Data Processing Addendum
Last updated: August 9, 2026
When this addendum applies
This Data Processing Addendum (DPA) forms part of the Signal Loom Terms of Service when a virtual assistant or agency account uses a client workspace. The Signal Loom account holder is the Customer. Depending on the Customer's arrangement with the seller, the Customer acts as a controller or processor and Signal Loom acts as its processor or subprocessor for client-workspace data.
Instructions and purpose
Signal Loom processes client-workspace data only to provide, secure, maintain, and support the service described in the Terms, and according to the Customer's use and documented instructions. Signal Loom will inform the Customer if an instruction appears to violate applicable data-protection law, unless the law prevents us from doing so.
Customer responsibilities
The Customer must have a lawful basis and the seller's authorization for the data it requests, uploads, or asks Signal Loom to process. The Customer decides which people may access each client workspace and must use the service's access controls and deletion tools responsibly.
Confidentiality and security
Signal Loom limits access to people and providers who need it to operate the service and who are bound by confidentiality obligations. We use access controls, encrypted transport, protected object storage, one-time seller upload links, and operational backups appropriate to the nature of the service. We review these measures as the product changes.
Subprocessors and international transfers
The Customer gives general authorization for the providers needed to operate Signal Loom. Providers that may process client-workspace data currently include Hetzner for EU application and database hosting, Cloudflare R2 for object storage, Sentry for error monitoring, and Google Gemini when the Customer chooses a Premium Visual Signals review. Clerk, Stripe, Brevo, and Google Analytics support account, billing, email, or site-usage functions and are not intentionally sent seller CSV contents.
Each subprocessor must protect the data under obligations appropriate to the work it performs. Some providers are established outside the European Economic Area. Where required, transfers rely on an adequacy decision, approved standard contractual clauses, or another lawful safeguard. We will give reasonable advance notice through the account email or an in-product notice and update this section before appointing a new provider that processes client-workspace data. A Customer with a reasonable data-protection objection may contact us before continuing to use the affected feature.
Requests, incidents, and assistance
Taking account of the nature of the processing, Signal Loom will reasonably assist the Customer with data-subject requests, security obligations, impact assessments, and regulator inquiries relating to client-workspace data. We will notify the Customer without undue delay after becoming aware of a personal-data breach affecting that data and provide available information needed for the Customer's response.
Return, deletion, and review
The Customer may export available results and permanently delete an archived client workspace. Permanent deletion removes the workspace from the active service; backup copies expire under the backup schedule, currently within seven days, unless law requires longer retention. On reasonable written request, Signal Loom will provide information needed to demonstrate compliance with this DPA and cooperate with a proportionate review, subject to confidentiality and security limits.
Processing details
- Subject and duration: client-store analysis for as long as the workspace is retained.
- Nature and purpose: receiving TPT exports, producing store guidance, retaining snapshots and actions, and providing related support and security.
- Data: TPT store-performance exports, derived analysis, public listing material selected for review, and workspace activity records.
- People: the seller, VA or agency users, and any individuals whose information the Customer lawfully includes in uploaded material.
Contact
Questions or requests about this DPA: support@graphene-edu.com. See the Privacy Policy and Terms of Service for the wider service terms.