Data processing addendum

This Data Processing Addendum ("DPA") forms part of the Vaaku Terms of Service. When you use Vaaku, you (the restaurant operator) are the controller of your restaurant's data, and TwoTwo is the processor — or, under California law, the service provider — processing it only on your instructions to deliver the service.

We process the categories of data described in our privacy policy (account data, restaurant operations data including POS feeds, billing metadata) for the duration of your subscription, solely to provide Vaaku: scheduled agent briefings, dashboards, POS synchronization, billing, and support. We process data only on your documented instructions — using the product as intended counts as your instruction. If we believe an instruction violates data-protection law, we'll tell you.

Everyone at TwoTwo who touches customer data is bound by confidentiality obligations. POS credentials are stored encrypted and write-only; our staff cannot view the values.

We use the following sub-processors, each bound by data-processing terms at least as protective as this DPA:

• Supabase, Inc. — authentication, database, hosting (US)
• Stripe, Inc. — payment processing (US)
• Groq, Inc. — AI inference (US)
• NVIDIA Corporation — AI inference (US)
• Inngest, Inc. — scheduled background jobs (US)
• Upstash, Inc. — rate limiting (US)
• Sentry (Functional Software, Inc.) — error tracking (US)

We'll notify you before adding or replacing a sub-processor, and you may object on reasonable data-protection grounds within 14 days; if we can't accommodate the objection, you may terminate the affected subscription.

We maintain appropriate technical and organizational measures:

• encryption in transit (TLS 1.2+) and at rest;
• tenant isolation via row-level security in the database;
• encrypted, write-only storage of POS credentials;
• least-privilege access to production systems;
• regular dependency updates and error monitoring.

If we become aware of a personal-data breach affecting your data, we'll notify you without undue delay and within 72 hours where feasible, describing what happened, what data was affected, and what we're doing about it — so you can meet your own notification duties.

We'll help you respond to data-subject requests (access, correction, deletion) as far as our processing is concerned — including the self-service deletion described in our privacy policy — and we won't respond to a data subject directly unless you ask us to.

Your data is exportable while your account is active. On termination or your written request, we'll delete your personal and restaurant data within 30 days, except where law requires retention (e.g. billing records). Backups age out within 90 days.

As your service provider, we: process personal information only to provide Vaaku; don't sell or share it; don't retain, use, or disclose it outside the direct business relationship except as permitted by law; and will cooperate with your compliance, including notifying you if we can't meet these obligations.

TwoTwo operates from India; our sub-processors are US-based. By using Vaaku you consent to processing in these jurisdictions, protected by the contractual terms above.

Data-protection questions: privacy@vaaku.ai.