Data Processing Addendum
Effective: April 3, 2026Last updated: September 17, 2026
This Data Processing Addendum ("DPA") forms part of the agreement between ContraForge LLC ("ContraForge," "Processor," "we," "us," or "our") and the entity agreeing to these terms ("Client," "Controller," or "you") for the provision of the PaidWrite service (the "Service Agreement"). This DPA governs the Processing of Personal Data by ContraForge on behalf of Client in connection with the PaidWrite platform.
By using PaidWrite, Client agrees to this DPA. If Client does not agree, Client must not submit Personal Data through the Service.
1. Definitions
1.1 "Applicable Data Protection Law" means all laws and regulations relating to the Processing of Personal Data that apply to the Processing contemplated by this DPA, including but not limited to: (a) the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA"); (b) the General Data Protection Regulation (EU) 2016/679 ("GDPR"); (c) the UK General Data Protection Regulation ("UK GDPR"); and (d) any other applicable federal, state, or international data protection legislation.
1.2 "Controller" means the entity that determines the purposes and means of Processing Personal Data. Under this DPA, the Client is the Controller.
1.3 "Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
1.4 "Personal Data" means any information relating to a Data Subject that is Processed by ContraForge on behalf of Client through the PaidWrite service. For CCPA purposes, this includes "Personal Information" as defined under Cal. Civ. Code Section 1798.140(v).
1.5 "Processing" (and "Process") means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.
1.6 "Processor" means the entity that Processes Personal Data on behalf of the Controller. Under this DPA, ContraForge is the Processor.
1.7 "Sub-processor" means any third party engaged by ContraForge to Process Personal Data on behalf of Client.
1.8 "Security Incident" means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored, or otherwise Processed by ContraForge or its Sub-processors.
1.9 "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to processors established in third countries, as adopted by the European Commission or the UK Information Commissioner's Office, as applicable.
2. Scope and Application
2.1 This DPA applies to ContraForge's Processing of Personal Data on behalf of Client in connection with the PaidWrite document analysis service.
2.2 This DPA applies where and only to the extent that: (a) ContraForge Processes Personal Data on behalf of Client as a Processor in the course of providing PaidWrite; and (b) such Processing is subject to Applicable Data Protection Law.
2.3 This DPA does not apply to data that ContraForge Processes as a Controller in its own right (for example, device identifiers and payment records used for billing and service administration), which is governed by the PaidWrite Privacy Policy.
2.4 In the event of any conflict between this DPA and the Service Agreement, this DPA shall prevail with respect to the Processing of Personal Data.
3. Roles of the Parties
3.1 Client as Controller. Client is the Controller of Personal Data submitted to PaidWrite. Client determines the purposes and means of Processing and is responsible for ensuring it has a lawful basis to submit Personal Data to the Service.
3.2 ContraForge as Processor. ContraForge is the Processor of Personal Data submitted by Client through PaidWrite. ContraForge Processes Personal Data solely in accordance with Client's documented instructions and this DPA.
3.3 Client Responsibilities. Client shall: (a) comply with all Applicable Data Protection Laws in its use of PaidWrite; (b) ensure it has obtained all necessary consents, authorizations, or other legal bases to submit Personal Data to the Service; (c) ensure that only documents appropriate for AI-based analysis are submitted; and (d) not submit documents containing categories of sensitive Personal Data (such as medical records or financial account numbers) unless Client has confirmed the lawful basis for doing so.
4. Processing Details
4.1 Nature of Processing. AI-powered document analysis. Client submits construction-industry documents (subcontract agreements, change orders, W-9 forms, lien waivers, insurance certificates, and similar documents) for automated compliance review and risk assessment.
4.2 Purpose of Processing. To analyze submitted documents for contractual risk, regulatory compliance, and completeness; to generate structured analysis results (risk scores, compliance issue summaries, clause-by-clause assessments); and to return those results to Client.
4.3 Duration of Processing. The original document file is deleted within thirty (30) seconds of upload. Extracted document text is held encrypted only for the duration necessary to generate the analysis (usually under a minute) and is deleted when the analysis finishes or fails; a scheduled hourly sweep removes any stale copy. Analysis results are retained as described in Section 12.
4.4 Categories of Data Subjects. Data Subjects whose Personal Data may appear in submitted documents include: contractors, subcontractors, project owners, company officers, signatories, notaries, insurance agents, and other individuals named in construction-industry documents.
4.5 Types of Personal Data. Personal Data Processed may include: names, business addresses, business phone numbers, email addresses, signatures, job titles, company affiliations, contractor license numbers, and taxpayer identification information appearing in submitted documents. ContraForge does not extract or store PII from documents — only structured analysis results.
4.6 The complete Processing details are set out in Annex A of this DPA.
5. ContraForge's Obligations
5.1 Processing on Instructions. ContraForge shall Process Personal Data only on documented instructions from Client, unless required to do so by applicable law. The Service Agreement and this DPA constitute Client's complete initial instructions. Client may issue additional instructions consistent with the Service Agreement in writing to privacy@paidwrite.app.
5.2 Confidentiality. ContraForge shall ensure that all persons authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
5.3 Security. ContraForge shall implement and maintain the technical and organizational security measures described in Section 6 and Annex B.
5.4 Sub-processors. ContraForge shall comply with the requirements of Section 7 before engaging any Sub-processor.
5.5 Data Subject Rights. ContraForge shall assist Client in responding to Data Subject requests as described in Section 9.
5.6 Breach Notification. ContraForge shall notify Client of any Security Incident as described in Section 10.
5.7 Deletion. Upon termination of the Service Agreement, ContraForge shall delete or return Personal Data as described in Section 12.
5.8 Audit. ContraForge shall make available to Client the information necessary to demonstrate compliance with this DPA as described in Section 11.
5.9 Notification of Conflicting Instructions. ContraForge shall immediately inform Client if, in ContraForge's opinion, an instruction from Client infringes Applicable Data Protection Law.
6. Security Measures
ContraForge implements and maintains the following technical and organizational measures to protect Personal Data:
6.1 Encryption in Transit. All data transmitted between Client devices and ContraForge infrastructure is encrypted using TLS 1.2 or higher.
6.2 Encryption at Rest. All stored data (analysis results, device records, payment records) is encrypted at rest using AES-256 or equivalent encryption provided by the infrastructure provider. Extracted document text is additionally application-encrypted for the short time it exists.
6.3 Transient Document Storage. The original document file is deleted within thirty (30) seconds of upload. Extracted text is held encrypted only while the analysis runs and is deleted when it finishes or fails; a scheduled hourly sweep scrubs any stale copy. Document text is never written to log files or error reports on ContraForge systems.
6.4 No PII Extraction. The analysis pipeline is designed to generate structured risk assessments and compliance summaries. Personal Data appearing in documents is not extracted, indexed, or stored as part of analysis results.
6.5 Access Controls. Access to production systems and stored data is restricted to authorized ContraForge personnel on a need-to-know basis. The administrative panel is protected by multi-factor authentication (TOTP), and every administrative action is audit-logged.
6.6 Infrastructure Isolation. Application services, the database, and the message queue are deployed in isolated environments with network-level access restrictions.
6.7 Monitoring. ContraForge uses application monitoring (Sentry) to detect errors and anomalies. Monitoring is configured to exclude Personal Data from error reports.
6.8 Secure Development. ContraForge follows secure development practices, including code review, automated testing, dependency scanning, and strict type enforcement.
6.9 The complete list of technical and organizational measures is set out in Annex B of this DPA.
7. Sub-processors
7.1 Authorized Sub-processors. Client provides general authorization for ContraForge to engage Sub-processors to Process Personal Data. The current list of Sub-processors is maintained at paidwrite.app/subprocessors.
7.2 Sub-processor Obligations. ContraForge shall: (a) enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than those in this DPA; and (b) remain fully liable to Client for the performance of each Sub-processor's obligations.
7.3 Notification of Changes. ContraForge shall notify Client at least thirty (30) days before adding or replacing a Sub-processor by updating the Sub-processor list and sending notice to Client's registered email address.
7.4 Right to Object. Client may object to a new or replacement Sub-processor within fifteen (15) days of receiving notification by sending written notice to privacy@paidwrite.app. The objection must state reasonable grounds relating to data protection. If ContraForge cannot reasonably accommodate the objection, either party may terminate the affected portion of the Service Agreement without penalty.
7.5 Emergency Sub-processor Changes. In urgent circumstances (such as a Sub-processor security incident), ContraForge may replace a Sub-processor with less than 30 days' notice, provided ContraForge notifies Client as soon as practicable and Client retains the right to object under Section 7.4.
8. International Data Transfers
8.1 Primary Processing Location. Personal Data is Processed primarily in the United States. ContraForge's hosting infrastructure (Railway), database (Neon on AWS us-west-2, Oregon), message queue (CloudAMQP), email delivery (Resend), and website/edge services (Cloudflare) are US-based services.
8.2 AI Processing Providers. PaidWrite routes document text to third-party AI inference providers via a LiteLLM proxy for analysis. Google (Gemini) is the primary provider; Groq and OpenRouter are fallback providers used only when the primary is unavailable (Anthropic models are reachable only as an OpenRouter fallback route). Personally identifying information is masked in-process before transmission, and prompt/response bodies are never logged by the proxy. Document text sent to these providers is subject to the transient-storage architecture described in Section 6.3 — text is transmitted for inference only and is deleted by ContraForge when the analysis completes. Gemini is used only on a paid plan whose terms exclude training on the data.
8.2a Optional Server-Side OCR (Google Cloud Vision). Server-side text extraction runs locally (Tesseract) by default, and no document image leaves ContraForge's infrastructure. If the optional Google Cloud Vision OCR driver is enabled (requires explicit operator acknowledgment), the raw document image is transmitted to Google Cloud Vision (US) for text extraction — in transit only, not stored — before the PII-masking step described in 8.2. When enabled, Google Cloud Vision is a Subprocessor governed by the Google Cloud Data Processing Addendum, and is listed as such on the Subprocessor List.
8.3 AI Provider Data Residency. All AI inference providers currently used by PaidWrite (Google Gemini, Groq, and OpenRouter) operate their inference infrastructure in the United States. ContraForge does not transmit document text to any AI inference provider that processes data in the People's Republic of China. Should ContraForge engage an inference provider that processes data outside the United States, it will update the Subprocessor List, provide advance notice as described in that document, and offer Client the ability to exclude such provider. Client may contact privacy@paidwrite.app to discuss provider restrictions.
8.4 Standard Contractual Clauses. To the extent that Personal Data originating in the European Economic Area, United Kingdom, or Switzerland is transferred to a country not recognized as providing an adequate level of data protection, ContraForge shall enter into Standard Contractual Clauses with Client upon request. The applicable SCCs shall be the European Commission's standard contractual clauses (Module Two: Controller to Processor), as supplemented by any necessary transfer impact assessment.
8.5 CCPA Compliance. For purposes of the CCPA, ContraForge is a "Service Provider." ContraForge does not sell or share Personal Information. ContraForge Processes Personal Information only for the business purposes specified in this DPA and the Service Agreement.
9. Data Subject Rights
9.1 Assistance. ContraForge shall, taking into account the nature of the Processing, assist Client by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Client's obligation to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law, including rights of access, rectification, erasure, restriction, portability, and objection.
9.2 Notification. If ContraForge receives a request directly from a Data Subject regarding Personal Data Processed on behalf of Client, ContraForge shall promptly redirect the Data Subject to Client and notify Client of the request, unless prohibited by law.
9.3 Scope of Assistance. Given PaidWrite's transient-document architecture, ContraForge's ability to identify and retrieve specific Personal Data is limited to: (a) analysis results associated with a device UUID; and (b) any email address associated with that device through email-to-scan. ContraForge does not retain the original document or its extracted text once an analysis has finished.
9.4 Response Timeline. ContraForge shall respond to Client's requests for assistance under this Section without undue delay and in any event within ten (10) business days.
10. Data Breach Notification
10.1 Notification. ContraForge shall notify Client of any confirmed Security Incident without undue delay and in any event within seventy-two (72) hours of becoming aware of the incident, by email to Client's registered contact address.
10.2 Content of Notification. The notification shall include, to the extent known at the time: (a) the nature of the Security Incident, including the categories and approximate number of Data Subjects and Personal Data records affected; (b) the name and contact details of ContraForge's point of contact (privacy@paidwrite.app); (c) a description of the likely consequences of the incident; and (d) a description of the measures taken or proposed to address the incident, including measures to mitigate its adverse effects.
10.3 Ongoing Updates. ContraForge shall provide supplementary information as it becomes available and shall cooperate with Client and any supervisory authority in investigating and remediating the incident.
10.4 Not an Acknowledgment of Fault. Notification of a Security Incident under this Section shall not be construed as an acknowledgment of fault or liability by ContraForge.
11. Audit Rights
11.1 Audit Information. ContraForge shall make available to Client all information reasonably necessary to demonstrate compliance with this DPA.
11.2 Audit Method. Client's audit right may be satisfied by: (a) ContraForge providing a current SOC 2 Type II report, ISO 27001 certification, or equivalent third-party audit report covering the systems used to Process Personal Data; or (b) if no such report is available, an on-site or remote audit conducted by Client or Client's independent third-party auditor, subject to the conditions in this Section.
11.3 Audit Conditions. Audits under Section 11.2(b) shall: (a) occur no more than once per calendar year; (b) be conducted during normal business hours with at least thirty (30) days' prior written notice; (c) be subject to reasonable confidentiality obligations; (d) not unreasonably interfere with ContraForge's business operations; and (e) be conducted at Client's expense.
11.4 Audit Scope. Audits are limited to ContraForge's Processing of Personal Data on behalf of Client and compliance with this DPA. Audits shall not extend to other clients' data or ContraForge's proprietary algorithms and models.
12. Data Retention and Deletion
12.1 Retention Periods. ContraForge retains data associated with Client's use of PaidWrite as follows:
| Data Type | Retention Period |
|---|---|
| Original document file | Deleted within 30 seconds of upload |
| Extracted document text | Deleted when the analysis finishes or fails; hourly sweep scrubs stale rows |
| Analysis results (risk scores, summaries) | Until deleted by the user in the app or by request |
| Device records | Deleted 24 months after last activity (scheduled purge planned) |
| Payment records (Stripe transaction data) | Seven (7) years (tax and legal compliance); excluded from deletion requests |
12.2 Deletion on Termination. Upon termination of the Service Agreement, and upon Client's written request, ContraForge shall delete all Personal Data Processed on behalf of Client within thirty (30) days, except where retention is required by applicable law (such as payment records retained for tax compliance).
12.3 Certification. Upon Client's request, ContraForge shall certify in writing that it has complied with the deletion obligations in this Section.
13. Term and Termination
13.1 Term. This DPA shall remain in effect for the duration of the Service Agreement between Client and ContraForge. This DPA shall automatically terminate when the Service Agreement terminates or expires.
13.2 Survival. Sections 10 (Data Breach Notification), 11 (Audit Rights), 12 (Data Retention and Deletion), and 14 (Liability) shall survive termination of this DPA.
14. Liability
14.1 Liability Cap. Each party's total aggregate liability arising out of or related to this DPA shall be subject to the limitations of liability set forth in the Service Agreement.
14.2 No Double Recovery. Nothing in this DPA shall entitle Client to recover the same damages more than once under both the Service Agreement and this DPA.
15. General Provisions
15.1 Governing Law. This DPA shall be governed by and construed in accordance with the laws of the State of California, United States, without regard to its conflict of laws principles.
15.2 Amendments. This DPA may be amended only in writing signed by both parties. ContraForge may update Annex B (Technical and Organizational Measures) from time to time to reflect improvements to its security posture, provided such updates do not materially reduce the level of protection afforded to Personal Data.
15.3 Severability. If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.
15.4 Entire Agreement. This DPA, together with the Service Agreement and the PaidWrite Privacy Policy, constitutes the entire agreement between the parties regarding the Processing of Personal Data.
Contact
For questions about this DPA or to exercise any rights described herein:
- Privacy inquiries: privacy@paidwrite.app
- Legal inquiries: legal@paidwrite.app
- Company: ContraForge LLC, 3870 La Sierra Avenue #1105, Riverside, CA 92505, USA
Annex A: Processing Details
| Detail | Description |
|---|---|
| Processor | ContraForge LLC |
| Nature of Processing | Automated AI-powered analysis of construction-industry documents for contractual risk, compliance, and completeness |
| Purpose of Processing | To provide Client with structured risk assessments, compliance issue identification, and clause-by-clause analysis of submitted documents |
| Duration of Processing | Original file: deleted within 30 seconds. Extracted text: deleted when the analysis finishes or fails. Analysis results: until deleted by the user. Device records: 24 months after last activity. Payment records: 7 years. |
| Categories of Data Subjects | Contractors, subcontractors, project owners, company officers and directors, signatories, notaries, insurance agents, and other individuals named in construction-industry documents |
| Types of Personal Data | Names, business addresses, business phone numbers, email addresses, signatures, job titles, company affiliations, contractor license numbers, and taxpayer identification information as they appear in submitted documents. Note: PII is not extracted or stored — only structured analysis results are retained. |
| Sensitive Data | Not intentionally Processed. Client is advised not to submit documents containing sensitive personal data (health, biometric, racial/ethnic origin) unless Client has a lawful basis. |
Annex B: Technical and Organizational Measures (TOM)
B.1 Encryption
| Measure | Implementation |
|---|---|
| Encryption in transit | TLS 1.2+ for all client-server and server-server communications |
| Encryption at rest | AES-256 (or provider equivalent) for the persistent data store (Neon/AWS Postgres); extracted text additionally application-encrypted while it exists |
| Key management | Provider-managed keys (Neon, AWS); application secrets rotated quarterly |
B.2 Transient Document Storage
| Measure | Implementation |
|---|---|
| Original file | Used for text extraction only and deleted within 30 seconds of upload |
| Extracted text | Held encrypted only while the analysis runs (usually under a minute); deleted when it finishes or fails; hourly sweep scrubs stale rows |
| Log exclusion | Document text is excluded from application logs and error reporting (Sentry) |
B.3 Access Controls
| Measure | Implementation |
|---|---|
| Authentication | Multi-factor authentication (TOTP) on the administrative panel; every admin action audit-logged |
| Authorization | Role-based access control; least-privilege principle |
| Device identity | Device UUID model — no user accounts or passwords |
| API authentication | Token-based API authentication for all service requests |
B.4 Infrastructure Security
| Measure | Implementation |
|---|---|
| Hosting | Railway (US-based, isolated deployment environments) |
| Database | Neon/AWS Postgres (encrypted, access-restricted) |
| Queue | CloudAMQP hosted message queue (job and device identifiers only) |
| Website / edge | Cloudflare Pages, Workers/KV (waitlist), Turnstile, email routing |
| Network isolation | Application services, the database, and the queue are deployed in isolated environments |
B.5 Application Security
| Measure | Implementation |
|---|---|
| Secure development | Code review, automated testing (PestPHP, Jest), strict typing (PHP strict types, TypeScript strict mode) |
| Static analysis | Larastan level 8, PHP Pint (PSR-12) |
| Dependency management | Regular dependency updates and vulnerability scanning |
| Error monitoring | Sentry (configured to exclude Personal Data from error reports) |
B.6 Payment Security
| Measure | Implementation |
|---|---|
| Payment processing | Stripe (PCI DSS Level 1 compliant) |
| Card data | Full payment card details are never stored on ContraForge systems |
| Stored payment data | Limited to Stripe session ID, transaction amount, and payment status |
B.7 AI Provider Security
| Measure | Implementation |
|---|---|
| Provider routing | LiteLLM proxy with provider-level API key management |
| Providers | Google Gemini (primary); Groq and OpenRouter (fallback, all US-based) |
| Data sent to providers | PII-masked document text for inference only — deleted by ContraForge when the analysis completes |
| Provider agreements | Each AI provider is bound by its respective data processing terms |
| Data residency | All inference providers operate US-based infrastructure; no document text is transferred to the People's Republic of China |
B.8 Email and Communications
| Measure | Implementation |
|---|---|
| Transactional email | Resend (US-based) |
| Email content | Limited to receipts and analysis result summaries — no raw document text |
B.9 Incident Response
| Measure | Implementation |
|---|---|
| Breach notification | Within 72 hours of confirmed incident |
| Monitoring | Automated error and anomaly detection via Sentry |
| Contact | privacy@paidwrite.app |
B.10 Data Minimization and Retention
| Measure | Implementation |
|---|---|
| Collection minimization | Device identity (UUID) only; no accounts; email optional (email-to-scan) |
| Storage minimization | Transient document storage; only structured analysis results retained |
| PII exclusion | Analysis results are designed to contain risk scores and compliance summaries, not extracted PII |
| Retention enforcement | Analysis results: until user deletion (in-app or by request). Device records: 24 months after last activity. Payment records: 7 years. |
This Data Processing Addendum is provided for informational purposes and governs the data processing relationship between ContraForge LLC and its clients. PaidWrite's analysis results do not constitute legal advice. Consult a qualified attorney for legal guidance.