Data Processing Addendum

Last updated: October 20, 2026

Draft — pending legal review. This addendum applies when a business (“Customer”) uses Celegram to send cards on behalf of its people and we process personal information for the Customer. It forms part of the Terms between the Customer and [COMPANY LEGAL ENTITY] (“we”, “Processor”).

1. Roles

The Customer is the controller (or “business” under the CCPA) of the personal information it or its people put into Celegram. We act as processor (or “service provider”) and process it only to provide the service, on the Customer’s documented instructions, which are these Terms and the Customer’s use of the product.

2. Data and purposes

• People: the Customer’s organizers, the people they invite to sign, signers and recipients.
• Data: names, email addresses, NameStar @names, time zones, messages, photos, video and voice notes, delivery and reminder records.
• Purposes: creating cards, collecting messages, sending invitations and reminders, delivering cards, support and security.
• We do not sell personal information or use it for advertising.

3. Sub-processors

• Cloudflare, Inc. — hosting, database and file storage (United States).
• [EMAIL PROVIDER] — sending emails over SMTP.
• Stripe, Inc. — payments, when the Customer buys a plan.
• NameStar — delivering cards to @names.

We will tell the Customer about a new sub-processor at least [NOTICE PERIOD] before it starts processing, so the Customer can object.

4. Security

• Encryption in transit (HTTPS) and at rest by our hosting provider.
• Access to production data limited to staff who need it, with separate admin accounts, rate-limited sign-in and logged admin actions.
• Unguessable links for signing and viewing cards; optional board passwords.
• [SOC 2 Type II — confirm status]

5. Personal data breaches

We will notify the Customer without undue delay, and within [BREACH NOTICE HOURS] hours, after becoming aware of a breach affecting the Customer’s data, with the information the Customer needs to meet its own obligations.

6. Requests from individuals

We help the Customer answer requests to access, correct or delete personal information. Organizers can export a card’s messages and delete a board themselves; account holders can download or delete their data under Account; other requests go to support@namestar.com.

7. Deletion

When the agreement ends, we delete the Customer’s personal information within [DELETION PERIOD] days, except records we must keep by law (such as invoices).

8. International transfers

Data is stored in the United States. Where data of people in the UK or EU is transferred, the parties rely on [TRANSFER MECHANISM].

9. Contact

[COMPANY LEGAL ENTITY], [COMPANY ADDRESS]. Privacy questions: support@namestar.com.