Effective date: February 15, 2026
This DPA applies where DocuRise processes Personal Data on behalf of the Document Owner ("User").
1. Roles. The User is the Controller. RiseCraft, LLC is the Processor.
2. Processing. We process Viewer data (UUIDs, engagement metrics, form submissions, automated messages) only to provide the Service and follow the User's documented instructions.
3. Security. We use encryption in transit and at rest, role-based access controls, and contractual confidentiality obligations for all personnel.
4. Sub-Processors. The User provides general authorization for sub-processors (currently: Stripe, Vercel, Supabase, Amazon Web Services). We will notify Users before adding new sub-processors. We remain responsible for sub-processor compliance.
5. Data Subject Requests. If a Viewer contacts us directly, we will notify the Document Owner and provide reasonable assistance.
6. Breach Notification. We will notify affected Document Owners within 48 hours of confirming a Personal Data breach.
7. Deletion. Upon termination or User request, we will delete all Personal Data within 30 days unless legally required to retain it.