1. Parties
This Data Processing Addendum (“DPA”) forms part of the written agreement (“Agreement”) between LADLE PBC, a Delaware public benefit corporation with operational headquarters in Canada (“LADLE”, “Processor”) and the customer identified in the Agreement or the corresponding LADLE subscription record (“Customer”, “Controller”). This DPA governs LADLE’s Processing of Personal Data on Customer’s behalf in connection with the Services.
2. Definitions
“Applicable Data Protection Laws” means all laws and regulations regarding the processing of Personal Data applicable to a party in its role as Controller or Processor, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR, the California Consumer Privacy Act as amended (“CCPA”), and the Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”).
“Personal Data”, “Controller”, “Processor”, “Data Subject”, and “Processing” have the meanings assigned in the GDPR. “Sub-processor” means any Processor engaged by LADLE to Process Personal Data on Customer’s behalf.
“Services” means the LADLE subscription product, including the web application, mobile applications where applicable, associated APIs, and monthly impact-reporting outputs.
3. Scope and Purposes of Processing
LADLE Processes the following categories of Personal Data on Customer’s behalf, solely to provide the Services and to comply with applicable law:
- Account identifiers — email address, name (if provided), workspace membership, authentication credentials.
- Chat content — user-provided text, uploaded files, images, and generated responses within Customer’s account or workspace.
- Usage telemetry — anonymized metrics on feature usage, error rates, and performance for the purpose of maintaining Service quality.
- Billing metadata — payment tokenization identifiers and last-four card digits (card details themselves are Processed exclusively by Stripe, not by LADLE).
Processing occurs only for: (a) delivery of the Services, (b) billing and account administration, (c) compliance with legal obligations, (d) generation of the monthly impact-reporting artifact, and (e) responding to Data Subject requests.
No training use. LADLE does not use Customer chat content to train any machine-learning model. Inference is performed by our upstream provider (Anthropic) in zero-retention mode, and Anthropic’s terms with LADLE contractually prohibit training on Customer content.
4. Sub-processor Authorization
Customer authorizes LADLE to engage the Sub-processors listed at /legal/subprocessors for the purposes described therein. LADLE will notify Customer of any intended addition or replacement of Sub-processors at least thirty (30) days in advance via (a) email to the Customer’s designated privacy contact and (b) a public update at the subprocessors page. Customer has the right to object to any proposed change on reasonable grounds relating to data protection; if the parties cannot resolve the objection within thirty (30) days, Customer may terminate the affected Services without penalty.
LADLE enters into written agreements with each Sub-processor imposing data protection obligations no less protective than those in this DPA.
5. Security Measures
LADLE implements and maintains appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include:
- Encryption in transit (TLS 1.2 or higher) for all Personal Data.
- Encryption at rest (AES-256) for stored Personal Data in production databases and backups.
- Multi-factor authentication required for all administrative access to production systems.
- Principle of least privilege: production access limited to two named personnel, both under written confidentiality obligations.
- Audit logging of all administrative access; logs retained for twelve (12) months.
- Regular vulnerability scanning of production infrastructure and dependencies.
- Documented incident response plan reviewed at minimum annually.
- Multi-tenant isolation at database and API layers to prevent cross-Customer data access.
See /security for the current technical posture in detail.
6. Breach Notification
LADLE will notify Customer without undue delay, and in any event within seventy-two (72) hours, of becoming aware of a Personal Data Breach affecting Customer’s Personal Data. The notification will describe: (a) the nature of the Breach, (b) the categories and approximate number of Data Subjects affected, (c) the likely consequences, (d) measures taken or proposed to address the Breach and mitigate its adverse effects, and (e) contact information for the LADLE representative handling the incident.
LADLE will provide a written post-incident report within thirty (30) days of the initial notification, including root-cause analysis, remediation completed, and preventive measures adopted.
7. Data Subject Rights
Taking into account the nature of the Processing, LADLE will assist Customer, insofar as possible, in fulfilling Customer’s obligations to respond to Data Subject requests under Applicable Data Protection Laws, including rights of access, rectification, erasure, restriction, portability, and objection.
Where a Data Subject exercises rights directly against LADLE via the LADLE application (e.g., account deletion via Settings), LADLE will fulfill the request within thirty (30) days and notify Customer’s designated privacy contact of the request category (not the Data Subject’s identity, unless the request originated from a Customer organization member and Customer is entitled to know).
8. Deletion and Return
Upon termination of the Agreement or Customer’s written request, LADLE will, within thirty (30) days, delete or return all Personal Data to Customer, at Customer’s election. LADLE may retain Personal Data to the extent required by applicable law, provided such retained data remains subject to the confidentiality and security obligations of this DPA.
Data retained solely for finance-record purposes (e.g., billing reconciliation) is retained for seven (7) years and deleted at that point without further notice.
9. International Data Transfers
LADLE processes Personal Data in the United States (primarily) and Canada. Where Personal Data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a jurisdiction not deemed adequate under the GDPR, the transfer is governed by the European Commission’s Standard Contractual Clauses (Module Two: Controller to Processor) incorporated into this DPA by reference and included as Annex A on execution of an enterprise-negotiated version of this DPA.
LADLE does not currently offer a data residency guarantee for EU-only or Canada-only storage of Personal Data. Customers with hard residency requirements should evaluate this posture before executing this DPA.
10. Audits
LADLE will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA. Upon reasonable prior written notice (not less than thirty (30) days), Customer may audit LADLE’s compliance with this DPA no more than once in any twelve-month period, at Customer’s cost, subject to LADLE’s reasonable security and confidentiality requirements.
11. Precedence
In the event of a conflict between this DPA and the Agreement (including the Terms of Service), this DPA prevails with respect to the Processing of Personal Data.
12. Contact
All notices under this DPA to LADLE should be directed to legal@ladle.chat. Data Subject requests may be directed to privacy@ladle.chat.
THIS DOCUMENT IS A GOOD-FAITH TEMPLATE INTENDED TO GIVE CUSTOMERS A CLEAR VIEW OF LADLE’S DATA-PROCESSING COMMITMENTS. IT IS A DRAFT AND HAS NOT BEEN REVIEWED BY OUTSIDE COUNSEL FOR EVERY JURISDICTION IT MAY BE EXECUTED IN. ENTERPRISE CUSTOMERS REQUIRING A NEGOTIATED, COUNSEL-REVIEWED VERSION SHOULD EMAIL LEGAL@LADLE.CHAT.