Storystak Data Processing Addendum

1. Scope and Roles

1.1 This Data Processing Addendum ("DPA") forms part of the Storystak Subscription Terms and the Storystak Trial Terms (each, the "Agreement") between Storystak LLC ("Storystak") and the Customer or Agency that accepted them ("Customer"). Capitalized terms not defined here have the meanings in the Agreement.

1.2 This DPA applies when Storystak processes Customer Personal Data. "Customer Personal Data" means Personal Information in Customer Content or Usage Data.

1.3 Customer is a "business" or "controller", or, where it acts for its own Clients, a "service provider" or "processor" to them. Storystak is Customer's "service provider" or "processor", or, where Customer acts for its Clients, a subprocessor. These terms have the meanings given in Data Protection Laws.

1.4 "Data Protection Laws" means the US federal and state privacy and data protection laws that apply to the processing of Customer Personal Data under the Agreement, including the California Consumer Privacy Act as amended ("CCPA").

2. Processing on Customer's Instructions

2.1 Storystak will process Customer Personal Data only to provide, secure and support the Service, and only on Customer's documented instructions. The Agreement, this DPA, and Customer's use and configuration of the Service are Customer's complete instructions. Additional instructions must be agreed in writing.

2.2 Storystak will tell Customer if, in its opinion, an instruction breaks Data Protection Laws, and need not follow it.

2.3 Annex B describes the processing.

3. State Privacy Law Terms

Storystak will not: (a) sell or share Customer Personal Data, as "sell" and "share" are defined in the CCPA; (b) retain, use or disclose it for any purpose other than the business purposes in the Agreement, or outside the direct business relationship with Customer; or (c) combine it with personal information Storystak receives from any other source, except as Data Protection Laws allow a service provider to do. Storystak will comply with the obligations that Data Protection Laws place on it, give Customer Personal Data the level of privacy protection those laws require, and notify Customer if it can no longer meet them. Customer may take reasonable and appropriate steps to stop and remediate unauthorized use. Storystak certifies that it understands and will comply with these restrictions.

4. No Training, No Pooling, and Client Walls

4.1 Storystak will not use Customer Personal Data to train or fine-tune AI models, and will use AI providers only under terms that prohibit them from training on it.

4.2 Storystak keeps Customer Personal Data separate from every other customer's data, and will not use it to build, inform, test or improve any other customer's Suite, Staks or deliverables.

4.3 Within Customer's Suite, each Client Stak is kept separate from every other Client Stak, as Section 8.6 of the Subscription Terms describes.

5. Storystak Personnel

Storystak will limit access to Customer Personal Data to personnel who need it to provide, secure or support the Service, and who are bound by written confidentiality obligations.

6. Security

Storystak will maintain the measures in Annex A and will not materially reduce the overall security of the Service during the Agreement. Customer is responsible for the security choices within its control, including its Users' credentials, which Users it limits to which Client Staks, and the settings of the AI tools it connects.

7. Subprocessors

7.1 Customer authorizes Storystak to use the Subprocessors listed at storystak.com/legal/subprocessors/ (Annex 1 to the Subscription Terms).

7.2 Storystak will bind each Subprocessor to written data protection terms no less protective than this DPA, as far as relevant to its service, and remains responsible for each Subprocessor's performance.

7.3 Storystak will email the Account Owner at least 14 days before a new Subprocessor begins processing Customer Personal Data, except in an urgent replacement for security or continuity, when it will give notice as soon as practicable. If Customer objects on reasonable data-protection grounds within 14 days after the notice, and Storystak cannot offer a reasonable alternative within 30 days after the objection, Customer may terminate the affected Service without penalty and receive a refund of prepaid fees for the unused period.

8. Customer's Own AI Tools

The AI tools Customer and its Users choose to connect to a Stak, such as Claude or ChatGPT, are not Storystak's Subprocessors. When a User's AI tool reads a Stak, Storystak discloses Customer Content to that tool at Customer's direction, and the tool's own terms govern what it does with it. Customer is responsible for those tools' settings, including whether a User's plan allows the provider to train on their conversations.

9. Assistance

9.1 Requests from individuals. If Storystak receives a request from an individual about Customer Personal Data, it will not respond except to direct the individual to Customer, and will forward the request to Customer within 5 Business Days. Storystak will provide reasonable help, through the Service's features or otherwise, for Customer to respond.

9.2 Assessments. Storystak will provide information reasonably needed for any data protection assessment Customer must carry out about the Service.

10. Security Incidents

10.1 Storystak will notify Customer without undue delay, and in any event within 72 hours, after confirming a Security Incident affecting Customer Personal Data.

10.2 The notice will describe, as far as known, what happened, the data and individuals affected, the likely consequences, and the steps Storystak has taken or proposes. Storystak will update Customer as it learns more, take reasonable steps to contain the incident, and cooperate with Customer's response.

10.3 Customer decides whether and how to notify affected individuals, Clients and regulators, unless the law requires Storystak to do so directly. A notice under this Section is not an admission of fault.

11. Return and Deletion

Customer may export Customer Content under Section 7.5 of the Subscription Terms. Storystak will delete Customer Personal Data as Section 8.7 of the Subscription Terms (or Section 5 of the Trial Terms) describes, and will confirm deletion in writing on request. Storystak may keep a copy only where the law requires, and then only for that purpose, under this DPA.

12. Information and Audits

12.1 Once a year, or after a Security Incident, Storystak will answer in writing a reasonable security questionnaire from Customer.

12.2 Where its hosting provider makes its own third-party audit reports available, Storystak will help Customer get them under that provider's confidentiality terms. Those reports cover the hosting provider's controls, not Storystak's application.

12.3 Any further audit that Data Protection Laws require will be on at least 30 days' notice, during business hours, at Customer's cost, no more than once a year, and limited to what those laws require.

13. Location

Storystak and its Subprocessors process Customer Personal Data in the United States, except that Cloudflare, which carries traffic to the Suite and connector, may route it through its global network, and Anthropic may perform its AI processing in other countries. Customer will not submit personal information of individuals in the European Economic Area, the United Kingdom or Switzerland unless an Order Form and an amendment to this DPA address it.

14. Prohibited Data

This DPA does not change Section 8.3 of the Subscription Terms. Storystak does not agree to process Prohibited Data, and does not sign a HIPAA business associate agreement except in a separate signed document.

15. Liability and Precedence

Each party's liability under this DPA is subject to the limits in the Agreement. If this DPA conflicts with the Agreement on the processing of Customer Personal Data, this DPA controls. This DPA lasts as long as Storystak processes Customer Personal Data.

---

Annex A: Security Measures

These are the measures in place on this DPA's effective date. Storystak may change them, as long as it does not materially reduce the overall security of the Service. The security overview at storystak.com/legal/security/ describes them in plain language.

• Encryption in transit. The Suite, the Surface, the Stak connector and Dot are served only over HTTPS with TLS 1.3. Plain HTTP requests are redirected to HTTPS, and browsers are told to use HTTPS only (HSTS).
• Separate storage. Each Suite's Customer Content is stored in its own private GitHub repository, separate from every other customer's. Each Suite runs as its own application with its own data store.
• Client walls. Each Client Stak is kept separate from every other Client Stak. Customer can limit a User who does not hold an owner, admin, operations or commercial role to the Client Staks assigned to them, and a limited User cannot read any other Client Stak except one they manage, through an AI tool or in the Surface. Each read through an AI tool is scoped to one Stak.
• Sign-in. Users sign in with Google. On every request, the Service re-checks the signed-in email address against the Suite's list of allowed domains and people, so deactivating someone in the Suite ends their access. Shared credentials are not allowed.
• People approve changes. AI tools can read the Stak and propose changes, but no proposed change applies without approval by a person with that right, and each change records who proposed it. Some changes always need a person and can never be set to apply on their own, including any number, price, percentage or date, and the files that speak for a client.
• Secrets kept out. A proposed change that contains what looks like an access key or a payment-card number is refused when it is filed.
• Limited internal access. Only Storystak personnel who need access to provide, secure or support the Service have it. Today that is Storystak's two partners; contractors get access only for a named customer task.
• Subprocessors. Bound by written terms, with AI providers under terms that prohibit training on Customer Content.
• Deletion. Deleted content leaves the live Service within 30 days of a request. Within 90 days after that, backups containing it expire and Storystak takes reasonable steps to remove it from repository history.
• Incident response. Security reports go to security@storystak.com, and Storystak follows Section 10 of this DPA.
• Hosting. Sevalla (a Kinsta platform), on Google Cloud in the us-west3 region (Salt Lake City, Utah), with Cloudflare in front. Sevalla's SOC 2 Type II report covers its own infrastructure, not Storystak's application.

Annex B: Description of Processing