Data Processing Addendum

Last updated: October 18, 2026

1. Roles

For room content, the customer is the controller and New Plains LLC, an Oklahoma limited liability company, is the processor. For billing and account data about organizers, we act as an independent controller as described in the Privacy Policy.

2. Documented instructions

We process room content only on the customer's documented instructions, which are these terms, the Terms of Service, and the customer's use of the product settings. We tell the customer if we believe an instruction breaks the law.

3. Subprocessors

• Vercel: hosting.
• Upstash: database for room data.
• Resend: sending invitation and account email.
• Stripe: billing and payments (account and billing data only).
• Openrouter: AI processing, Facilitator plan only, when the agent is on.

We will tell customers before adding or replacing a subprocessor with at least 14 days' notice by email.

4. Security measures

• Signed, HttpOnly session cookies.
• Separate keys for each room.
• Rate limits on sign-in and join attempts.
• Encrypted transport (HTTPS).

5. Personal data breach

We will notify the customer without undue delay and within 72 hours after we become aware of a breach affecting their room content, with the information we have about it.

6. Confidentiality and staff

People who can access room content are bound by confidentiality duties and access it only as needed to run the service.

7. Deletion on termination

When the customer deletes a room, we delete its data. When the agreement ends, we delete remaining room content on request, and backups expire within 30 days.

8. Audits

On reasonable request, we will give the customer the information needed to show we meet this addendum, and we will cooperate with reasonable audits. Once every 12 months, with 30 days' notice, at the customer's cost.

9. International transfers

We store and process room content in the United States. If customer personal data is transferred out of the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, the European Commission's Standard Contractual Clauses (Module 2: Controller to Processor) and the UK International Data Transfer Addendum apply and are incorporated into this addendum by reference.

10. Contact

Questions about this addendum: support@virtualoffsite.com.