Data Processing Addendum
Effective Date: September 16, 2026
Last Updated: September 16, 2026
This Data Processing Addendum ("DPA") forms part of the agreement between VaultWiz LLC, doing business as ShoBiz ("ShoBiz," "we," "us," "Processor") and the business customer that uses the Services ("Customer," "you," "Controller").
It governs our processing of personal data that you upload, create, or manage about your own clients, employees, vendors, and contacts ("Customer Personal Data"). For personal information where we decide the purposes and means — your account, billing, and our marketing — see our Privacy Policy instead.
If you have signed a separate negotiated data processing agreement with us, that agreement controls where it conflicts with this one.
1. Roles of the Parties
You are the controller (or "business") of Customer Personal Data. You decide why and how it is processed, and you are responsible for the lawfulness of your instructions.
We are the processor (or "service provider"). We process Customer Personal Data only to provide the Services and only on your documented instructions.
We will not:
- Sell Customer Personal Data, or share it for cross-context behavioral advertising
- Retain, use, or disclose it for any purpose other than performing the Services, except as permitted by law
- Retain, use, or disclose it outside our direct business relationship with you
- Combine it with personal information from another source, except as needed to perform the Services you requested
We will notify you if we determine we can no longer meet these obligations.
2. Your Instructions
Your instructions to us are: this DPA, the agreement for the Services, your configuration choices in the product, and the actions your authorized users take in the Services.
We will tell you if, in our opinion, an instruction infringes applicable data protection law. We may suspend processing of an instruction we reasonably believe to be unlawful until it is resolved.
3. Your Responsibilities
You are responsible for:
- Having a lawful basis, and where required, valid consent, to collect the personal data you upload and to have us process it
- Providing the privacy notices your own clients are entitled to receive
- The accuracy of the data you upload
- Configuring roles and permissions so only appropriate users can see sensitive records
- Responding to your own clients' privacy requests — we will assist as described in Section 8
Because the Services can store Social Security numbers, financial account details, and credit report data, you are responsible for confirming that your collection and use of that data complies with the laws that apply to your business, including the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, and state financial privacy laws, where applicable to you.
4. Nature and Purpose of Processing
| Subject matter | Provision of the ShoBiz business management platform |
| Duration | For the term of your subscription, plus the retention period in Section 10 |
| Nature and purpose | Hosting, storing, organizing, retrieving, transmitting, analyzing, and deleting Customer Personal Data so you can operate your business |
| Types of personal data | Identifiers, contact details, government identifiers including Social Security numbers, financial account and transaction data, credit report data, employment and income data, documents, communications content, calendar and meeting data, vehicle records, and any other data you choose to store |
| Categories of data subjects | Your clients, leads, employees, contractors, vendors, affiliates, contacts, and their associated individuals |
| Special categories | You may upload government identifiers and financial data. Do not upload health data, biometric data, or other special-category data except where the Services expressly support it |
5. Confidentiality
We restrict access to Customer Personal Data to personnel who need it to operate or support the Services. Those personnel are bound by written confidentiality obligations that survive the end of their engagement, and their access is logged.
6. Security Measures
We implement and maintain the following technical and organizational measures:
- Encryption in transit — TLS for all connections to the Services
- Encryption at rest — AES-256-GCM for Social Security numbers and stored third-party credentials, with keys managed separately from the database
- Credential protection — bcrypt password hashing; plaintext passwords are never stored
- Access control — role-based permissions, business-scoped data isolation, and least-privilege administrative access
- Application hardening — input sanitization, rate limiting, bot mitigation on public endpoints, and security headers
- Logging and monitoring — audit logging of significant actions with monitored error and security logs
- Backups — regular encrypted backups with a defined restoration process
- Change management — code review and staged deployment
We may update these measures, but will not materially reduce the overall level of protection during your subscription term.
7. Sub-processors
You give general authorization for us to engage sub-processors. We impose data protection obligations on each sub-processor that are no less protective than this DPA, and we remain liable for their performance.
Our current sub-processors are:
| Sub-processor | Purpose | Location |
|---|---|---|
| Render | Application hosting | United States |
| MongoDB Atlas | Primary database | United States |
| Amazon Web Services | Email delivery (SES) and infrastructure | United States |
| Cloudinary | File, image, and document storage | United States |
| SignalWire | SMS and voice messaging | United States |
| Plaid | Bank account linking and transaction data | United States |
| Stripe, PayPal, NMI, Clover | Payment processing | United States |
| Anthropic | AI-assisted features (see Section 9) | United States |
| Calendar, email, mapping integrations, where you connect an account | United States | |
| Microsoft | Calendar and email integrations, where you connect an account | United States |
| Zoom | Meetings, recordings, and transcripts, where you connect an account | United States |
Changes. We will give you at least 30 days' notice before adding or replacing a sub-processor that processes Customer Personal Data. You may object on reasonable data protection grounds within that period by writing to info@shobizapp.com. If we cannot offer a reasonable alternative, you may terminate the affected Services without penalty for the unused portion of your prepaid term.
To receive sub-processor change notices, email info@shobizapp.com with "Sub-processor Notices" in the subject line.
8. Assistance to You
Data subject requests. If we receive a request from one of your clients, we will not respond on your behalf except to confirm the request relates to you. We will forward it to you without undue delay. The Services include export, correction, and deletion tools so you can respond directly; where those tools are insufficient, we will provide reasonable assistance.
Security and compliance. Taking into account the nature of processing and the information available to us, we will provide reasonable assistance with your data protection impact assessments, prior consultations with regulators, and your own breach notification obligations.
9. Artificial Intelligence
AI-assisted features may process Customer Personal Data. Our commitments:
- No training. Customer Personal Data is not used to train ShoBiz models or any third-party model. Our AI sub-processor is contractually prohibited from training on data we submit.
- Minimum necessary input. We submit only the text a feature needs — typically the current message and a short conversation history.
- Human review. AI output is a suggestion or a logged, reversible action. No AI decision producing legal or similarly significant effects about a data subject is made without human involvement.
- Tenant-level opt-out. You can disable AI processing for your business at Business Settings → Privacy & AI. When disabled, no AI feature will process your data, including features released later. This is enforced by a single platform gate rather than per-feature settings.
10. Retention, Return, and Deletion
During your subscription you may export or delete Customer Personal Data at any time using the Services.
On termination, we will make Customer Personal Data available for export for 30 days. After that period, we will delete it within 90 days, except where retention is required by law. Data in rolling backups is overwritten on a cycle not exceeding 90 days.
On written request after termination, we will confirm deletion in writing.
11. Personal Data Breach
We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records involved, the likely consequences, the measures taken or proposed, and a contact point for more information.
We will cooperate with you and take reasonable steps to mitigate and remediate. Our notification is not an acknowledgement of fault or liability.
12. Audits
On written request, no more than once per twelve-month period, we will provide the information reasonably necessary to demonstrate compliance with this DPA — including our security documentation and responses to a reasonable security questionnaire.
Where a regulator requires an on-site audit, or where you have a documented reasonable belief that we are in material breach, you may request one on at least 30 days' written notice, during business hours, subject to confidentiality, without disrupting the Services or accessing other customers' data, and at your expense.
13. International Transfers
The Services are hosted in the United States, and Customer Personal Data is processed there.
Where you transfer to us personal data subject to the GDPR or UK GDPR, the parties incorporate the European Commission's Standard Contractual Clauses (Module Two: controller to processor) and, for UK transfers, the UK International Data Transfer Addendum, with:
- ShoBiz as "data importer" and Customer as "data exporter"
- The description of processing in Section 4 completing Annex I
- The security measures in Section 6 completing Annex II
- The sub-processor list in Section 7 completing Annex III
- Governing law and forum as specified in your agreement for the Services, or Ireland where the Clauses require an EU Member State
14. Liability and Order of Precedence
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the agreement for the Services.
If this DPA conflicts with that agreement, this DPA controls as to the processing of Customer Personal Data. If this DPA conflicts with the Standard Contractual Clauses, the Clauses control.
15. Changes
We may update this DPA to reflect changes in law, our sub-processors, or the Services. Material changes will be notified at least 30 days in advance to the email address on your account, and the "Last Updated" date above will be revised.
16. Contact
VaultWiz LLC (dba ShoBiz)
30 N Gould St Ste 5170, Sheridan, WY 82801, United States
Email: info@shobizapp.com
Phone: (424) 234-9134
Write to info@shobizapp.com with "DPA" in the subject line for data processing questions, sub-processor notices, or audit requests.