This Addendum forms part of the Terms of Service between A1 AI Agents Inc. (“we”, “us”) and the Customer, and applies where we process personal information on the Customer’s behalf through GetSimpleSign. There is nothing to sign and nothing to request. Capitalised terms not defined here have the meaning given in the Terms.
1Roles
The Customer is the organization accountable for the personal information it puts into the Service and for the instructions it gives. We act as its service provider and process personal information only to provide the Service and on the Customer’s documented instructions, including those given through the ordinary use of the Service’s features. The Terms and this Addendum are the Customer’s complete documented instructions. If we believe an instruction breaches applicable privacy law, we will tell the Customer.
2Scope and duration
3Confidentiality
We limit access to personal information to personnel who need it to provide, secure, or support the Service, and those people are bound by confidentiality obligations that survive the end of their engagement.
4Security
We maintain the safeguards described in Section 10 of our Privacy Policy, including role-based workspace access, single-use recipient-specific signing links, encryption in transit, private document storage, validation and scanning of uploaded files, controlled backups, activity logging and monitoring, and assessment of service providers. We will not materially reduce these safeguards during the term.
5Sub-processors
The Customer authorises the sub-processors listed on our sub-processors page. We impose data-protection obligations on each of them no less protective than this Addendum, and remain responsible for their performance. We will give at least 30 days’ notice before a new sub-processor begins processing. If the Customer objects on reasonable data-protection grounds within that period and we cannot offer an alternative, the Customer may terminate the affected part of the Service and receive a refund of prepaid unused fees.
6Location of processing
Account and workspace records, agreement documents, and encrypted database backups are stored in Canada, in the Amazon Web Services Canada Central region. Email delivery and payment processing are performed by providers in the United States, so information handled by them may be subject to that jurisdiction’s laws, including lawful access by its authorities. Our sub-processors page states where each provider processes.
7Assistance with individuals’ requests
If we receive a request from an individual about personal information we process for the Customer, we will not respond to it substantively ourselves except to acknowledge it and direct them to the Customer, unless the Customer instructs otherwise or the law requires otherwise. We will tell the Customer without undue delay and provide reasonable assistance in responding — including access, correction, deletion, and providing information in a structured, commonly used technical format.
8Breach notification
If we become aware of a breach of security safeguards affecting the Customer’s personal information, we will notify the Customer without undue delay and in any event within 72 hours of confirming it, with the information the Customer needs to meet its own reporting obligations, and will provide reasonable further assistance. We will keep the records the law requires.
9Deletion and return
For 30 days after a workspace is closed the Customer may export its agreements and completion records or reactivate the workspace. After that, we delete or de-identify personal information in accordance with the retention periods in our Privacy Policy, except where we are required to keep it by law, legal hold, or an unresolved dispute, or where it persists in backups until those backups expire on their ordinary cycle.
10Demonstrating compliance
We will provide the information reasonably necessary to demonstrate compliance with this Addendum, including answering a written security questionnaire once in any 12-month period. We do not currently hold a SOC 2 or ISO 27001 attestation and do not claim one; we will say so plainly rather than imply otherwise, and we will tell Customers if that changes.
11Restrictions on our own use
We do not sell personal information, use it for advertising, or use documents, templates, signatures or recipient information to train, fine-tune, or evaluate any artificial-intelligence model. We may create aggregated, de-identified information as described in Section 8 of the Terms.
12Precedence
If this Addendum conflicts with the Terms in relation to the processing of personal information, this Addendum controls.