This addendum sets processing terms for project materials, contacts, and review records that a customer organization enters into ProofFlow. Processing features are limited to those enabled in the service.
1. Roles and processing
The customer organization acts as controller for project, reviewer, and employee information. Office Hasegawa acts as processor to provide ProofFlow. Office Hasegawa may act as an independent controller for account, billing, and service-security information.
- Purpose and duration
- Provide accounts, projects, file versions, reviews, approval records, and notifications during the subscription and handle termination.
- People
- Customer users and employees, customer contacts, and reviewers.
- Data
- Names and email addresses, project information, file names and hashes, PDFs and images, comments, annotations, decisions, review links, notification message content and delivery status, and access and audit records (including access times, IP-derived hashes, and browser information).
2. Instructions, security, and incidents
Office Hasegawa will process data only on documented instructions, bind authorized personnel to confidentiality, and use appropriate encryption, access restrictions, and other safeguards. If we become aware of a breach, we will notify the customer without undue delay and assist with investigation, impact assessment, and required notice. We will reasonably assist with individual requests, regulatory communications, audits, and impact assessments.
3. Subprocessors
ProofFlow uses Cloudflare (Workers, D1, R2, Queues, Email Service, and Container) and Stripe (billing). We do not specify or guarantee a fixed data-location region. Email Service processes recipients, message content, and delivery information. Email previews are disabled for ProofFlow; Cloudflare’s applicable terms and settings govern retention of delivery and log information. When the safety scanner is available, ClamAV runs in a private Cloudflare Container to scan uploaded files. Files are processed in that Container for scanning; we do not use a separate external scanning provider. Uploads are paused if the scanner is unavailable. We will update the subprocessor schedule before adding one. We will impose applicable data-protection obligations on subprocessors and remain responsible for their performance. We will give 30 days’ advance notice of changes and allow reasonable objections.
4. International transfers
Each party is responsible for transfer obligations that apply to it. Transfers from the EU/EEA or United Kingdom to Japan, the United States, or another destination may require appropriate contractual clauses or another transfer mechanism. Where required, the parties must enter into applicable standard contractual clauses or other lawful safeguards. This addendum alone may not satisfy every region’s transfer requirements.
5. Termination, deletion, and audit
Before termination, the customer can use export features available in the service to obtain needed data. An organization deletion request can be canceled for at least 30 days and may be scheduled after the paid period ends. When deletion runs, active D1 organization data and R2 files are removed. Account deletion revokes sign-in and may leave an anonymized account record for audit attribution. D1 recovery history may retain deleted data for up to 30 days and is not accessible through ProofFlow; the R2 file bucket has no independent backup. We may retain information only where and for as long as law requires. We will reasonably provide compliance information and cooperate with audits.