Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service between [LEGAL ENTITY NAME] ("Cherry", the "Processor") and the business that uses the Cherry Service ("Customer", the "Controller"). It applies whenever Cherry processes personal data on the Customer's behalf. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data.

1. Definitions

• Customer Personal Data: personal data in Customer Data that Cherry processes on the Customer's behalf, such as data about the Customer's clients and team members.
• Data Protection Laws: all laws that apply to the processing, including, as applicable, Argentina's Law No. 25,326 and Decree No. 1558/2001, the California Consumer Privacy Act as amended (CCPA), and other US state privacy laws.
• Sub-processor: a third party engaged by Cherry to process Customer Personal Data.
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
• Terms such as "controller", "processor", "service provider", "business" and "consumer" have the meanings given in the Data Protection Laws.

2. Roles

The Customer is the controller (or "business") and Cherry is the processor (or "service provider" / "contractor") of Customer Personal Data. Cherry is a controller only for the account data of the Customer's users, as described in the Privacy Policy.

3. Details of the processing

4. Cherry's obligations

Cherry will:

1. process Customer Personal Data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use of the Service, and tell the Customer if it believes an instruction violates the law;
2. not use Customer Personal Data for any other purpose, including Cherry's own marketing, profiling or the training of AI models, and not combine it with data from other sources except as needed to provide the Service;
3. not disclose it to third parties except Sub-processors under section 6 or when required by law (in which case Cherry will notify the Customer unless legally prohibited);
4. ensure that people authorized to process it are bound by confidentiality obligations that survive the end of their engagement;
5. implement the security measures in Annex 1;
6. assist the Customer, taking into account the nature of the processing, with data subject requests, security, impact assessments and consultations with authorities.

4.1 Cherry staff access to AI assistant conversations

When the Customer uses Cherry AI, Cherry stores the assistant's conversations for a limited period after their last activity and then deletes them. Authorized Cherry staff may open a conversation only for one of these purposes: (a) support the Customer asked for; (b) investigating a Security Incident, an outage or a complaint; or (c) reviewing the quality of the assistant's answers to improve its instructions and tools, as part of maintaining the Service. Each access requires stating the purpose, is recorded in an audit log with the staff member, the purpose and the time, and shows the conversation with email addresses, phone numbers and client name fields masked by default. Seeing them unmasked is a separate action, also recorded, and is limited to what the purpose needs. Conversations are never used to train AI models (section 4, item 2), and staff notes about a conversation do not contain client data. [A validar por el abogado: counsel to confirm this clause, including that purpose (c) is a permitted business purpose under the CCPA and Argentine law.]

5. CCPA and US state law terms

To the extent the CCPA or similar US state laws apply, Cherry: (a) will not sell or share Customer Personal Data; (b) will not retain, use or disclose it for any purpose other than the business purposes specified in this DPA, or outside the direct business relationship with the Customer; (c) will not combine it with personal information received from others, except as permitted by law; (d) will comply with the applicable obligations and provide the same level of privacy protection required of the Customer; (e) will notify the Customer if it can no longer meet its obligations; and (f) grants the Customer the right to take reasonable steps to stop and remediate unauthorized use. Cherry certifies that it understands these restrictions.

6. Sub-processors

• The Customer gives general authorization for Cherry to engage Sub-processors. The current list is at /legal/subprocessors.
• Cherry will give at least 30 days' notice before adding or replacing a Sub-processor, by updating the list and emailing the account owner. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a refund of any prepaid fees for the remaining term.
• Cherry will impose on each Sub-processor data protection obligations no less protective than this DPA and remains responsible for its Sub-processors' performance.

7. Data subject requests

The Service lets the Customer export a client's data and delete (anonymize) a client's personal details. If Cherry receives a request directly from a data subject about Customer Personal Data, it will forward it to the Customer within 2 business days and will not respond itself except to confirm receipt and redirect the person, unless the Customer instructs otherwise. Cherry will provide reasonable additional help so the Customer can meet legal deadlines (for example, 10 days for access and 5 business days for rectification or deletion under Argentine law).

8. Security Incidents

Cherry will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the incident, the categories and approximate number of people and records affected, the likely consequences, and the measures taken or proposed. Cherry will update the Customer as more information becomes available and will cooperate with the Customer's legally required notifications. Notifying the Customer is not an admission of fault.

9. International transfers

Cherry hosts Customer Personal Data in the United States, and Cherry's team may access it from Argentina. The Customer authorizes these transfers. Where Argentine Law No. 25,326 applies to a transfer, the parties agree that the model contractual clauses approved by Argentina's Agency for Access to Public Information (Disposition No. 60-E/2016 or the Ibero-American model clauses recognized by Resolution No. 198/2023, controller-to-processor module) are incorporated by reference, and Cherry will put equivalent safeguards in place with its Sub-processors. [Counsel to confirm the chosen clause set and attach it if required.]

10. Audits

Cherry will make available the information reasonably necessary to demonstrate compliance with this DPA, including summaries of security policies and any third-party certifications or reports it holds. If that information is not sufficient, the Customer may, at its own cost and no more than once every 12 months, request an audit with at least 30 days' notice, conducted during business hours, subject to confidentiality and without access to other customers' data.

11. Return and deletion

During the term, the Customer can export each client's data from the Service. When the account closes, Cherry will delete Customer Personal Data within 30 days, unless the law requires retaining it. Data in backups is deleted when backups are overwritten on their regular rotation, and is protected under this DPA until then.

12. Liability and term

Each party's liability under this DPA is subject to the limitations in the Terms, except where the law does not allow it. This DPA lasts as long as Cherry processes Customer Personal Data.

Annex 1 · Technical and organizational security measures

• Access control: role-based permissions per business (owner, admin, staff); every query is scoped to the authenticated business; database constraints prevent cross-business references.
• Authentication: passwords hashed with scrypt and a per-user salt; short-lived access tokens (15 minutes); rotating refresh tokens stored only as hashes, with reuse detection; one-time codes expire after 10 minutes with attempt limits; Google Sign-In available.
• Secrets and tokens: API tokens, invitation tokens and appointment-management links stored only as hashes; random 256-bit keys for stored files.
• Encryption: TLS for data in transit; encryption at rest provided by the hosting and storage providers.
• Application security: input validation on every request, error responses without internal details, secure httpOnly cookies, the browser never talks to the internal API directly.
• Data minimization and retention: expired sign-in codes, sessions and invitations are purged automatically; Customers can anonymize clients at any time.
• Logging and monitoring: application and error monitoring with redaction of personal data; rate limiting of sensitive endpoints. [In progress at the date of this draft.]
• Personnel: access to production limited to authorized staff with confidentiality obligations and multi-factor authentication. [To be formalized.]
• Resilience: daily database backups stored in a separate, access-restricted storage bucket and deleted when their retention period ends ([X days]); recovery procedures that re-apply deletions made after a backup was taken. [Backup encryption and restore tests to be documented.]
• Incident response: documented procedure with notification to Customers within 72 hours. [To be formalized.]

Annex 2 · Sub-processors

See the current list at /legal/subprocessors.