Data Processing Addendum

This Data Processing Addendum ("DPA") describes how ReadyIQ, a product of Axiom Marketing Inc, an Ontario, Canada corporation ("Processor," "we"), processes personal data on behalf of customers ("Controller," "you") who use the ReadyIQ platform. It supplements our Terms of Service.

1. Roles

Where you use the Service to process personal data belonging to your own end users or clients, you act as the data Controller and we act as the data Processor, processing that data only on your instructions and for the purpose of providing the Service. For account, billing, and platform-usage data we collect about you directly, we act as an independent Controller — see our Privacy Policy.

2. Subprocessors

We use the following subprocessors to provide the Service. Each is bound by its own data protection terms with us.

• Clerk — authentication and user identity
• Stripe — payment processing and billing
• Neon — primary database hosting (Postgres)
• Cloudflare R2 — file and vault object storage
• Resend — transactional email delivery
• OpenAI — AI model inference for prompt and content tools
• Vercel — application hosting and edge network
• Upstash — rate limiting infrastructure

We will provide notice before adding a new subprocessor that will materially change how your data is handled, where practical.

3. Security Measures

We apply industry-standard security measures, including encryption in transit (TLS) and at rest, access controls scoped to least-privilege, and regular review of our infrastructure configuration. See our Security page for how to report a vulnerability.

4. Breach Notification

If we become aware of a breach affecting your personal data processed under this DPA, we will notify you without undue delay after becoming aware, and provide information reasonably available to us about the nature and scope of the incident as our investigation progresses.

5. Deletion on Termination

On termination of your account, we will delete or anonymize personal data processed on your behalf within a reasonable period, subject to legal retention requirements and backup rotation cycles. You may request an export of your data before termination takes effect.

6. Contact