1. Parties
This Data Processing Addendum (“DPA”) forms part of the written agreement (“Agreement”) between LADLE, an unincorporated sole proprietorship registered in British Columbia, Canada (“LADLE”, “Processor”) and the customer identified in the Agreement or the corresponding LADLE subscription record (“Customer”, “Controller”). This DPA governs LADLE’s Processing of Personal Data on Customer’s behalf in connection with the Services.
2. Definitions
“Applicable Data Protection Laws” means all laws and regulations regarding the processing of Personal Data applicable to a party in its role as Controller or Processor, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR, the California Consumer Privacy Act as amended (“CCPA”), and the Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”).
“Personal Data”, “Controller”, “Processor”, “Data Subject”, and “Processing” have the meanings assigned in the GDPR. “Sub-processor” means any Processor engaged by LADLE to Process Personal Data on Customer’s behalf.
“Services” means the LADLE subscription product, including the web application, mobile applications where applicable, associated APIs, and monthly impact-reporting outputs.
3. Scope and Purposes of Processing
LADLE Processes the following categories of Personal Data on Customer’s behalf, solely to provide the Services and to comply with applicable law:
- Account identifiers — email address, name (if provided), workspace membership, authentication credentials.
- Chat content — user-provided text, uploaded files, images, and generated responses within Customer’s account or workspace.
- Usage telemetry — anonymized metrics on feature usage, error rates, and performance for the purpose of maintaining Service quality.
- Billing metadata — payment tokenization identifiers and last-four card digits (card details themselves are Processed exclusively by Stripe, not by LADLE).
Processing occurs only for: (a) delivery of the Services, (b) billing and account administration, (c) compliance with legal obligations, (d) generation of the monthly impact-reporting artifact, and (e) responding to Data Subject requests.
No training use. LADLE does not use Customer chat content to train any machine-learning model. Inference is performed by our upstream provider (Anthropic) under their standard commercial API terms, which prohibit training on Customer content. Those terms permit Anthropic to retain inputs and outputs for a limited period for abuse monitoring; LADLE has not executed a zero-data-retention addendum with Anthropic as of the version date of this DPA, and will amend this section if and when one is executed.
4. Sub-processor Authorization
Customer authorizes LADLE to engage the Sub-processors listed at /legal/subprocessors for the purposes described therein. LADLE will notify Customer of any intended addition or replacement of Sub-processors at least thirty (30) days in advance via (a) email to the Customer’s designated privacy contact and (b) a public update at the subprocessors page. Customer has the right to object to any proposed change on reasonable grounds relating to data protection; if the parties cannot resolve the objection within thirty (30) days, Customer may terminate the affected Services without penalty.
LADLE enters into written agreements with each Sub-processor imposing data protection obligations no less protective than those in this DPA.
4a. Workspace Data Model (Team Accounts)
Where Customer is a workspace (team), the following provisions apply in addition to the general processing terms above:
- Shared workspace resources — Two categories of data are visible to every active member of the workspace: workspace instructions (admin-authored system-prompt directives) and workspace knowledge (admin-authored shared text notes). Both are used for the sole purpose of shaping the AI assistant’s behavior for chats inside the workspace. Neither is Processed for any other purpose.
- Owner-only chat content — the "chat privacy invariant."Every chat and its message contents are owned by exactly one Data Subject (the chat author). A workspace admin cannot read the content of another member’s chats. A member cannot read another member’s chats. This is enforced at the database layer via row-level security policies, not by application-level access control alone. The chat privacy invariant survives role changes: a former admin who is demoted does not gain retroactive access; a promoted member does not gain access to chats sent before promotion.
- Attribution for impact reporting — Chats sent inside a workspace are tagged with the workspace identifier so LADLE can produce the monthly impact-reporting artifact (meal counts and dollar totals attributable to the workspace). The tag is metadata only; the tag does not grant read access to the chat content.
- Membership visibility — Active members of a workspace may enumerate other active members (email + display name + role). This is the roster functionality necessary to make invitations and removals possible. Removed members are not enumerable by remaining members.
- Effect of workspace deletion — When a workspace is closed, chats belonging to former members remain associated with the individual Data Subject and can be exported or deleted via the individual Settings pane. Workspace-scoped resources (instructions, knowledge, membership records) are retained for 30 days in a soft-deleted state to permit reactivation, then irrecoverably deleted.
5. Security Measures
LADLE implements and maintains appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include:
- Encryption in transit (TLS 1.2 or higher) for all Personal Data.
- Encryption at rest (AES-256) for stored Personal Data in production databases and backups.
- Multi-factor authentication required for all administrative access to production systems.
- Principle of least privilege: production access limited to two named personnel, both under written confidentiality obligations.
- Audit logging of all administrative access; logs retained for twelve (12) months.
- Regular vulnerability scanning of production infrastructure and dependencies.
- Documented incident response plan reviewed at minimum annually.
- Multi-tenant isolation at database and API layers to prevent cross-Customer data access.
- Row-level security policies enforce the chat privacy invariant described in Section 4a — the database itself refuses cross-user reads of chat content, so an application-layer bug cannot bypass the isolation.
See /security for the current technical posture in detail.
6. Breach Notification
LADLE will notify Customer without undue delay, and in any event within seventy-two (72) hours, of becoming aware of a Personal Data Breach affecting Customer’s Personal Data. The notification will describe: (a) the nature of the Breach, (b) the categories and approximate number of Data Subjects affected, (c) the likely consequences, (d) measures taken or proposed to address the Breach and mitigate its adverse effects, and (e) contact information for the LADLE representative handling the incident.
LADLE will provide a written post-incident report within thirty (30) days of the initial notification, including root-cause analysis, remediation completed, and preventive measures adopted.
7. Data Subject Rights
Taking into account the nature of the Processing, LADLE will assist Customer, insofar as possible, in fulfilling Customer’s obligations to respond to Data Subject requests under Applicable Data Protection Laws, including rights of access, rectification, erasure, restriction, portability, and objection.
Where a Data Subject exercises rights directly against LADLE via the LADLE application (e.g., account deletion via Settings), LADLE will fulfill the request within thirty (30) days and notify Customer’s designated privacy contact of the request category (not the Data Subject’s identity, unless the request originated from a Customer organization member and Customer is entitled to know).
8. Deletion and Return
Upon termination of the Agreement or Customer’s written request, LADLE will, within thirty (30) days, delete or return all Personal Data to Customer, at Customer’s election. LADLE may retain Personal Data to the extent required by applicable law, provided such retained data remains subject to the confidentiality and security obligations of this DPA.
Data retained solely for finance-record purposes (e.g., billing reconciliation) is retained for seven (7) years and deleted at that point without further notice.
9. International Data Transfers
LADLE processes Personal Data in the United States (primarily) and Canada. Where Personal Data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a jurisdiction not deemed adequate under the GDPR, the transfer is governed by the European Commission’s Standard Contractual Clauses (Module Two: Controller to Processor) incorporated into this DPA by reference and included as Annex A on execution of an enterprise-negotiated version of this DPA.
LADLE does not currently offer a data residency guarantee for EU-only or Canada-only storage of Personal Data. Customers with hard residency requirements should evaluate this posture before executing this DPA.
10. Audits
LADLE will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA. Upon reasonable prior written notice (not less than thirty (30) days), Customer may audit LADLE’s compliance with this DPA no more than once in any twelve-month period, at Customer’s cost, subject to LADLE’s reasonable security and confidentiality requirements.
11. Precedence
In the event of a conflict between this DPA and the Agreement (including the Terms of Service), this DPA prevails with respect to the Processing of Personal Data.
12. Contact
All notices under this DPA to LADLE should be directed to legal@ladle.chat. Data Subject requests may be directed to privacy@ladle.chat.
THIS DOCUMENT IS A GOOD-FAITH TEMPLATE INTENDED TO GIVE CUSTOMERS A CLEAR VIEW OF LADLE’S DATA-PROCESSING COMMITMENTS. IT IS A DRAFT AND HAS NOT BEEN REVIEWED BY OUTSIDE COUNSEL FOR EVERY JURISDICTION IT MAY BE EXECUTED IN. ENTERPRISE CUSTOMERS REQUIRING A NEGOTIATED, COUNSEL-REVIEWED VERSION SHOULD EMAIL LEGAL@LADLE.CHAT.