Data Processing Agreement

01About this DPA

This Data Processing Agreement (the “DPA”) is part of the Terms of Service between Datalogian LLC, which operates Prepped BK (“we”, “us”) and the subscribing law firm (the “Firm”). It applies automatically when the Firm accepts the Terms. If this DPA and the Terms conflict on the handling of Customer Data, this DPA controls.

Words defined in the Terms mean the same thing here.

02Definitions

• Customer Data: all data the Firm, its Users or its Clients put into the Service, and anything we derive from it for the Firm.
• Client: a person whose information the Firm collects through the Service, usually a bankruptcy client or prospective client.
• Data Protection Law: US federal and state laws that apply to the processing of Customer Data, including the Gramm-Leach-Bliley Act and its Safeguards Rule (16 C.F.R. Part 314) where they apply, state consumer privacy laws, and state data security and breach notification laws.
• Security Incident: a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Data.
• Subprocessor: a third party we engage that processes Customer Data.

03Roles

The Firm is the controller of Customer Data (a “business” or “controller” under state privacy laws). We are its processor (a “service provider” or “processor”), and, to the extent the Firm is a financial institution under the Gramm-Leach-Bliley Act, its service provider under that law.

The Firm is responsible for having a lawful basis to collect Customer Data, for any notices and consents its Clients need, and for the instructions it gives us.

04Processing only on the Firm’s instructions

We process Customer Data only to provide, secure and support the Service for the Firm, as described in the Terms, this DPA and the settings the Firm chooses in the Service. Those are the Firm’s complete instructions. Additional instructions need to be agreed in writing.

If we believe an instruction breaks Data Protection Law, we will tell the Firm and may decline to follow it. Annex A lists the details of the processing.

05What we will not do

We will not:

• Sell Customer Data, or share it for cross-context behavioral or targeted advertising.
• Use Customer Data to train, fine-tune or improve any AI model, ours or anyone else’s.
• Keep, use or disclose Customer Data for any purpose other than providing the Service to the Firm, or outside our direct business relationship with the Firm.
• Combine Customer Data with personal information we get from anyone else, except as the Service requires.
• Contact Clients except as the Firm directs through the Service, and never for marketing.
• Try to re-identify any de-identified data.

We will comply with Data Protection Law that applies to us as a service provider and give Customer Data the level of privacy protection it requires. We will tell the Firm if we can no longer meet these obligations, and the Firm may then take reasonable steps to stop and fix any unauthorized use. We certify that we understand and will comply with the restrictions in this section.

06Confidentiality and privilege

We understand that Customer Data includes information relating to the Firm’s representation of its Clients, which the Firm must protect under its rules of professional conduct (including the duty, reflected in ABA Model Rule 1.6(c), to make reasonable efforts to prevent unauthorized access or disclosure). We support those duties by:

• Treating all Customer Data as confidential.
• Limiting access to personnel who need it to run or support the Service, who are bound by written confidentiality obligations.
• Not viewing the contents of Customer Data except as needed to provide support the Firm asks for, to perform a paralegal review the Firm orders, to keep the Service secure, or to comply with law.
• Sending any subpoena, court order or other demand for Customer Data to the Firm where we can, and notifying the Firm promptly (unless the law forbids it) so the Firm can assert privilege or seek a protective order. We will disclose only what we are legally required to disclose.
• Answering the Firm’s reasonable due diligence questions about our safeguards.

Our processing of Customer Data is not intended to waive any privilege that belongs to the Firm or its Clients.

07Paralegal review personnel

When the Firm orders a paralegal review of a case, a trained paralegal employed by Datalogian LLC (a “Reviewer”) processes that case’s Customer Data on the Firm’s instructions. Reviewers are our own personnel, not a Subprocessor. For each review:

• One case, read only. The Reviewer can see only the case the Firm ordered the review for: its uploaded documents, the reading results and flags, and the Client’s answers. This limit, and the fact that a Reviewer cannot change case data, is enforced in the database itself, the same way firm isolation is.
• Limited in time. Access starts when a Reviewer picks up the request and ends when the notes are delivered or 7 days after the request, whichever comes first. Before pickup, Reviewers see only the request itself: the Firm’s name, the chapter, the planned filing date and any note the Firm adds. The Firm can cancel a request before it is picked up.
• Logged. Every view and download by a Reviewer is recorded in the Firm’s audit log under the Reviewer’s name, and the Firm can see it on the case.
• Confidentiality. Reviewers are trained for this work, bound by written confidentiality obligations, sign in with their own accounts and two-factor authentication, and use Customer Data only to perform the review. They do not keep copies of Customer Data after the review.
• No Client contact, no legal advice. Reviewers do not contact Clients. The review notes are a paralegal’s observations for the Firm’s attorney, not legal advice, and the attorney remains responsible for the case.
• The notes are Customer Data. They are stored encrypted, shown to the Firm in the Service and in its exports, and kept and deleted under this DPA like the rest of the case.

08Security

We maintain administrative, technical and physical safeguards appropriate to the sensitivity of Customer Data, including at least the measures in Annex B. We may update these measures over time, but we will not reduce the overall level of protection during the Firm’s subscription.

09GLBA Safeguards Rule

Some bankruptcy firms may be treated as financial institutions under the Gramm-Leach-Bliley Act for some purposes. Where the FTC Safeguards Rule applies to the Firm, it must oversee its service providers and require them by contract to protect customer information. To support that, we commit to:

• Implement and maintain safeguards that protect the security and confidentiality of the Firm’s customer information, protect against anticipated threats to it, and protect against unauthorized access or use that could harm Clients (Annex B describes them).
• Use and disclose nonpublic personal information only to provide the Service to the Firm.
• Give the Firm the information it reasonably needs to assess our safeguards periodically, as described in the Audits section.
• Notify the Firm of Security Incidents as described below, quickly enough for the Firm to meet any notification duty it has, including notice to the FTC.

10Subprocessors

The Firm authorizes the Subprocessors in Annex C. For each one, we have a written agreement that requires protections for Customer Data at least as strong as this DPA in substance, as fits the service it provides. We are responsible for our Subprocessors’ work under this DPA.

• Notice of changes. We will email the Firm’s account owner at least 30 days before we add or replace a Subprocessor, and update Annex C.
• Objections. The Firm may object on reasonable data protection grounds within that 30 days. We will work in good faith to address the objection. If we cannot, the Firm may cancel the affected part of the Service and receive a refund of prepaid fees for the unused period.
• Emergencies. If we must replace a Subprocessor urgently for security or continuity reasons, we will notify the Firm as soon as we can, and the objection right still applies.
• Limited services. Twilio receives only a Client’s mobile number and the reminder text, and only when the Firm enters a mobile number. Stripe processes only the Firm’s own billing data, never Client data.

11Security incidents

We will notify the Firm of a Security Incident without undue delay, and in any event within 72 hours after we become aware of it. This is faster than the 10 days Florida law allows a third-party agent (Fla. Stat. § 501.171(6)).

The notice will include, as far as we know at the time:

• What happened and when, and when we discovered it.
• The types of Customer Data and the Firm’s Clients likely affected.
• What we have done and will do to contain it and reduce harm.
• A contact person for the incident.

We will send updates as we learn more, investigate the cause, and give the Firm the information and help it reasonably needs to meet its own notice duties to Clients, regulators, courts or others. The Firm decides whether and how to notify its Clients. We will not notify Clients or regulators about a Security Incident involving Customer Data without the Firm’s approval, unless the law requires us to.

Notifying the Firm of a Security Incident is not an admission of fault.

12Help with Client requests

If a Client asks us to access, correct or delete their information, or to use any other privacy right, we will send the request to the Firm and not answer it ourselves unless the Firm tells us to. The Service lets the Firm view, export and delete Customer Data, and we will give reasonable additional help where it cannot do so on its own.

13Retention, return and deletion

• During the subscription. Uploaded files and their encryption keys are deleted automatically when the retention window the Firm sets (1 to 90 days) runs out. The Firm can delete cases and other data at any time.
• Export. The Firm can export its case data at any time while subscribed, and can ask us for an export at support@preppedbk.com for 30 days after its subscription ends.
• Deletion after termination. We delete all Customer Data from our active systems within 30 days after the subscription ends.
• Backups. Copies in backups age out and are permanently gone within a further 30 days. Until then, backups stay encrypted, are isolated from active use, and are restored only for disaster recovery.

If the law requires us to keep any Customer Data longer, this DPA continues to protect it, and we will use it only for that legal purpose. We will confirm deletion in writing on request.

14Audits and information

Once a year, or after a Security Incident, the Firm may send us a reasonable written security questionnaire, and we will answer it within 30 days. We will also provide other information the Firm reasonably needs to show its compliance with Data Protection Law and its professional duties. The Firm will keep our answers confidential.

15Where data is processed

We and our Subprocessors process Customer Data in the United States. We will give the Firm at least 30 days’ notice before processing it in another country, and the objection right in the Subprocessors section applies.

16Liability and term

Each side’s liability under this DPA is subject to the Limitation of liability section of the Terms. This DPA lasts as long as we process Customer Data for the Firm, including after the Terms end until deletion is complete.

17Annex A: Details of processing

• Subject matter and purpose: collecting documents from the Firm’s Clients, reading them with AI, checking amounts, requesting missing items, and organizing data for the Firm’s bankruptcy filings.
• Nature of processing: collection, storage, AI extraction, calculation, organization, email reminders, export and deletion, and, when the Firm orders one, review of a case by a Datalogian LLC paralegal.
• Duration: the Firm’s subscription, plus the deletion periods in this DPA.
• People concerned: the Firm’s Clients and prospective clients, and people who appear in their documents (such as spouses, dependents, employers and creditors). Also the Firm’s Users.
• Types of data: names and contact details; addresses; identity documents; employment and pay information; bank account balances and transactions (account numbers kept to the last four digits in extracted data); tax return information; credit report information, including debts and creditors; household information; and answers the Client gives in the questionnaire.
• Sensitive data: the Service is designed not to keep Social Security numbers in extracted data. Original uploaded files may show them, and are encrypted and deleted on the Firm’s retention schedule. The Firm should not upload health records or other sensitive data the Service does not ask for.

18Annex B: Security measures

Encryption

• Files are encrypted in the Client’s browser before upload (AES-256-GCM) and stored encrypted.
• Envelope encryption at the application level, with a separate key for each file, on top of our providers’ storage encryption. Deleting a file also destroys its key.
• TLS for all data in transit.

Access control

• Two-factor authentication required for every Firm User before any case data is reachable.
• Firm isolation enforced in the database itself, so one firm’s queries cannot return another firm’s data.
• Client upload links are private, hard to guess, and tied to a single case. Clients do not get accounts.
• Paralegal Reviewers have separate accounts with two-factor authentication, belong to no firm, and can read only a case under an open review they picked up, enforced in the database, until the review is delivered or 7 days pass.
• Our own administrative access is limited to the people who need it, protected by multi-factor authentication, and reviewed.

Data minimization

• No field exists for Social Security numbers, and the system refuses to save output that looks like one.
• Account numbers are truncated to the last four digits in extracted data.
• Uploaded files are deleted automatically on the Firm’s retention schedule. Unfinished uploads are purged daily.
• Customer Data is never used to train AI models.

Monitoring and response

• An audit log records sign-ins, uploads, exports, deletions and other account activity, including every view and download by a paralegal Reviewer.
• Application and access logs are reviewed for misuse.
• A written incident response process, including the 72-hour Firm notification in this DPA.

Vendors and operations

• Subprocessors are reviewed for security before use and bound by written data protection terms.
• Hosting and database providers maintain their own physical and environmental security controls.
• Software changes are reviewed before release, and dependencies are kept up to date.
• Encrypted backups support recovery, and age out on the schedule in this DPA.

19Annex C: Subprocessors

Paralegal reviews are performed by Datalogian LLC’s own trained review staff, not by a Subprocessor. See Paralegal review personnel above.

Questions about this DPA or a request for a signed copy: support@preppedbk.com. Prepped BK sends notice of Subprocessor changes by email to each Firm’s account owner.