Back to Legal Index

Data Processing Addendum

Data Processing Addendum // v1.0.0

Scope Notice: This Data Processing Addendum (DPA) applies strictly to this website and the Developer Program portal. The downloadable/hosted Cortlet application software and core product operate under their own distinct Terms of Service, End-User License Agreements, and Privacy Policies.

1. Legal Entity & Preamble

This Data Processing Addendum ("DPA") governs the processing of Personal Data in connection with the web services, developer tools, and developer accounts provided under the brand name Cortlet (an independent software initiative, hereafter referred to as "Cortlet," "we," or "us").

This DPA supplements the Cortlet Terms of Service and Privacy Policy. By creating a developer account or utilizing our developer portal, you agree to the terms outlined in this agreement.

2. Roles of the Parties

  • Data Controller: The developer, user, or client who submits personal data, account credentials, or telemetry to the web portal.
  • Data Processor: Cortlet, which processes personal data strictly to maintain developer accounts, secure the web portal, and manage system operations.

3. Scope and Nature of Processing

Cortlet processes Personal Data solely to deliver web portal features, manage developer account authentication, and collect essential platform performance telemetry.

DATA TYPES: Names, Email Addresses, IP Addresses, User Identifiers, Web Analytics

DATA SUBJECTS: Developers, Website Visitors, Program Applicants

PROCESSING PURPOSE: Authentication, Web Infrastructure, Performance Monitoring

4. Technical & Organizational Security Measures (TOMs)

While Cortlet is an independent project and does not currently maintain third-party security certifications (such as SOC 2 Type II or ISO/IEC 27001), we enforce pragmatic, standard security controls:

Encryption Standards

Web traffic is encrypted in transit using TLS 1.3. Static assets and assets hosted on storage providers are encrypted at rest.

Email Verification Auth

Authentication is managed via Clerk utilizing mandatory email verification codes sent to the registered address for access.

Hosting & Assets

Web applications are deployed on Vercel platform infrastructure, with static media distributed via Amazon S3 and CloudFront CDN.

Incident Response

Direct procedures to isolate security bugs, revoke compromised credentials, and notify affected users in the event of an issue.

5. Sub-Processors

Cortlet utilizes specific third-party sub-processors strictly to operate web services and user sign-in:

  • Clerk.com: User authentication and identity verification via email security codes.
  • Vercel Inc.: Next.js web application hosting and deployment platform.
  • Amazon Web Services (AWS): Amazon S3 and CloudFront CDN for serving web media and public asset delivery.

6. Breach Notification

In the event of a confirmed personal data security incident affecting website accounts, Cortlet will notify registered account holders via email within 72 hours of confirmation, detailing the scope of the incident and mitigation steps.

7. Data Subject Rights & Deletion

Users retain full rights to request access to or deletion of their personal web portal data. Account deletion requests initiated via the Developer Portal will cause identity data and associated metadata to be permanently deleted from primary databases within 30 days.

Questions regarding this data processing framework can be sent to support@cortlet.com.