Legal

Data Processing Addendum

Last Updated: March 2, 2026

This Data Processing Addendum ("DPA") supplements the Terms of Service and Privacy Policy of Kindthing LLC d/b/a Paolo ("Paolo," "we," "us," or "our") and governs the processing of personal data by Paolo on behalf of its users ("you" or "Data Controller").

This DPA applies when Paolo processes personal data on your behalf in connection with the Service. By using the Service, you agree to this DPA.

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable individual, as defined by applicable data protection laws.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, or deletion.
• "Data Controller" means you, the user, who determines the purposes and means of Processing Personal Data through the Service.
• "Data Processor" means Paolo, which Processes Personal Data on behalf of the Data Controller.
• "Sub-processor" means a third party engaged by Paolo to Process Personal Data on behalf of the Data Controller.

2. Roles and Scope

You are the Data Controller for any Personal Data you store in or transmit through the Service. Paolo acts as the Data Processor, Processing your data solely to provide and maintain the Service as described in our Terms of Service and Privacy Policy.

3. Data Processing Details

4. Our Obligations as Data Processor

Paolo shall:

• Process on your instructions. Process Personal Data only in accordance with your documented instructions, which are defined by your use of the Service and these terms. We will not Process your Personal Data for any other purpose unless required by law, in which case we will inform you (unless legally prohibited from doing so).
• Maintain confidentiality. Ensure that any personnel authorized to Process Personal Data are bound by appropriate confidentiality obligations.
• Implement security measures. Maintain appropriate technical and organizational measures to protect Personal Data, including:
  • Row-Level Security (RLS) at the database level
  • Encryption in transit (TLS) and at rest
  • OAuth 2.0 and API key authentication
  • Timing-safe authentication comparisons
  • Regular security monitoring and logging
• Assist with data subject rights. Assist you in responding to requests from data subjects to exercise their rights (access, correction, deletion, portability) by providing the tools and mechanisms described in our Privacy Policy.
• Support compliance obligations. Provide reasonable assistance with data protection impact assessments and consultations with supervisory authorities, where required by applicable law.
• Delete or return data. Upon termination of your account or upon your request, delete your Personal Data from active systems within 30 days. Backup copies will be purged within 90 days.
• Make information available. Provide information reasonably necessary to demonstrate compliance with this DPA upon request.

5. Sub-processors

5.1 Authorized Sub-processors

You authorize Paolo to engage the following sub-processors to assist in providing the Service:

5.2 Sub-processor Obligations

Paolo ensures that each sub-processor is bound by data protection obligations no less protective than those in this DPA. Paolo remains liable for the acts and omissions of its sub-processors.

5.3 Changes to Sub-processors

We will notify you of any intended changes to our sub-processors at least 14 days before the change takes effect, by email or through the Service. If you object to a new sub-processor, you may terminate your account before the change takes effect.

6. Connected AI Platforms

When you connect Paolo to an AI platform (such as Anthropic's Claude), data flows between Paolo and that platform at your direction. These connected platforms are not sub-processors of Paolo — they operate as independent controllers or processors under their own terms and privacy policies.

Important: When you use Paolo through Anthropic's Claude or other AI platforms, those platforms may collect, log, or process data that passes through the integration as part of their own platform operations, including for safety monitoring, abuse prevention, and service improvement. This data handling is governed by the platform's own terms and privacy policy, not by Paolo's. We encourage you to review the terms of any AI platform you connect to Paolo.

7. Data Transfers

Paolo and its sub-processors are located in the United States. If you are located outside the United States, your Personal Data will be transferred to the United States for Processing. We rely on the data protection measures described in this DPA and our Privacy Policy to safeguard your data during and after transfer.

8. Data Breach Notification

In the event of a Personal Data breach that is likely to result in a risk to your rights and freedoms, Paolo will notify you without undue delay and no later than 72 hours after becoming aware of the breach. The notification will include, to the extent available:

• The nature of the breach, including the categories and approximate number of data subjects and records affected
• The likely consequences of the breach
• The measures taken or proposed to address the breach and mitigate its effects

9. Term and Termination

This DPA remains in effect for the duration of your use of the Service. Obligations related to data deletion, confidentiality, and security survive termination.

10. Conflicts

In the event of a conflict between this DPA and our Terms of Service or Privacy Policy, this DPA shall prevail with respect to the Processing of Personal Data.

11. Contact

For questions about this DPA or to exercise your data protection rights:

Kindthing LLC d/b/a Paolo
Email: hello@trypaolo.com
Website: https://trypaolo.com