Skip to content
PaloWorks
Start free

Data Processing Addendum

Last updated: October 10, 2026

Part of a set with the Terms of Service and the Privacy Policy. Where this addendum and the Terms disagree about personal data, this addendum wins.

1. Who is who

When you put your clients' details into PaloWorks, you decide what is collected and why. For that data you are the controller, and Ferrier Industries LLC, a Wyoming limited liability company, is your processor: we handle it only to run the service for you. For your own account details and billing, we are the controller, as described in the Privacy Policy.

This addendum applies automatically to every workspace for as long as you use PaloWorks. There is nothing to sign; accepting the Terms of Service accepts it.

2. What we process

Whose data:

  • Your clients and their contacts — the people you send intake, scope, contract, change-order, invoice, portal, and status links to
  • People who send an inquiry through your public Book me page
  • Members of your workspace

What kinds:

  • Names, email addresses, company names, and billing addresses or tax numbers you put on an invoice
  • What a client types into an intake form, a message thread, or a Book me inquiry
  • Approval and signing records: the typed name, time, IP address, browser user agent, and a hash of the document text
  • Invoice and payment records: amounts, due dates, and payment status (card details stay with Stripe)
  • Delivery records for the email the product sends on your behalf: the address and whether the message arrived

Why:

  • Hosting and showing your workspace to you and your members
  • Showing each document to whoever holds its link, and recording approvals, signatures, and payments
  • Sending the email you trigger, and the reminders you switch on
  • Taking card payments through your own connected Stripe account
  • Producing an AI draft when you ask for one, and, on Pro and Studio, three automatic reads: a newly logged revision round against its scope, a submitted intake summarised for your email, and the Friday review's paragraph, written from totals only

We process it for as long as your account is open, and then for the deletion period in section 7. The product is not built for special-category data such as health records, and you should not put it there.

3. Our commitments as processor

  • We process your clients' data only to provide PaloWorks and on your instructions, which are the Terms, this addendum, and what you do in the product. We tell you if we believe an instruction breaks the law.
  • We do not sell it, use it to advertise, or use it to train AI models.
  • For California law, Ferrier Industries LLC is a service provider and contractor. We will not sell or share personal information of your clients, or retain it for a purpose other than providing the Service.
  • Anyone at Ferrier Industries LLC who can reach it is bound to keep it confidential.
  • We help you answer requests from the people whose data it is, and with any assessment or consultation your law requires, as far as the information we hold allows.
  • We tell you without undue delay, and in any event within 72 hours after we become aware, of a breach affecting your clients' data, with what we know and what we are doing about it.

4. Subprocessors

You authorise us to use the subprocessors below. Each receives only what it needs for the purpose given. This list is rendered from the same registry as the Privacy Policy, so the two always match; the Privacy Policy also lists the advertising on our public site, named apart below.

  • Vercel — hosts the application and serves every page.
  • Supabase — stores your account and workspace data.
  • Stripe — subscription billing, and card payments from your clients through your own connected Stripe account.
  • Resend — delivers the email the product sends: sign-in links, documents and reminders you send to clients, receipts, and notifications.
  • PostHog — product analytics, and session replays of the public marketing pages, in the United States. Our servers send the event name, a timestamp, and the workspace id (the user id for a new sign-up) when something happens in the product, with details such as a record’s id or an invoice’s amount in cents. The browser sends which page was opened — the path only, with ids, share-link tokens and the query string removed — plus the referring site, campaign tags, how long a page was open and how far it was scrolled, and the browser’s user agent, language, time zone and screen size, and on the public marketing pages which links, buttons and form fields are used. On those pages only, it also sends session replays: what the page shows and how the pointer moves, clicks and scrolls, with what is typed into a form field, any search text shown back on the page, and the text, links and images outside the page’s own content masked before anything leaves the browser, and the address cut to its path; replays never record the signed-in product, the sign-in and sign-up pages, or a share link. After a click on one of our ads in ChatGPT, the browser also reports whether that ad’s measurement reached OpenAI. Once you are signed in, the browser’s events carry your user id, plan, role and workspace id. It keeps nothing on your device, and it never receives a document, a client’s name, or an email address.
  • Microsoft Clarity — heatmaps and session replays of the public marketing pages only, from Microsoft Corporation in the United States. The browser sends what the page shows, how the pointer moves, clicks and scrolls, the page's full address (query string included: campaign tags, an ad network's click id, or a template filter), the referring site, and the browser's user agent, language and screen size. Every form field, and any search text shown back on the page, is masked before anything leaves the browser; the free tools and the demo, which show back what a visitor types, and any page whose address carries more than campaign tags, ad click ids or template filters, are not recorded. It keeps nothing on your device, and it never runs in the signed-in product, on the sign-in and sign-up pages, or on a share link.
  • OpenAI — the model provider behind the AI-assisted drafts and reads, which are on Pro and Studio. When you press a button that asks for a draft (a scope from a brief, a verdict on a revision request, a payment chase email, a plain-language contract summary), we send the text that draft needs, which can include your client’s brief and name and the scope or contract text, to OpenAI and show you the result to edit. Three run without a button: when a revision round is logged, the round is read against the scope and a verdict is filed on the project; when a client submits an intake, it is summarised for the email that tells you; and the Friday review’s paragraph is written from the week’s totals, with no client or workspace names. A client you mark as not allowing AI is never read by the first two. Nothing is sent on the Free plan, or when AI is not set up. OpenAI’s API terms govern its handling of that text. Optional logo background cleanup. Only when you request a preview, the selected logo is sent to OpenAI. You review and approve the result before it replaces your saved logo. No client documents or other workspace data accompany the image request.
  • Amazon Web Services — stores files you attach — proofs, signed PDFs, receipts — in a private S3 bucket in us-east-1. Objects are not public. A download uses a short-lived signed URL. When file storage is not configured, uploads are refused and this processor receives nothing.
  • Google — only if you choose to sign in with Google. Google then knows you signed in to PaloWorks.

Separately, our own advertising on paloworks.com, Google Ads and ChatGPT Ads, concerns visitors to our public site. It never receives anything from a workspace, so it is not a subprocessor of the data this addendum covers; the Privacy Policy says what each receives.

When we add or replace a subprocessor, this list and the date at the top change. If the change is material we tell you by email or in the product. If you object on reasonable data-protection grounds, write to support@paloworks.com; if we cannot address it, you may close your account, and the refund terms in the Refund Policy still apply.

5. Security

What protects the data today:

  • Encryption in transit (HTTPS) and at rest by our hosting and database providers
  • Every database query scoped to your workspace, with that boundary covered by its own tests
  • Hashed passwords, optional TOTP two-factor, passkeys, and sessions you can review and revoke
  • Share links built on long random tokens that you can rotate or revoke from the project
  • An activity log per workspace that records approvals, signatures, invoices, and team changes

We do not publish a third-party compliance certification. Security problems go to security@paloworks.com, the contact also listed in /.well-known/security.txt.

6. International transfers

PaloWorks and its subprocessors may store and process data in the United States and other countries where they operate. On written request we will make available the EU Standard Contractual Clauses and the UK IDTA addendum. Until they are attached as a schedule, write to support@paloworks.com.

7. Retention, return, and deletion

  • Return: the workspace owner can download the whole workspace as JSON from Settings → Your data at any time, and clients, invoices, payments, and time as CSV.
  • A deleted project waits in Settings → Recently deleted for 30 days and is then purged.
  • When you close your account, we delete your workspace data within 30 days, except records the law requires us to keep, such as invoices tied to processed payments.
  • While the account is open, the text of an AI draft is erased after 30 days and its remaining record after 365 days; the email delivery log is deleted after 90 days; expired sign-in sessions after 7 days.

8. Information and audits

We answer reasonable written questions about how we process your clients' data and give you the information you need to show that this addendum is being kept. Send them to support@paloworks.com.

9. Liability and disputes

This addendum is part of the Terms of Service and does not enlarge our liability. The limitation of liability, binding individual arbitration, and governing law in those terms apply to it, except where the law that protects the data subjects requires otherwise.

10. Contact

Questions about this addendum: support@paloworks.com. Ferrier Industries LLC is a Wyoming limited liability company. PaloWorks by Ferrier Industries LLC. Mailing address: 30 N Gould St #69044, Sheridan, WY 82801, USA. Write to legal@ferrierindustries.com.

This addendum is provided by Ferrier Industries LLC. It is not legal advice.