Data Processing Addendum

This Data Processing Addendum ("DPA") describes how Plato processes personal data when it does so on behalf of an organizer or community using the Platform.

This DPA is a business-to-business document. It applies where Plato processes personal data as a service provider on the instructions of a customer (for example, a community organizer), and it supplements the Terms of Service. It does not describe every processing activity: where Plato processes data in its own capacity — for example, for its own security, analytics, or legal obligations — our Privacy Policy applies.

• "Personal data" means information relating to an identified or identifiable individual that is processed through the Platform.
• "Data principal" (or data subject) means the individual to whom the personal data relates.
• "Customer" means the organizer or entity that uses Plato to process personal data in connection with its community.
• "Service" means the Plato Platform and related services.

The roles of Plato and the Customer depend on the circumstances and on the applicable law.

In many cases, a community organizer decides why and how member and event information is collected for their community, while Plato processes that information to provide the Service. In that scenario, the Customer acts in a controller or fiduciary-style role for that processing and Plato acts as a processor or service provider on the Customer's instructions.

This does not apply to every category of data. Where Plato processes personal data for its own legitimate purposes (for example, security, fraud prevention, platform analytics, or legal compliance), Plato acts in its own capacity and the Privacy Policy governs.

Where Plato processes personal data on behalf of a Customer, it will do so only on the Customer's documented instructions, except where applicable law requires otherwise. The Customer is responsible for the lawfulness of the instructions it gives, including ensuring it has an appropriate basis for the processing.

Personal data processed through the Service may include: account and profile information (such as name and email), community membership information, event and registration information, attendance records, messages and communications, task and announcement content, and certificate-related information. The categories will depend on how the Customer uses the Service.

Personal data may relate to the Customer's organizers, members, volunteers, event participants, and other individuals the Customer adds to the Platform in connection with its community.

Where Plato processes personal data on the Customer's behalf, it does so to provide the Service the Customer requested, including: community and membership management, event planning and registration, attendance tracking, communications and notifications, task management, certificate generation, and file sharing.

Plato ensures that personnel authorized to process personal data are subject to appropriate confidentiality obligations and will process the data only as necessary to provide the Service.

Plato maintains reasonable technical and organizational measures to protect personal data, including:

• encryption in transit;
• authenticated access and role-based authorization;
• least-privilege access to production systems;
• audit logging of privileged actions;
• security logging and monitoring;
• rate limiting and abuse controls;
• regular backups; and
• an incident-response process.

Details of internal infrastructure, credentials, and security configuration are not disclosed.

Plato uses third-party providers to operate the Service, including providers of authentication (Clerk), database hosting (Turso/LibSQL), file storage (Cloudflare R2), email delivery (Resend), and observability (Grafana Cloud).

A current list of sub-processors and third-party services is maintained by the operator and made available on request. Whether a particular provider is a sub-processor of the Customer's data depends on the provider's role and the applicable arrangements. Where Plato engages a sub-processor to process Customer data, it will ensure the sub-processor is bound by appropriate obligations.

The Platform provides data principals with mechanisms to exercise supported requests, including access, correction, export, deletion, and privacy grievances, through the Privacy area of their Settings. Where a data principal contacts a Customer directly, the Customer is responsible for responding. Where Plato receives a request that relates to a Customer's processing, Plato will, where appropriate, direct the request to the Customer and provide reasonable assistance.

Where a security incident affects personal data processed on a Customer's behalf, Plato will follow its incident-response process and provide reasonable assistance to the Customer, where required, to support the Customer's obligations — for example, with information about the incident needed for notification or reporting. Plato does not automatically report every incident to authorities on the Customer's behalf; notification obligations are determined by the Customer and applicable law.

Plato processes personal data for as long as needed to provide the Service, subject to the Platform's retention practices, which include:

• product/navigation activity retained for approximately 90 days;
• security events retained for approximately 365 days;
• admin audit records retained for approximately 730 days;
• temporary data exports expiring within approximately 7 days; and
• certificates and attendance records retained for verification and operational purposes.

On an approved account-deletion request, Plato removes or anonymizes the relevant personal data in accordance with its deletion workflow. Backup copies may persist for the backup lifecycle and expire according to the backup retention schedule.

Some third-party providers used to operate the Service may process or store data outside India as part of providing their services, in accordance with their service terms and applicable contractual arrangements. Where transfers occur, they are subject to the provider's applicable safeguards and Plato's arrangements with the provider.

Plato will provide reasonable assistance to a Customer in connection with the Customer's compliance obligations under applicable data protection law, including by making available information about Plato's processing and security practices, subject to confidentiality and without exposing internal security details.

This DPA applies while a Customer uses the Service. On termination of the Service, Plato will, where applicable, delete or return personal data processed on the Customer's behalf in accordance with the Terms of Service, unless applicable law requires retention.

Liability under this DPA is subject to the limitations set out in the Terms of Service. Each party remains responsible for its own obligations and for any liability arising from its own processing.

Questions about this DPA may be directed to hello@blear.in.