This Data Processing Addendum ("DPA") is part of the Terms of Service between Getss LLC ("we", "us") and the customer that uses Easyflow ("customer", "you"). It applies whenever we process personal information contained in customer content, and it is effective as of 2026-10-11. If this DPA conflicts with the terms on the processing of personal information, this DPA controls.
1. Definitions
- Customer personal information: personal information contained in customer content, meaning everything the customer's workspace holds, including what people outside the customer's company submit to it.
- Data protection laws: the United States federal and state privacy laws that apply to the processing, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").
- Security incident: a confirmed breach of security leading to the unauthorized or unlawful loss, alteration, disclosure of or access to customer personal information.
2. Roles
The customer is the controller (a "business" under the CCPA) of customer personal information, and we are its processor (a "service provider" under the CCPA). The customer is responsible for the lawfulness of the processing, the notices and consents it needs, and its instructions.
3. Scope and instructions
| Subject matter | Providing Easyflow under the terms |
| Duration | The term of the subscription, plus the deletion period in section 9 |
| Purpose | Running the customer's processes, sending their notifications and emails, producing documents and, when a manager asks, the AI assistant |
| Data subjects | The customer's users, and the employees, clients, vendors and other people involved in its processes, including people outside the company who submit forms, fill in guest steps or follow requests |
| Types of data | Names, email addresses, form values, files, comments, signatures (typed name, acceptance, time, user and email, and a salted hash of the IP address), photos with date, time and, when a process requires it, GPS location, and audit records |
We process customer personal information only on the customer's documented instructions. Those instructions are the terms, this DPA, and how the customer uses and configures Easyflow, such as event emails, webhooks, sharing and the AI assistant. We will tell the customer if we believe an instruction violates data protection laws.
4. Confidentiality of personnel
Everyone we authorize to process customer personal information is bound by confidentiality and has only the access their role requires. Administrative access across workspaces is limited to our system administrators.
5. Security measures
We maintain technical and organizational measures designed to protect customer personal information, including:
- HTTPS for all traffic;
- passwords hashed with bcrypt and never stored in plain text; users set their own passwords through one-time links;
- workspace isolation enforced in the data layer, with every query scoped to the workspace;
- permissions checked on the server for every action;
- fields hidden in a step stripped on the server from pages, PDFs and emails;
- an audit log of every change, and a hash-chained timeline for each request so tampering is detectable;
- email action links that are signed, scoped to one purpose, bound to the step, stop working when the step moves on, and open a confirmation page before acting;
- rate limits on public endpoints;
- signed webhooks, with private network addresses blocked;
- inactive workspaces blocked from the API, realtime updates, schedules and public links.
Our security overview describes them in more detail. We may update them as long as the overall protection is not reduced.
6. Subprocessors
The customer authorizes us to engage the following subprocessors:
| Subprocessor | Purpose | Location |
|---|---|---|
| Oracle Cloud Infrastructure | Application and database hosting | United States |
| DigitalOcean (Spaces) | File storage | United States |
| Resend | Email delivery | United States |
| OpenAI | AI assistant, only when a manager uses it | United States |
We bind each subprocessor to written data protection obligations that are no less protective than those in this DPA, and we remain responsible for its performance.
Before a new subprocessor starts processing customer personal information, we will update this list and notify the workspace owner by email. The customer may object on reasonable data protection grounds within the notice period. If we cannot resolve the objection, the customer may end its subscription and receive a refund of prepaid fees for the unused period.
7. Assistance with data subject requests
The customer can search its workspace and export requests to CSV and PDF directly in Easyflow. If we receive a request from a person about customer personal information, we will forward it to the customer and will not respond ourselves, except to direct the person to the customer, unless the law requires otherwise. We will provide reasonable assistance with requests the customer cannot handle on its own in the app, such as removing a person's information from completed requests.
8. Security incidents
We will notify the customer without undue delay, and in any case within 72 hours of becoming aware of a security incident affecting customer personal information. The notice will describe, as far as we know at that time, the nature of the incident, the data and people affected, its likely consequences and the steps we are taking. We will keep the customer updated and cooperate reasonably with its own obligations. Notice of an incident is not an admission of fault.
9. Deletion and return
During the subscription, the customer can export requests to CSV and download requests and generated documents as PDF. When the customer asks us to close its workspace, we delete its content within 30 days, except where the law requires us to keep it. Anything we must keep remains protected by this DPA.
10. Audits
On written request, no more than once a year unless a security incident or a regulator requires it, we will answer reasonable information requests, such as security questionnaires, about our compliance with this DPA. These requests do not extend to information about other customers or that would compromise our security.
11. CCPA service provider terms
We will not:
- sell or share customer personal information, as those terms are defined in the CCPA;
- retain, use or disclose it for any purpose other than providing Easyflow to the customer under the terms, or as the CCPA otherwise permits;
- retain, use or disclose it outside our direct business relationship with the customer;
- combine it with personal information we receive from others or collect ourselves, except as the CCPA permits.
We will comply with the obligations the CCPA places on service providers, provide the level of privacy protection it requires, and notify the customer if we can no longer meet them, in which case the customer may take reasonable steps to stop and remediate unauthorized use. We understand and will comply with these restrictions.
12. Other laws
This DPA covers United States data protection laws. If you need to process personal information subject to other laws, such as the GDPR, contact privacy@easy.wf first.
13. Contact
- Company: Getss LLC
- Privacy questions: privacy@easy.wf