How we look after your team's records for you.

This addendum is between the business that uses CleanCleaver ("the customer") and Praiseworthy Apps LLC (9241 January Dr, Las Vegas, NV 89134). It is part of the terms of service. Where they differ about personal data, this addendum wins.

It covers the personal data the customer keeps in CleanCleaver about its own work and people (its "records"). For those records the customer is the controller and we are its processor (and, under US state laws, its service provider). For our own accounts, billing, emails and website we are a controller; the privacy policy covers that.

1. Only on your instructions. We process the records only to run CleanCleaver for you, as the terms, this addendum and your settings say, unless the law makes us do otherwise (then we tell you first, where the law allows).
2. People bound to confidence. Only our staff who need to, on a reviewed access list, can see your records, and they are bound to keep them confidential.
3. Security. We keep the measures in Annex 2 and may improve them; we will not make them weaker.
4. Help with your duties. We help you answer your people's requests, assess risk and talk to authorities. If one of your workers asks us directly, we pass it on to you within 5 days and do not answer it ourselves.
5. Not ours to sell. We do not sell or share your records, use them for our own purposes outside running the service, or combine them with other data, except as the law allows a service provider (for example, to keep the service secure).

If we become aware of a breach of your records, we tell you without undue delay and within 48 hours, with what we know: what happened, the people and records involved, the likely effects and what we are doing. We keep you posted as we learn more, and give you what you need to tell your people and any authority. Our incident register tracks each legal clock (in Europe and the UK, 72 hours for you to tell the authority; each US state's own rules) so nothing is missed.

At any time the owner can download everything the business has stored, as one file. When the owner deletes the business, we wait 7 days (the owner can cancel), then erase every record, person and photo, and keep one line that the business existed and was deleted. Backups hold deleted data for up to 5 days. We keep nothing else unless the law makes us, and then only for that.

Once a year, on request, we answer your written security questions and share our security documents and our evidence pack (the list of our controls and the evidence for each). We have no outside security audit report yet and do not claim one. An on-site or third-party audit is possible after a breach, or when an authority asks, on reasonable notice and at your cost.

Your records are kept in the United States. Where European or UK law applies, the Standard Contractual Clauses (Module 2, controller to processor) and the UK Addendum are part of this addendum, with Annex 1 as their description of the transfer and Annex 2 as their security measures.