Data Processing Addendum

1. Roles

For the personal information your department puts into ProbieTrack, your department is the controller and Command and Consequence Leadership Group LLC is the processor. You decide what is collected and why. We process it on your documented instructions, which are: run the service described in the Terms.

2. Subject matter and duration

Processing lasts as long as your account, plus the deletion window described below. The subject matter is the training, evaluation and probationary records of members of your department.

3. Categories of data and data subjects

Data subjects: your members, your account holders. Categories: identity and contact details, employment details, and performance evaluations. This is employment-performance information about identifiable people, and some of it may be produced in a grievance, an arbitration or litigation. It should be treated as sensitive whether or not a statute labels it so.

4. Our obligations

• Process only on your instructions, and tell you if we believe an instruction breaks the law.
• Keep the people who handle it bound to confidentiality.
• Apply the security measures described in the Privacy Policy.
• Not engage a new sub-processor without notice to you.
• Help you respond to requests from your members about their data.
• Help you with security assessments and breach notification.
• Delete or return the data at the end, at your choice.
• Make available the information needed to demonstrate the above.

5. Sub-processors

Current sub-processors: Stripe (payments; billing contact details only, no personnel records), Resend (notification delivery), DigitalOcean (infrastructure, United States), and Backblaze B2 (off-site backup storage, United States). Backups are encrypted before they leave our infrastructure with a key Backblaze never holds, so what is stored there cannot be read by Backblaze or by anyone who obtains it from them. We will give 30 days' notice before adding another, so you have time to object.

6. Security measures

Encryption in transit; passwords hashed with a current key-derivation function; optional two-factor authentication, which can be required for administrative tiers; rate limiting and lockout on authentication; session idle timeout and absolute ceiling; private file storage reachable only through short-lived signed links; per-department isolation enforced in the data layer such that a query without a department fails rather than returning everything; an append-only audit trail; daily backups with 30-day retention and a documented, exercised restore procedure.

7. Support access

Our support sessions inside your account are read-only, time-limited, visibly banner-marked for their duration, and recorded at both ends on your own audit trail with the stated reason. You can see every such session we have had.

8. Breach notification

We will tell you without undue delay, and in any case within 72 hours, of becoming aware of a personal data breach affecting your data, with what we know at the time and updates as we learn more.

9. Return and deletion

You can export everything at any time, including while your account is lapsed or suspended. On termination, deletion runs after a 30-day window during which nothing is destroyed and you can still export. After the window, data is permanently removed, subject only to backups already taken, which age out on the backup retention schedule.

Non-payment never triggers deletion. A lapsed account becomes read-only and retains everything.

10. Transfers

Your data is stored and processed in the United States: application and database on DigitalOcean infrastructure in San Francisco, encrypted backups on Backblaze B2. Notification email is delivered through Resend and payment details through Stripe, both United States companies.

[If any customer is outside the United States, the transfer mechanism relied on.]

11. Audits

Once in any twelve months, on 30 days' written notice, you may audit our compliance with this addendum, during business hours and without disrupting the service. You bear your own costs and ours. Where an independent report covering the same ground exists, we may offer it instead, and you may still audit if it does not answer your question.

12. Order of precedence

Where this addendum and the Terms of Service conflict on the processing of personal data, this addendum governs.

Last updated: September 14, 2026