DPA · last updated 27 October 2026
Data Processing Addendum.
This addendum is part of the Terms of Service between the customer and Life Vitamin Co. LLC ("we") and applies whenever we process personal data on the customer's behalf. Need a countersigned copy? Email [email protected].
1. Roles
For prospect data and email content in the customer's workspace, the customer is the controller and we are the processor (or, where the customer is itself a processor, our subprocessor). "Personal data", "processing", "controller", "processor" and "data subject" have the meanings given by applicable data protection law, including the GDPR, the UK GDPR and the CCPA/CPRA.
2. Instructions
We process customer personal data only to provide Keep Your Chain under the Terms and the customer's documented instructions, which include the customer's use and configuration of the product. We tell the customer if we believe an instruction breaks the law. We don't sell or share customer personal data, or use it for any other purpose, including training AI models.
3. Confidentiality
Everyone at Life Vitamin Co. LLC with access to customer personal data is bound by confidentiality and has access only as needed to run and support the service.
4. Security
- Encryption in transit (TLS) for every connection; mailbox credentials and API keys encrypted at rest with AES-256-GCM under a per-workspace key.
- Strict workspace isolation in every query, covered by automated tests.
- Passwordless sign-in by one-time link; sessions expire; access to production is limited to the founders.
- Automated backups before every database change; documented restore steps.
- An activity log of changes in each workspace, kept 180 days.
5. Subprocessors
The customer authorizes these subprocessors: Cloudflare, Inc. (hosting, database, backups, built-in AI drafting; US and global network), Stripe, Inc. (billing; US) and Resend (account and sign-in email; US). We give at least 30 days' notice by email before adding or replacing one, and the customer may object on reasonable data-protection grounds; if we can't resolve it, the customer may end the affected service and get a prorated refund. Services the customer connects with its own account or key (Microsoft 365, MillionVerifier, Apollo, Anthropic, OpenAI, Telegram, Google, Cloudflare DNS) are the customer's own providers, not our subprocessors. We impose data-protection terms on our subprocessors at least as protective as this addendum.
6. Data subject requests
The product lets the customer export, correct and delete prospect data and suppress addresses. If we receive a request from a data subject about customer data, we pass it to the customer without undue delay and don't answer it ourselves unless the customer asks us to. We provide reasonable help with requests the customer can't handle in the product.
7. Personal data breaches
We notify the customer without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting customer personal data, with what we know, what we're doing about it and who to contact, and we keep the customer updated.
8. Assistance
We provide reasonable information the customer needs for data protection impact assessments and consultations with regulators, taking into account the nature of the processing.
9. Deletion and return
The customer can export its data as CSV at any time. After the account ends, we delete customer personal data within 30 days; it then leaves our backups as they are replaced on a rolling basis, unless the law requires us to keep it.
10. Audits
On written request, once a year, we answer reasonable security questionnaires and provide information needed to show compliance with this addendum. Cloudflare and Stripe hold their own independent security certifications for the infrastructure we use.
11. International transfers
Customer data is processed in the United States. Where the law requires a transfer mechanism for personal data from the EEA, the UK or Switzerland, the parties agree to the EU Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor) and the UK International Data Transfer Addendum, which are incorporated by reference, with Life Vitamin Co. LLC as data importer and California law and courts where a choice is open.
Annex: details of processing
| Subject matter and duration | Providing Keep Your Chain for the term of the customer's subscription, then until deletion as described in section 9. |
|---|---|
| Nature and purpose | Storing prospect records, sending and syncing outreach email through the customer's mailboxes, classifying replies, drafting suggested replies, analytics, alerts. |
| Data subjects | The customer's prospects and their colleagues who join an email thread; the customer's own users. |
| Categories of data | Names, business email addresses, job titles, company and website, public storefront technology, email content and headers within outreach threads, and any custom fields the customer imports. |
| Special categories | None intended. Customers must not import special-category data. |
Life Vitamin Co. LLC · 1601 N. Sepulveda Blvd. #584, Manhattan Beach, CA 90266 · [email protected]