Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between RetreatBooker LLC, United States (“GuideBundle”, “Processor”) and each creator who uses GuideBundle to collect personal data through guides (“Customer”, “Controller”). It applies automatically, without signature, whenever GuideBundle processes personal data on the Customer’s behalf. Terms such as “personal data”, “processing”, “controller”, “processor” and “personal data breach” have the meanings given in the EU General Data Protection Regulation (“GDPR”), the UK GDPR and comparable laws.

1. Subject matter and duration

The subject matter is the processing of personal data collected through the Customer’s guides in order to provide the Service. Processing lasts for the term of the Customer’s use of the Service and until the data is deleted under section 11.

2. Nature and purpose

GuideBundle hosts and displays guides, stores visitor progress, collects and stores leads, produces analytics, sends invitations requested by the Customer, and makes the data available to the Customer in its workspace and exports. GuideBundle processes the data only to provide the Service.

3. Categories of data

• Names and email addresses given by visitors (leads).
• Random visitor identifiers, guide progress (steps and checklists) and analytics events.
• Campaign data: UTM parameters, referrer host and path, and landing URL without its query string.
• Email addresses of people the Customer invites to a guide, and invitation status.
• Any personal data the Customer chooses to include in guide content.

The Service is not designed for special categories of personal data, and the Customer should not collect them through guides.

4. Data subjects

Visitors to the Customer’s guides, leads, invited readers, and any individuals mentioned in the Customer’s content.

5. Processor obligations (GDPR Article 28)

GuideBundle will:

• process personal data only on the Customer’s documented instructions, which are these Terms, this DPA and the Customer’s use of the Service settings, and tell the Customer if it believes an instruction breaks data protection law;
• not sell the personal data or use it for its own purposes, such as advertising;
• implement the security measures in section 7;
• engage subprocessors only as described in section 8;
• assist the Customer with data subject requests (section 9), security, breach notification, data protection impact assessments and prior consultations, taking into account the nature of the processing and the information available to GuideBundle;
• delete or return personal data at the end of the Service (section 11);
• make available the information needed to demonstrate compliance with Article 28 (section 12).

The Customer is responsible for having a lawful basis for the processing, for giving data subjects an appropriate privacy notice, and for the lawfulness of its instructions.

6. Confidentiality

GuideBundle ensures that anyone authorized to process the personal data is bound by confidentiality obligations and accesses it only as needed to operate, support or secure the Service.

7. Security measures

• Encryption in transit with HTTPS (TLS).
• Authentication and visitor identifiers kept in HttpOnly cookies, with CSRF protection on state-changing requests.
• Passwords stored only as bcrypt hashes.
• Customer AI provider keys encrypted at rest with AES-256-GCM.
• Every creator resource scoped to the authenticated user’s workspace; no cross-workspace access.
• Data minimization: random visitor identifiers, referrer host and path only, landing URLs stored without query strings, and no device fingerprinting.
• Daily backups kept for 14 days on the server, with encrypted off-site copies kept for up to 30 days.
• Restricted administrative access, security updates and server logs used for monitoring and incident investigation.

8. Subprocessors

The Customer gives general authorization for GuideBundle to use the subprocessors below. GuideBundle imposes data protection obligations on each subprocessor that are no less protective than this DPA and remains responsible for their performance.

Stripe processes billing data as an independent controller, not as GuideBundle’s subprocessor for guide data. Application-selected AI providers receive briefs, source text and guide content for requested generation and safety/quality review using GuideBundle’s server-managed accounts.

GuideBundle will notify the Customer by email or in the Service at least 14 days before adding or replacing a subprocessor. The Customer may object on reasonable data protection grounds by writing to privacy@guidebundle.com within that period. The parties will discuss the objection in good faith. If it cannot be resolved, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the unused period.

9. Data subject requests

The Service lets the Customer view, export and delete leads, and forget an email address across its workspace. If GuideBundle receives a request from a data subject about the Customer’s data, it will forward it to the Customer without undue delay and will not respond directly except to confirm the request was passed on, unless required by law.

10. Personal data breaches

GuideBundle will notify the Customer without undue delay, and in any case within 72 hours after becoming aware of a personal data breach affecting the Customer’s data. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records affected, likely consequences and the measures taken or proposed. GuideBundle will take reasonable steps to contain the breach and will provide further information as it becomes available.

11. Deletion or return at the end

The Customer can export its leads at any time. When the Customer deletes data or its account, GuideBundle permanently deletes the related workspaces, guides, leads and uploaded files from the live system. Deleted data is removed from backups as they expire (14 days on the server and up to 30 days for encrypted off-site copies), unless law requires longer retention.

12. Audits

On written request, GuideBundle will provide information and documentation reasonably needed to demonstrate compliance with this DPA, such as descriptions of its security measures and subprocessors. If that documentation is not sufficient to meet a requirement of a supervisory authority or of applicable law, the parties will agree on a reasonable, scoped audit at the Customer’s cost, with reasonable notice and confidentiality.

13. International transfers

Where personal data is transferred to a country without an adequacy decision, the parties rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), which are incorporated by reference, together with appropriate supplementary measures. GuideBundle ensures equivalent safeguards with its subprocessors.

14. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms, except where law does not allow it. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails.

15. Contact

Data protection questions about this DPA: privacy@guidebundle.com.