Data processing agreement, for workspace data.

1. Scope and roles

This agreement is between the customer who uses a ClaraDB workspace ("Customer") and The Plain Works Co., Ltd. ("Processor"). It forms part of the terms of use and applies when Processor handles personal data contained in workspace content on Customer's behalf ("Customer Personal Data"). Customer is the controller or business; Processor is the processor or service provider. Each party remains the controller of the account, contact and security data it holds for its own purposes, as the privacy notice describes. The privacy contact is the Privacy team (개인정보보호 담당 부서), hello@claradb.com.

2. Instructions and purpose limit

Processor processes Customer Personal Data only to provide, secure and support the service under the terms, Customer's configuration and use, and written instructions sent to hello@claradb.com. It tells Customer if an instruction appears unlawful. Processor does not sell or share Customer Personal Data, does not use it outside the direct business relationship, does not combine it with data from other sources except as needed to provide the service, and does not use it for advertising or to train AI models.

3. Customer responsibilities

Customer gives lawful instructions and any notices and consents the law requires, adds only data the service needs, does not add special categories of data, and manages workspace roles, invitations and API keys. Customer answers privacy requests from its own personnel and contacts, and decides whether the service suits its legal duties. ClaraDB is decision support, not legal advice.

4. What Processor does

• Binds personnel with access to confidentiality, and limits access to what the work needs.
• Applies the measures in Annex II.
• Helps Customer, taking the nature of the processing into account, with verified privacy requests, security questions, breach response and impact assessments the law requires.
• Keeps records reasonably needed to show compliance, and tells Customer of a binding government demand for Customer Personal Data where the law allows.
• Deletes or returns Customer Personal Data as section 7 describes.

5. Subprocessors

• Authorization. Customer gives general authorization for Processor to engage subprocessors. The current subprocessors are listed below and, with a dated change log, on the subprocessors page, which forms part of this agreement.
• Terms. Processor engages each subprocessor under written terms that protect Customer Personal Data at least as well as this agreement, as far as they apply to the service the subprocessor provides. Processor remains responsible for each subprocessor's performance of those duties.
• Notice. Processor gives at least 30 days' notice before a new or replacement subprocessor starts processing Customer Personal Data, by email to workspace owners and on the subprocessors page. Where a replacement is urgent for security, legal or availability reasons, Processor gives notice as soon as it reasonably can.
• Objection. Customer may object on reasonable data-protection grounds by writing to hello@claradb.com within 14 days of the notice. The parties will discuss a solution in good faith, such as not using the new subprocessor for Customer Personal Data. If they cannot agree within 30 days, Customer may end the affected service and receive a prorated refund of prepaid fees for it.
• Not a subprocessor. Paddle sells paid plans as merchant of record and is an independent controller of the payment data it collects. It receives no workspace content.

6. Security incidents, requests and audits

• Processor notifies Customer without undue delay, and no later than 72 hours, after it becomes aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. The notice goes to workspace owners by email and describes, as far as then known, what happened, the categories and approximate number of people and records affected, the likely consequences, the measures taken or proposed, and a contact. Processor adds information as it learns it, takes reasonable steps to contain the breach, and helps Customer meet its own notice duties. A notice is not an admission of fault.
• Processor passes a privacy request about Customer Personal Data to Customer unless it is authorized to answer. Workspace owners can export workspace data from settings.
• Once a year on written request, Processor gives current security information. If the law requires more, Customer may have a narrowly scoped audit by an independent auditor under confidentiality, in business hours, at Customer's cost and without access to other customers' data. A further audit is allowed after a material incident or a regulator's request.

7. Deletion and retention

During the term Customer can export workspace data and delete SKUs, workspaces and accounts. Deleted SKUs stay in Trash until an admin removes them. An account is removed within 30 days of deletion. The retention periods in the privacy notice apply to logs and records. A legal hold, dispute or mandatory law may require limited longer retention; retained data stays protected and is deleted when the reason ends.

8. Transfers

Customer authorizes processing in the Republic of Korea, the United States and the other locations of the listed subprocessors. Where the data leaves the EU, EEA, UK or Switzerland without an adequacy decision, the parties rely on the European Commission's standard contractual clauses (with the UK addendum for UK data) or the EU-US Data Privacy Framework for a certified recipient, and Processor gives a copy of the safeguards on request. The notice of overseas transfer under the Korean Personal Information Protection Act is in the privacy notice.

9. US state privacy terms

Where the CCPA or CPRA, or a similar US state law, applies to Customer Personal Data, Processor acts as Customer's service provider or processor and accepts the restrictions that role requires: it uses the data only for the business purposes in Annex I, does not sell or share it, keeps it confidential and secure, helps with requests, allows reasonable assessment, and tells Customer if it can no longer meet these duties.

10. Liability, term and precedence

The liability limits in the terms apply to this agreement as far as the law allows. It lasts while Processor processes Customer Personal Data. If it conflicts with the terms about personal data, this agreement controls. Changes need written agreement, except that Processor may change subprocessors under the notice and objection process in section 5, and may update the measures in Annex II if the update does not materially lower the overall protection of Customer Personal Data. The agreement is governed by the law of the Republic of Korea.

Annex I: processing details

Annex II: technical and organizational measures

• Workspace access by membership and role, enforced in the database; least-privilege administration.
• Single-use, expiring sign-in links; step-up check before sensitive account changes; API keys stored only as hashes.
• Encryption in transit (TLS); provider-managed encryption at rest.
• Workspace data hosted in the United States: database in us-east-1 (Amazon Web Services, N. Virginia, United States); application servers in Vercel's Washington, D.C. region (iad1).
• Rate limits, spam traps, abuse controls, logging and incident procedures.
• Content security policy, security headers and no personal data in analytics events.
• Provider review and written data-protection terms with each subprocessor.
• Dependency monitoring, code review and vulnerability response.
• Deletion workflows and confidentiality duties for personnel.

Annex III: contact

The Plain Works Co., Ltd., Privacy team (개인정보보호 담당 부서): hello@claradb.com. This agreement applies with the terms; a copy for your records is available on request.

Other legal pages

• Terms of use
• Privacy notice
• Subprocessors
• Security and responsible disclosure
• Billing and refunds