Data Processing Addendum

1. Purpose of this addendum

This Data Processing Addendum ("DPA") supplements the Zeerus Terms of Service and applies whenever your agency ("Controller", "you") uses Zeerus to store or process personal information about your own clients. In that relationship, your agency is the controller of your clients' personal information, and Saayjon Ranjan, operating as Zeerus("Zeerus", "Processor") processes it solely on your behalf and your documented instructions. Where these terms conflict with the Terms of Service on this specific point, this DPA governs.

2. Subject matter, duration, and nature of processing

Zeerus processes personal information for the duration of your subscription, for the sole purpose of providing the Service: storing, displaying, and helping you act on your book of business (client records, policy records, reminders, and related workflow). Processing ends when your account is closed and data is deleted per Section 8.

3. Categories of data subjects and personal data

Data subjects: the clients and prospective clients of your agency.

Categories of personal data processed:

• Contact information: name, email, phone, mailing address;
• Dates: birthday, anniversary;
• Insurance policy information: carrier, policy number, type, premium, renewal/review dates;
• Commission information tied to a client's policies;
• Notes and activity history your agency records about the client;
• CASL consent status for automated email communication.

Zeerus does not intentionally process special categories of personal information (health data, etc.) beyond what your agency chooses to enter in free-text notes.

4. Processor obligations

Zeerus agrees to:

• Process personal information only on your documented instructions (as reflected in how the Service operates), unless required otherwise by law;
• Ensure personnel with access to personal information are subject to confidentiality obligations;
• Implement appropriate technical and organizational security measures, including tenant-isolated database access controls (row-level security), encryption in transit, and hashed credential storage;
• Assist you in responding to data subject access, correction, and deletion requests concerning your clients, to the extent the Service's existing tools don't already let you handle these directly;
• Notify you without undue delay after becoming aware of a personal data breach affecting your clients' information;
• Make available the information reasonably necessary to demonstrate compliance with this DPA.

5. Sub-processors

You authorize Zeerus to engage the following sub-processors to provide the Service:

• Supabase: database, authentication, file storage (primary data store, hosted in the ca-central-1 / Canada region);
• Vercel: application hosting;
• Stripe: subscription billing (processes your agency's payment details, not your clients' personal information);
• Resend: delivery of transactional and reminder emails to your clients;
• Sentry: error monitoring, hosted in the EU. Sentry may incidentally capture your clients' personal information if it appears in application error reports (for example, in a stack trace or request payload at the moment of a crash).
• Google: only engaged for a specific team member who individually connects their Google Calendar. Google receives that team member's own account email and calendar free/busy times, plus (when a client or lead books a slot through that team member's booking page) the booker's name and any notes they submitted, embedded in the calendar event Zeerus creates. No other team member's or client's data is shared with Google as a result of one team member connecting their own calendar.

Actual data-processing location for each sub-processor: Supabase: Canada (ca-central-1); Vercel: not pinned to a single region (observed running in both Canada and the United States); Stripe: United States (Stripe, LLC, for customers in the Americas, per Stripe's own disclosures); Resend: United States (account data and metadata; the send itself can route through a regional AWS location, but the underlying account data does not); Sentry: European Union (Germany); Google: United States (Google LLC), as part of Google's own global infrastructure. Zeerus will notify you before adding a new sub-processor that will process your clients' personal information, giving you the opportunity to object.

6. International data transfers

Zeerus's primary database is hosted in Canada, but as detailed in Section 5, several sub-processors (Stripe, Resend, Sentry, and, for agencies that opt into it, Google, plus Vercel's application-hosting layer) do process data outside Canada as part of their normal operation, not as an exception. Zeerus relies on each sub-processor's own compliance safeguards for these transfers.

7. Audit rights

On reasonable request, no more than once per 12-month period, Zeerus will provide you with documentation reasonably necessary to demonstrate compliance with this DPA. Zeerus does not currently offer on-site or third-party audits. This is standard for a company at this stage, and most SaaS DPAs limit audit rights the same way, but revisit this if a large customer specifically requires it as a contract condition.

8. Return and deletion of data

On termination of your subscription, Zeerus retains your data for 30 days to allow export, then deletes it, except where retention is required by law (for example, billing records) or preserved in the account's audit log as described in the Privacy Policy.

9. Liability

Liability under this DPA is subject to the limitations set out in the Terms of Service.

10. Term and governing law

This DPA remains in effect for as long as Zeerus processes personal information on your behalf, and is governed by the same law as the Terms of Service.

11. Contact

Questions about this DPA can be sent to support@zeerus.app.