The addendum.
Between the customer and Procloud Labs, Inc., under the Etch Subscription Agreement.
1. Scope and roles
This addendum applies when Procloud Labs, Inc. ("we") processes personal data contained in customer data (as defined in the Subscription Agreement) for the customer ("you") in providing Etch. For that personal data you are the controller (or a processor acting for your own client) and we are your processor (or subprocessor). It covers the EU and UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act and similar laws ("data protection law"). Personal data we hold as a controller, such as the account details of the people who use Etch and our customer records, is covered by our Privacy Policy.
2. Processing only on your instructions
We process the personal data only to provide Etch to you, as set out in the Subscription Agreement, this addendum and Annex I, and on your other documented instructions, including what you and your users do in Etch. Using Etch's settings is giving an instruction. If we believe an instruction breaks data protection law, we'll tell you. If the law requires us to process it otherwise, we'll tell you first unless the law forbids it.
3. Our people
Only people who need to, to provide or support Etch, have access to the personal data, and they are bound by confidentiality. Administrative access to production is limited to named people, uses two-factor sign-in and is logged.
4. Security
We maintain the technical and organizational measures in Annex II, which you agree give an appropriate level of security for the risk. We may improve them, but won't reduce the overall level of protection during your subscription.
5. Subprocessors
You give us general authorization to use subprocessors. The current ones, what each does and where, are listed in Annex III. We'll tell the account owner by email at least 30 days before adding or replacing one. If you object on reasonable data-protection grounds, tell us within that time and we'll work with you to find a solution; if we can't, you may end the subscription before the change takes effect. Each subprocessor is bound by a written agreement with data-protection obligations at least as protective as this addendum, and we remain responsible for its performance.
6. Helping you with people's requests
Etch lets you answer most requests yourself: admins can see, correct and remove members; outside approvers and other content can be edited or removed; and the account owner can download everything in the account (Admin → Account data) or delete the account. If someone sends us a request about personal data we hold for you, we'll pass it to you and won't answer it ourselves unless you ask. We'll give you reasonable further help where you need it.
7. Personal data breaches
We'll notify you without undue delay after becoming aware of a personal data breach affecting the personal data, with what we know about its nature, the likely consequences and what we're doing about it, and update you as we learn more. We'll help you meet your own obligations to notify authorities and people. Notifying you is not an admission of fault.
8. Assessments and consultations
We'll give you the information about Etch you reasonably need for a data protection impact assessment or a consultation with a supervisory authority.
9. Return and deletion
At any time, and until the account is deleted, the account owner can download all customer data in open formats (CSV, JSON Lines and HTML). When a subscription ends, the account locks and is deleted 90 days after the plan ended, after a warning email at least 14 days before; the account owner can also delete it sooner (7 days after asking). Deleted data is gone from our backups within 30 days. We keep nothing else, except a record that the account existed and which Stripe customer it was, and what the law requires us to keep.
10. Information and audits
We'll make available the information needed to show we meet this addendum: on request, once a year, we'll answer a reasonable security questionnaire and share our security documentation, and our SOC 2 report once it is issued, under confidentiality. Where that isn't enough to meet data protection law or a regulator's demand, you may audit us, at your cost, with at least 30 days' notice, during business hours, by a qualified auditor bound by confidentiality, at most once a year unless after a breach.
11. International transfers
Etch is hosted in the United States. Where personal data from the EEA, the UK or Switzerland is transferred to us, or by us to a subprocessor, in a country without an adequacy decision, the European Commission's Standard Contractual Clauses (Decision 2021/914) apply and are incorporated by reference: Module Two (controller to processor) or Module Three (processor to processor), as fits. For them: clause 7 (docking) applies; under clause 9(a), option 2 (general written authorization, with the 30 days' notice in §5); the optional wording in clause 11 does not apply; under clauses 17 and 18, Irish law and the courts of Ireland; Annex I of the clauses is Annex I here, Annex II is Annex II and Annex III is the subprocessor list. For the UK, the International Data Transfer Addendum issued by the ICO applies, with Table 4 allowing either party to end it; for Switzerland, the clauses apply with the FADP as the governing data protection law and the Swiss FDPIC as the competent authority. Where a recipient is certified under the EU–US Data Privacy Framework, we may rely on that as well.
12. California
For personal information under the CCPA we are a service provider. We won't sell or share it, or keep, use or disclose it outside our direct business relationship with you or for any purpose other than providing Etch, or combine it with personal information from elsewhere except as the CCPA allows. We'll tell you if we can no longer meet these obligations.
13. Liability and precedence
Each party's liability under this addendum is subject to the limits in the Subscription Agreement, except where data protection law doesn't allow that. If they conflict: the Standard Contractual Clauses prevail over this addendum, and this addendum prevails over the Subscription Agreement on data protection.
Annex I: the processing.
| Data exporter | The customer, as identified in its Etch account; contact: its account owner. Role: controller (or processor for its own client). |
|---|---|
| Data importer | Procloud Labs, Inc., 4444 2nd Ave, Detroit, MI 48201, United States; [email protected]. Role: processor. |
| People the data is about | The customer's users; outside approvers it adds; people named in content it puts into Etch, such as senders of archived marketing emails and seed contacts it creates for testing. |
| Kinds of personal data | Names, work email addresses, roles and permissions; records of who did what in the account; personal data the customer includes in campaign records, briefs, comments, sign-offs, templates and archived emails. Etch is not built to hold email recipient lists, and the customer agrees not to put them in. |
| Special categories | None intended. The customer agrees not to put special-category data into Etch. |
| How often | Continuously, for the length of the subscription. |
| Nature of the processing | Hosting, storing, organizing, displaying, searching, exporting and deleting; sending service emails; reading from services the customer connects, on its behalf, and writing to them where the customer asks (creating Jira issues; the daily export to the customer's own storage); receiving the emails sent to its seed addresses and Vault addresses; and, only if the customer switches them on, sending the parts each AI feature needs to the AI provider (never recipient data, email bodies, email addresses, passwords or keys). |
| Purpose | Providing Etch to the customer under the Subscription Agreement. |
| How long | For the subscription, then as in §9: deleted 90 days after a plan ends (or 7 days after the owner asks), and from backups within 30 days after that. |
| Subprocessors | As listed in Annex III, for the services and locations given there. |
| Competent supervisory authority | The authority of the EU member state where the customer is established or, if it has no establishment in the EU, of the member state where its representative is; for the UK, the ICO; for Switzerland, the FDPIC. |
Annex II: security measures.
- Encryption. TLS for all traffic; data encrypted at rest by Google Cloud; keys customers give Etch for their platforms sealed with AES-256-GCM under a key held in Google Secret Manager; API keys, sign-in sessions, codes and share links stored only as one-way fingerprints.
- Separation of customers. Every record belongs to one account and one workspace, and the database itself enforces it (row-level security), not only the application.
- Access in Etch. Roles per account, workspace and module (Owner, Admin, Editor, Viewer); two-factor sign-in, required for every account, or company single sign-on (SAML 2.0) for domains the customer proves, where the customer's provider gives the second factor; an account can limit how long sessions last; people can sign out of every device. Outside approvers use links that expire after 7 days and give no other access.
- Our access. Production access limited to named people, with two-factor sign-in, logged. Our staff console shows counts and account settings, not customer content, and every staff action is logged.
- Records of what happened. An append-only audit log in each account, kept as long as the account, of who did what; application logs never contain email addresses, links, codes or keys.
- Availability and recovery. Daily backups kept 30 days and 7 days of point-in-time recovery; restores rehearsed; alerts when the app or database stops answering or struggles; per-visitor request limits at the edge.
- Secure development. Every change reviewed and tested before release, including database tests of the access rules; secrets never in code; untrusted email HTML shown only in a locked-down frame.
- Minimizing data. No recipient lists; only aggregate send results from email platforms; AI features off until switched on and limited as in Annex I.
- Deletion. As in §9, with deletion of everything an account owns done in one transaction and checked by tests that fail if a new kind of record would be missed.
- Vulnerability reports. [email protected], acknowledged within 2 business days.