Draft — not legal advice
Data processing agreement
This page is a working draft for the v1 US region. It is not a signed agreement and it has not been reviewed by counsel.
This click-through draft describes how Nod processes personal data for a freelancer workspace. It is not yet presented at signup as a binding click-wrap, and it is not signed.
Roles
The freelancer is the controller of client and deal data they submit. Nod is the processor. Nod is an independent controller of account, billing, and security logs.
Instructions and security
Nod processes workspace data to provide the deal link, signature evidence, payment status, messaging, and filing features the freelancer turns on. Access is limited to tenant members through row-level security, plus service-role jobs that act on a single webhook or deal. Nod does not sell personal data.
International transfers
v1 storage is in the United States. For EEA and UK personal data, this draft incorporates the EU Standard Contractual Clauses (Module 2, controller to processor, and Module 3 where Nod is a sub-processor) and the UK Addendum. Where a sub-processor is certified under the EU-US Data Privacy Framework, that certification is the transfer tool named on the sub-processor list; otherwise the SCCs apply.
Sub-processors, breach, deletion
Sub-processors are listed on the sub-processors page. This draft commits to a notice before adding one. A personal-data breach is communicated to the freelancer without undue delay and within 72 hours of confirmation where the GDPR applies. Export and delete are available from the workspace security settings.