Clauth

Data Processing Agreement

Draft — needs review by a lawyer. Clauth isn’t open to outside organizations until this text has been reviewed. Today it covers people signing in to The Cake Labs’ own businesses’ apps.

Version 2026-11. Between The Cake Labs [registered details to be added] (“Clauth”, the processor) and the organization that accepts it (the “Organization”, the controller of its people’s data).

1. Scope

Clauth processes the personal data of the Organization’s people (name, email, credentials, roles, sign-in records) only to provide sign-in and access management for the Organization’s apps, as described in the Privacy Policy, and only on the Organization’s documented instructions — which are these terms and the Organization’s use of the admin console.

2. Clauth’s commitments

  • Keep the data confidential; only people who need it to run Clauth can access it, under confidentiality.
  • Security measures: passwords hashed, admin 2-step verification, encrypted signing keys and backups, encrypted traffic, audit logs, separation of organizations’ data in the console, limits and abuse monitoring.
  • Use only the sub-processors listed in the Privacy Policy, tell the Organization before adding or replacing one, and hold them to equivalent obligations.
  • Help the Organization answer people’s requests (access, correction, export, deletion) — the admin console and data export cover most of these.
  • Notify the Organization without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting its data, with what is known, and help it meet its own notification duties under the Data Privacy Act of 2012.
  • On deletion of the Organization, delete its data after the 30-day grace period (backups roll off within 30 days after that), unless the law requires keeping it.
  • Make available the information reasonably needed to show compliance with this agreement.

3. The Organization’s commitments

  • It has a lawful basis to have its people use Clauth and has told them how their data is used.
  • It controls who gets access and keeps its admin and client credentials secure.
  • Its apps handle the data they receive from Clauth lawfully, under their own privacy policies.

4. Transfers, term and law

Data is stored with the hosting provider in [country to be confirmed]; transfers outside the Philippines are protected as the Data Privacy Act requires. This agreement lasts as long as the Organization uses Clauth and is governed by Philippine law.

Back