Skip to content
ColdCredit
Request early access

Data Processing Addendum

How ColdCredit processes personal information about guide visitors on behalf of the organizations that use it. Part of the Business Terms.

Version 2026-10-23

Draft, pending review by counsel

This is a plain-language working draft. It has not been reviewed by a lawyer yet (decision Q19) and will change before ColdCredit launches. It is not legal advice.

1. Scope and roles

  • This addendum is part of the Business Terms between ColdCredit LLC ("ColdCredit") and the organization that accepted them ("Customer"). It applies when ColdCredit processes Customer Personal Data: personal information about guide visitors that ColdCredit processes on the Customer's behalf.
  • For Customer Personal Data the Customer is the business or controller and ColdCredit is its service provider, contractor or processor under the California Consumer Privacy Act (as amended by the CPRA) and the other US state privacy laws that apply ("Data Protection Laws").
  • It does not cover the account details of the Customer's own staff (name, email, login), which ColdCredit handles as described in its privacy policy.
  • Annex 1 below describes the processing. If this addendum and the rest of the Business Terms differ on data protection, this addendum wins.

2. Instructions and purpose

  • ColdCredit processes Customer Personal Data only to provide the service described in Annex 1, on the Customer's documented instructions. The Business Terms, this addendum and the Customer's choices in the console are those instructions.
  • ColdCredit will tell the Customer if it believes an instruction breaks a Data Protection Law, and need not follow it.
  • The Customer confirms it has the right to have the data processed this way and gives guide visitors any notice the law requires.

3. Service provider commitments

ColdCredit will not:

  • sell or share Customer Personal Data, as the CCPA defines those words, or use it for targeted advertising;
  • keep, use or disclose it for any purpose other than the business purposes in Annex 1, including any commercial purpose of its own, or outside the direct business relationship with the Customer;
  • combine it with personal information ColdCredit receives from anyone else or collects itself, except as Data Protection Laws allow a service provider to do;
  • try to re-identify a guide visitor.

ColdCredit will:

  • comply with the Data Protection Laws that apply to it and give Customer Personal Data the level of privacy protection they require;
  • tell the Customer within 10 business days if it decides it can no longer meet these obligations;
  • let the Customer take reasonable and appropriate steps to ensure the data is used consistently with these obligations, and to stop and remediate any unauthorized use;
  • make sure everyone at ColdCredit who processes the data is bound to keep it confidential.

ColdCredit may use data that has been de-identified, so that it cannot reasonably be linked to a person, household or device, and aggregated across customers to run and improve the service. It will keep it de-identified, publicly commit not to re-identify it, and require the same of anyone it shares it with.

4. Financial institution customers

  • ColdCredit is designed not to receive nonpublic personal information under the Gramm-Leach-Bliley Act. The Business Terms forbid the Customer from sending member, customer, account, loan or application numbers or other such information.
  • If any is received anyway, ColdCredit will use and disclose it only to provide the service and as the law allows (12 CFR 1016.11, 16 CFR 313.11), protect it with the safeguards in Annex 2, tell the Customer, and delete it on request.
  • For the Customer's oversight of its service providers (16 CFR 314.4(f); 12 CFR 748, Appendix A), ColdCredit will answer reasonable security questionnaires, provide its security packet, and tell the Customer of material changes to the measures in Annex 2.

5. Subprocessors

  • The Customer authorizes ColdCredit to use the subprocessors listed below and on the security page. ColdCredit has a written contract with each that protects the data at least as much as this addendum, and is responsible for what they do with it.
  • ColdCredit will email the Customer's account owners at least 30 days before it adds a subprocessor or switches on a planned one. The Customer may object on reasonable data protection grounds within those 30 days. If we cannot resolve the objection, the Customer may cancel and get back fees prepaid for the remaining period.

  • Supabase

    What it does
    Database, sign-in and logo file storage
    Guide visitor data
    Yes
    Where
    United States
    Status
    Active

  • Vercel

    What it does
    Hosting the site, console and guide pages
    Guide visitor data
    Yes
    Where
    United States, with a global delivery network
    Status
    Active

  • Stripe

    What it does
    Subscriptions, payments and invoices
    Guide visitor data
    No
    Where
    United States
    Status
    Active

  • Resend

    What it does
    Email: sign-in links, invitations, billing notices and contact form messages
    Guide visitor data
    No
    Where
    United States
    Status
    Active

  • Cloudflare Turnstile

    What it does
    Bot checks on sign-up, sign-in after failed attempts, password reset and the contact form
    Guide visitor data
    No
    Where
    Global network
    Status
    Active

  • Backup storage

    What it does
    Holding the nightly encrypted backup of ColdCredit's database schema for 30 days
    Guide visitor data
    Yes
    Where
    United States
    Status
    Planned, not active

  • Sentry

    What it does
    Error monitoring and sampled performance tracing
    Guide visitor data
    Yes
    Where
    United States
    Status
    Active

A video provider the Customer chooses to embed in a guide (YouTube, Vimeo, Loom or HeyGen) is the Customer's choice, not a ColdCredit subprocessor. Its player loads only when a guide visitor presses play, and then receives the visitor's IP address and browser details, under the provider's own terms.

6. Security

ColdCredit maintains administrative, technical and physical safeguards appropriate to the data, including those in Annex 2 and on the security page, and reviews them as the service changes. ColdCredit does not hold a SOC 2 report.

7. Security incidents

  • If ColdCredit confirms unauthorized access to, or acquisition, loss or disclosure of, Customer Personal Data (a "Security Incident"), it will tell the Customer's account owners without undue delay and no later than 72 hours after confirming it, by email.
  • The notice will describe what happened, the data and number of records involved as far as known, what ColdCredit is doing, and a contact. ColdCredit will update it as it learns more, and help the Customer meet its own notice duties, including to regulators such as the NCUA and the FTC.
  • Guide visitors are anonymous to ColdCredit, so ColdCredit cannot notify them directly. The Customer decides whether and how to notify them and its regulators, unless the law requires ColdCredit to do so.
  • Telling the Customer about a Security Incident is not an admission of fault.
  • Report a suspected incident to security@coldcredit.co.

8. Requests from guide visitors and assessments

  • If a guide visitor asks ColdCredit to access, correct or delete Customer Personal Data, ColdCredit will tell the Customer and help it respond, by finding the visitor's records from the visitor ID in their browser and deleting or exporting them.
  • ColdCredit will give reasonable help with the Customer's data protection assessments that involve the service.

9. Deletion

  • When the Customer deletes its organization, it can be restored for 30 days. After that ColdCredit erases its guide records, links' wording, branding, team and invitations, and redacts staff email addresses in its activity log. Link codes are kept, retired, so a printed QR code never opens another organization's guide.
  • The Customer can ask for an export before the 30 days end, or for earlier deletion.
  • Copies in the database provider's daily backups expire after 7 days. Backups are restored only to recover the service.

10. Information and audits

  • Once a year, or after a Security Incident, the Customer may ask for the information it reasonably needs to check compliance with this addendum. ColdCredit will answer in writing, and through its security packet and questionnaire answers.
  • If a regulator requires more, or written answers are not enough, the Customer or an independent auditor it appoints may assess ColdCredit's processing on 30 days' notice, during business hours, under confidentiality, at the Customer's cost, and no more than once a year.

11. General

  • The limitation of liability in the Business Terms applies to this addendum.
  • ColdCredit stores and processes Customer Personal Data in the United States.
  • ColdCredit may update this addendum when the law changes or the service does, with the notice the Business Terms give for material changes. It will not reduce the protection of Customer Personal Data during a paid period.

Annex 1: Details of processing

  • Subject matter and purpose

    Details
    Providing the guides a Customer creates, and showing the Customer how its links are used: visits, people, completions, QR versus direct, and reported problems.

  • Duration

    Details
    The term of the Business Terms, then until deletion under section 9.

  • Nature of processing

    Details
    Collection by the guide page, storage, aggregation into the Customer's analytics, display to the Customer's users, and deletion.

  • Data subjects

    Details
    People who open the Customer's guides (guide visitors).

  • Personal data

    Details
    A random visitor ID made and kept in the visitor's browser; event kind (visit, bureau marked done or not done, problem reported); bureau; a truncated user-agent string; device type; whether the visit came from a QR code; the problem type and any note the visitor types, with emails, phone numbers and long numbers removed. Guide visitors' IP addresses are used for rate limiting and are not stored by ColdCredit: only a keyed hash of each, in a counter that expires within 30 minutes and is deleted daily.

  • Sensitive data

    Details
    None is requested. Social Security numbers, dates of birth, addresses, account numbers and bureau logins are never collected, and the Business Terms forbid the Customer from sending them.

  • Location

    Details
    United States.

Annex 2: Security measures

  • Isolation

    Measures
    A dedicated database schema and database role; row-level security limits every read to the Customer's own organization; the credentials of ColdCredit LLC's other product have no access to it.

  • Encryption

    Measures
    HTTPS only, with HSTS; encryption at rest by the database provider; card and bank details never reach ColdCredit.

  • Access

    Measures
    Owner, admin and viewer roles; email invitations that expire after 7 days; two-factor sign-in available to every user and required for every ColdCredit staff session; staff changes to a Customer's account appear in that Customer's activity log.

  • Integrity of guide data

    Measures
    Each guide page carries a signed token, so another site cannot post activity to the Customer's analytics; per-IP and per-link rate limits that refuse requests if the limiter is unavailable.

  • Minimization

    Measures
    Guides are anonymous; problem notes are scrubbed in the browser and again on the server; guide visitors' IP addresses are not stored, only keyed hashes in rate-limit counters that expire within 30 minutes; no third-party analytics or trackers on guide pages; a video the Customer embeds loads from its provider only when the guide visitor presses play, and YouTube plays from youtube-nocookie.com.

  • Secure development

    Measures
    Server-side input validation; every write goes through an audited command; automated tests over access rules; secret scanning before every commit.