Acretix

Legal

Data Processing Addendum

Terms for processing personal data on behalf of business customers.

Draft v0 — last updated June 2026 — pending counsel review

Placeholder pending legal review. This document is a structural draft. The final wording is being prepared by counsel and will replace this text.

1. Roles and scope

This Data Processing Addendum (the 'DPA') applies where Acretix processes personal data on your behalf in connection with the Service. For that data you act as the controller and Acretix acts as the processor.

This is placeholder structure; the binding terms will be provided by counsel.

2. Subject matter and duration

Acretix processes personal data for the duration of your use of the Service and as needed to provide it, as described in the agreement between us.

3. Nature and purpose of processing

Processing is limited to what is necessary to host and operate your deals, documents, signatures, and settlement records within the Service.

4. Categories of data and data subjects

Personal data may include the identities and contact details of the parties and signatories to your contracts, and the contents of the deals and evidence you upload. Data subjects are the individuals named in or party to those records.

5. Subprocessors

Acretix uses the subprocessors listed in our Privacy Policy (including Supabase, Vercel, eSignatures.com, Resend, and — when enabled — Anthropic). We impose data-protection obligations on subprocessors consistent with this DPA.

6. Security measures

Acretix maintains technical and organizational measures appropriate to the risk, including encryption in transit and at rest, row-level access isolation, private evidence storage with short-lived links, and tamper-evident hashing of evidence. See our Security page.

7. Data subject requests

Taking into account the nature of the processing, Acretix will assist you in responding to requests from data subjects to exercise their rights.

8. Personal data breaches

Acretix will notify you without undue delay after becoming aware of a personal data breach affecting your data.

9. International transfers

Placeholder — transfer mechanisms (such as standard contractual clauses, where applicable) will be described here by counsel.

10. Return and deletion

On termination, Acretix will delete or return your personal data within a reasonable period, except where retention is required by law.

11. Audits

Acretix will make available information reasonably necessary to demonstrate compliance with this DPA.

12. Precedence and contact

In case of conflict, this DPA governs over the Terms of Service with respect to data processing. Questions? Email hello@tryacretix.com.