Data Processing Addendum

This Data Processing Addendum (“DPA”) is between you, the customer (the “controller”), and Omnipure Marketing LLC, 1209 Mountain Rd Pl NE, Ste N, Albuquerque, NM 87110, USA (“CornerHello”, the “processor”). It is part of our Terms of Service and applies whenever we process personal data for you. If this DPA and the terms disagree about personal data, this DPA wins. Words like “personal data”, “processing” and “data subject” mean what they mean in the EU and UK GDPR.

We process personal data to provide CornerHello to you: showing your video bubble and share links, counting visits, and collecting and storing your visitors’ answers. We do this for as long as your account is open, and until the data is deleted as described in section 10.

Hosting, storing, delivering, counting, displaying and deleting data, and sending you email notices about new answers. When you turn them on, also transcribing video answers and writing short AI summaries. We don’t use AI to score or rank people, and we don’t analyze faces or emotions.

Data subjects: visitors of your websites and share links, and people who send answers through your funnels.

• Visit events: impressions, opens, video quartiles, step views and button clicks. Unique visitors are counted with a monthly salted one-way code of your account, the visitor’s IP address and user agent, which goes only into an estimating counter (HyperLogLog). We don’t store the IP address.
• Answers: what visitors choose to send, such as names, email addresses, other form fields, written answers and video answers (image and voice).
• Consent records: the consent text a visitor agreed to before recording a video answer.
• When enabled: transcripts and AI summaries of answers.

You should not ask visitors for special categories of data (such as health, religion or biometric data used to identify someone), or for data about children.

We process the data only on your documented instructions: these terms, this DPA and the settings you choose in CornerHello. If we are required by law to process it in another way, we will tell you first unless the law forbids it. If we believe an instruction breaks data protection law, we will tell you. You are responsible for having a lawful basis for the data you collect and for linking your privacy policy before you turn on video answers.

Only people who need access to run, support or secure CornerHello can reach your data, and they are bound to keep it confidential.

• Data is encrypted in transit.
• Visitors’ video answers are kept in a private, token-protected video library. Links to watch them are signed and expire after one hour. Your own videos are public, so your bubble can play them.
• Row level security in our database keeps each customer’s data separate.
• Staff access requires two-step sign-in, and staff actions are recorded in an audit log.
• We don’t store visitors’ IP addresses for counting; short-lived rate-limit counters delete themselves within an hour.

You allow us to use the subprocessors on our subprocessors page. We give each of them data protection terms that protect your data at least as well as this DPA, and we stay responsible for their work. Before we add or replace a subprocessor, we update that page and email account owners at least 30 days ahead. If you have a reasonable data protection reason to object, tell us within that time; if we can’t solve it, you can close your account and get a refund of any prepaid fees for the time left.

• Data subject requests: you can find, export and delete answers in CornerHello. If a visitor writes to us, we pass the request on to you and don’t answer it ourselves unless you ask us to.
• Security incidents: if we learn of a personal data breach affecting your data, we tell you without undue delay, with the information we have, so you can meet your own duties.
• Assessments: we give you reasonable help with data protection impact assessments and with questions from authorities, using the information we have.

Answers are deleted automatically when their retention period ends: 30 days on Free, 1 year on paid plans, and 1 to 3 years on Business, as you choose. You can delete answers at any time, and export them as a CSV file. When your account closes, we delete your data, apart from what the law requires us to keep.

We don’t hold certifications such as SOC 2 or ISO 27001. On request, we will answer reasonable security questionnaires and give you the information you need to show we meet this DPA. If that isn’t enough, or an authority requires it, you may audit us once a year, with at least 30 days’ notice, during business hours, at your own cost and under a confidentiality agreement.

We and several subprocessors process data in the United States. Where personal data from the EU, the EEA or Switzerland goes to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914, Module Two, controller to processor) apply and are part of this DPA. For the UK, the UK International Data Transfer Addendum to those clauses applies. We put the same kind of safeguards in place with our subprocessors.

Questions about this DPA, or to ask for a signed copy: hello@cornerhello.com.