This addendum forms part of the Terms of Service between Optracs LLC ("Processor"), of 5900 Balcones Dr, Ste 100, Austin, TX 78731-4298, and the Customer ("Controller"). Where it conflicts with the Terms on the handling of personal data, this addendum wins.
1. Roles
The Customer decides why and how personal data in its workspace is processed. It is the controller. Optracs processes that data only on the Customer's instructions. It is the processor.
This allocation is not a formality. The Customer decides who to contact, what to keep, and what consent it has. Optracs does not and cannot make those decisions for it.
2. Scope
| Subject matter | Providing the Optracs platform |
|---|---|
| Duration | The term of the agreement, plus the deletion window in section 8 |
| Nature and purpose | Hosting, storing, transmitting, and displaying Customer Data so the Customer can run its business |
| Types of personal data | Names, postal addresses, email addresses, telephone numbers, property addresses, photographs of property, insurance claim details, payment records, contract and signature records, communication logs, and whatever else the Customer chooses to enter |
| Categories of data subject | The Customer's employees and contractors; the Customer's own customers and prospects, typically homeowners; insurance adjusters and other third parties recorded in the course of a job |
3. Instructions
Optracs processes personal data only on documented instructions from the Customer. The Terms of Service, this addendum, and the Customer's use of the platform's features are those instructions.
If Optracs is required by law to process data beyond those instructions, it will tell the Customer first unless the law forbids it. If Optracs believes an instruction breaks data protection law, it will say so.
4. Confidentiality
Everyone at Optracs with access to personal data is bound by confidentiality obligations and is granted access only as their role requires.
5. Security
Optracs maintains technical and organisational measures appropriate to the risk, including:
- Encryption of data in transit and at rest.
- Tenant separation enforced at the database layer, so that a query executed in one workspace cannot return another workspace's rows. This is verified by an automated isolation suite that runs against a throwaway database on every schema change; a change that breaks separation fails the build.
- Role-based access control within a workspace, with permissions checked in the database rather than only in the interface.
- Sign-in by password or emailed link. Passwords are held only as a one-way hash by the authentication provider; a new device must prove the account's email address before it is trusted; and an authenticator app can be added as a second factor.
- Restricted production access, granted to named individuals.
Optracs may change these measures, but not in a way that materially weakens security.
6. Subprocessors
The Customer authorises Optracs to use the subprocessors in the subprocessor list, which states what each one can access.
Optracs will give at least 30 days' notice before adding or replacing a subprocessor. The Customer may object on reasonable data protection grounds; if the objection cannot be resolved, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees.
Each subprocessor is bound by written terms no less protective than these. Optracs remains liable for its subprocessors' acts and omissions.
7. Assisting the Customer
Data subject requests. If a data subject contacts Optracs directly, Optracs will not respond on the merits and will refer them to the Customer. Optracs will help the Customer respond, using the platform's own access, export, correction, and deletion features where possible.
Breach notification. Optracs will notify the Customer without undue delay and in any case within 72 hours of becoming aware of a personal data breach affecting the Customer's data, with what is known at the time, and will keep the Customer updated.
Assessments. Optracs will provide the information the Customer reasonably needs for a data protection impact assessment or a consultation with a regulator.
8. Deletion and return
On termination, the Customer may export its data for 30 days. After that window Optracs deletes it. Where a workspace is closed for non-payment, the export window is the 30 days described in the Terms of Service, not an additional 30.
The platform provides a workspace-level purge that removes business records and stored files. Two limits, stated because a promise of complete deletion would be false:
Deleted data persists in encrypted backups until those roll off, and no longer than approximately 7 days. Backups are not mined and individual records are not restored from them.
That figure is the retention of the database provider's daily automatic backups on its Pro plan, and this clause is written to that ceiling deliberately. Today Optracs is on the provider's free plan, which keeps no automatic backups at all, so deleted data does not persist in any backup. The Customer should also know the other side of that: with no automatic backups, a loss on Optracs' side cannot be restored from one.
- Files are held in Optracs' own storage (Cloudflare R2), not in any Customer-controlled location. Optracs can therefore delete them, and does: marking a file deleted frees the Customer's allowance at once, and a daily sweep removes the bytes at the vendor. There is no category of Customer file that Optracs is unable to erase.
Optracs keeps what the law requires it to keep, and may keep aggregate statistics that do not identify anyone. Two further records outlast a deletion, each for its own reason: Optracs' record of what its own staff did in the Customer's workspace, kept for 36 months so that a question about it can still be answered; and an email address that bounced or complained about mail from Optracs' shared sending domain, kept so that it is not mailed again.
9. Audit
On request, Optracs will make available the documentation needed to demonstrate compliance with this addendum, including what its subprocessors publish about their own security. The Customer may also carry out one audit a year, at its own cost, on at least 30 days' written notice, during business hours, subject to confidentiality, and in a way that neither disrupts the service nor exposes any other customer's data.
10. International transfers
Personal data is processed in the United States. Optracs is sold in the United States only and does not transfer personal data outside it.
No standard contractual clauses are attached, deliberately. Pasting in transfer machinery for a transfer that is not happening reads as diligence and is actually a promise nobody has scoped. If Optracs ever sells into the EU or UK, this section and the corresponding part of the privacy policy have to be written before the first customer signs.
11. Liability
Liability under this addendum is subject to the limitations in the Terms of Service, except where the law does not permit that.
12. Contact
Questions about this addendum, and notices under it, go to info@optracs.com.