulator-notification process in more detail.

Draft note: PIPEDA and PIPA do not set a fixed clock (unlike some other jurisdictions' "72 hours" rules) - the standard is "as soon as feasible". We have deliberately not attached an invented number of hours or days to this commitment. Whether to add one anyway, as a stronger contractual promise to tenants, is a question for a lawyer weighing what a small operator can realistically commit to.

9.Return and deletion on termination

When your subscription ends, the grace period described in our Terms of Service and Privacy Policy applies: your data remains retained and exportable for 30 days, after which access ends. You can export your own records to CSV at any point before then.

You may also request deletion of your workspace and everything in it at any time, from the data settings page. That deletion, once executed, removes your database records, your generated output, your files across every Storage bucket, and the encrypted tokens for any connected email account. It is carried out by a person confirming an irreversible action, rather than firing automatically, and we will confirm in writing once it has run.

We retain our own operating records (audit and usage logs, and billing records we are required to keep for tax purposes) on the schedule set out in our Privacy Policy. These are our records of having operated the service, not your content, and this agreement does not require their deletion.

10.Liability, audits, and other terms

Liability under this Data Processing Agreement is subject to the limitation in our Terms of Service, capped at the total amount you paid us in the twelve months before the claim arose, except where the law does not allow a limitation.

We will respond to a reasonable written request for information about our security measures, addressed to legal@sitkasystems.ca. We do not currently commit to an on-site or third-party audit right: as a small operator, that is not something we can support today, and this document does not promise it.

This agreement is governed by the laws of British Columbia, and the courts of British Columbia, sitting in Vancouver have jurisdiction, on the same terms as our Terms of Service.

Draft note: this is the single document in this legal pack a tenant actually signs, and the one where writing it without a lawyer carries the most risk. In particular: whether the liability cap above should apply to a privacy breach at all (many DPAs carve out a separate, often higher, cap for regulatory fines and breach costs), whether the audit-rights refusal above is defensible for an enterprise customer, and whether the breach-notification clause needs a firmer number attached, are all decisions this draft has deliberately left as the conservative, lower-commitment option rather than guessed at. See legal@sitkasystems.ca before relying on this against anything but a small, low-risk customer.