Data Processing Agreement

VA SHIFT LLC dba ReleaseOS · Effective Date: March 23, 2026

This Data Processing Agreement ("DPA") is entered into by and between VA SHIFT LLC dba ReleaseOS ("ReleaseOS") and the Customer (the "Data Controller"). This DPA is incorporated into the ReleaseOS Terms of Service.

1. Roles and Scope of Processing

Roles: The Customer is the Data Controller and ReleaseOS is the Data Processor.

Purpose: Processing is strictly limited to providing analytics, release planning, and platform functionality.

Instructions: The Parties agree that the Agreement constitutes the Customer's complete and final instructions to ReleaseOS.

2. Strict Use Limitations & Data Ethics

ReleaseOS shall process data only in accordance with Customer's instructions. ReleaseOS shall NOT:

Sell, rent, or otherwise monetize Customer Data.
Use Customer Data for advertising or marketing purposes.
AI Protection: Use Customer Data to train, tune, or improve any Artificial Intelligence (AI) or Machine Learning (ML) models.

3. Platform API Compliance & "Flow-Down" Obligations

ReleaseOS maintains compliance with the developer terms of Spotify, Google (YouTube), TikTok, Meta (Instagram), Apple Music, SoundCloud, and X.

YouTube Terms: Customer agrees to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy.

Non-Commingling: Customer shall not use Platform Data to create individual user profiles for re-identification or behavior tracking.

Anti-Surveillance: Customer shall not use Platform Data for government surveillance, law enforcement, or to infer sensitive information (race, religion, political beliefs).

4. Sub-processors

Current List: Authorized sub-processors include Base44 (Infrastructure) and Stripe (Payments).

Notice: ReleaseOS will notify Customer of any changes to Sub-processors 30 days in advance via website or email.

5. Security & Breach Notification

Measures: ReleaseOS shall implement the measures outlined in Exhibit A.

Notification: ReleaseOS shall notify the Customer of a Personal Data Breach within 72 hours of discovery.

6. Limitation of Liability

Notwithstanding anything to the contrary, the total aggregate liability of VA SHIFT LLC arising out of or related to this DPA shall not exceed the total amount paid by the Customer to ReleaseOS in the thirty (30) days immediately preceding the event giving rise to the claim.

7. Termination & Deletion

Upon termination, ReleaseOS shall delete or anonymize all Personal Data unless law requires storage. Users may request full data deletion at any time via support@releaseos.io.

8. International Data Transfers

Where the processing involves a transfer of Personal Data from the EEA, UK, or Switzerland to a country without an adequacy decision (such as the US), the parties agree to abide by the following:

EU/EEA Data: The EU Standard Contractual Clauses (2021/914), Module Two (Controller-to-Processor), are hereby incorporated by reference.

UK Data: The UK International Data Transfer Addendum (IDTA) to the EU SCCs is hereby incorporated by reference.

Swiss Data: The EU SCCs shall apply to Swiss data, with the Swiss Federal Data Protection and Information Commissioner (FDPIC) acting as the competent authority.

Data Privacy Framework: ReleaseOS shall process data in accordance with the EU-U.S. Data Privacy Framework (DPF) principles where applicable.

9. Governing Law

This DPA is governed by the laws of the State of Delaware.

Annex 1: Details of Processing

A. List of Parties

Data Controller (Customer): 4000 Buena Vista Ave, #305A, Baltimore MD, 21211.

Data Processor (ReleaseOS): VA SHIFT LLC dba ReleaseOS.

Contact: support@releaseos.io

B. Description of Processing

Subject Matter: Digital content analytics and release planning.

Data Categories: Account info, platform metadata, engagement metrics, and API tokens.

Exhibit A: Technical and Organizational Measures (TOMs)

Infrastructure: Hosted on Base44 with 24/7 physical security and biometric controls.

Encryption: Data is encrypted at rest (AES-256) and in transit (TLS 1.2+).

Isolation: Logical data separation via multi-tenant architecture.

Access: Production access restricted via MFA and Principle of Least Privilege.

Payments: All financial transactions are managed by Stripe.

No-Scraping: Customer is prohibited from using automated systems to scrape or harvest Platform Data from ReleaseOS.