Data processing addendum

Effective 27 October 2026. Published by Respiresoft LLC. When a policy changes, the date changes and the hub says what changed.

This addendum is for hosting companies and other businesses ("you") that run RespireCloud and have to sign a data processing agreement with their suppliers. It is part of the terms of sale and service between you and Respiresoft LLC ("RespireSoft", "we"). It applies when data protection law such as the GDPR or the UK GDPR applies to the personal data we handle for you.

1. What this addendum covers, and what it does not

RespireCloud runs on your servers. Your customers' data stays on your servers and is not processed by us. This includes hosted websites, files, databases, mail, DNS records, hosting accounts and backups, and your administrators' and customers' sign-in data on the panel. We cannot read it and do not receive it.

This addendum covers only the personal data that RespireSoft processes on your behalf when you use these services:

For the other personal data we hold about you, such as your own contact and billing details, we act as a controller, as the privacy policy says.

2. Roles

You are the controller and RespireSoft is the processor for the data in section 1. We process it only on your documented instructions, which are this addendum, the terms, and your use of the features, and we tell you if we think an instruction breaks the law.

3. Duration and the end of the services

We process this data while you use the services. AI request content is not kept by us after the request ends. The AI service keeps metadata only (time, size, cost and the model that answered) for billing and abuse checks. Trial records are kept 90 days. Support email and access logs are kept only as long as needed to run, protect and support the service. After the licence ends we delete or anonymise the data in this addendum on request, except what the law makes us keep (for example accounting records).

4. Our duties

• Confidentiality. People who handle this data for us are bound to keep it confidential.
• Security. We use the measures in section 5.
• Sub-processors. We use the sub-processors in section 6. We tell you before we add or replace one, and you may object on reasonable grounds.
• Your people's rights. If someone asks us for access to or deletion of data we process for you, we tell you and help you answer, as far as we can with what we hold.
• Impact assessments. We give you the information you need for a data protection impact assessment or a consultation with an authority.
• Breaches. We tell you without undue delay, and no later than 72 hours after we become aware of a personal data breach that affects data in this addendum, and give you what we know so that you can meet your own duty to report.
• Return and deletion. When the services end, we delete the data on request (section 3).
• Audit. We give you the information needed to show that we meet this addendum and allow audits once a year by written questionnaire. An on-site audit happens only where the law requires it, with notice, in business hours and under confidentiality.

5. Security measures

These are measures the code shows today:

• Every request from your panel is signed with a key that exists only on your server and is checked with a time window and a one-time number. Answers are signed too, and your panel refuses one that does not verify.
• Downloads come through short-lived links to a valid licence, and releases are signed and checked before they are installed.
• Requests to RespireSoft AI go through our central AI service. The panel removes secrets from requests and sends only the categories you allowed. The service keeps metadata only, not the content of requests, and we ask model providers not to keep requests where they offer that.
• Phone and browser notifications are sent by your own server with its own keys. They do not pass through RespireSoft.
• Passwords on our services are stored as argon2id hashes, partner payout details are encrypted, sign-in codes are short-lived and limited per address and network, and our hosted pages send security headers.
• Our services use encrypted connections. Access to our systems is limited to staff who need it.

6. Sub-processors

You give general permission for these sub-processors. This is the current list. We tell customers before we add a sub-processor.

7. International transfers

We are in the United States. Where personal data from the EEA, the UK or Switzerland reaches us or a sub-processor outside those areas, the parties use standard contractual clauses where the law requires them (module two, controller to processor, with the UK addendum), which are part of this addendum by reference.

8. How to sign this addendum

It applies from the day you start using the services. If your lawyers need a signed copy, write to info@respiresoft.com and we will sign one with you.

9. Liability, law and order of precedence

The limits of liability and the governing law (Wyoming, courts of Sheridan County) in the terms apply to this addendum, as far as the law allows. If this addendum and the terms disagree about personal data, this addendum wins.

10. Contact

Respiresoft LLC, 32 N Gould St, Sheridan, WY 82801, United States. info@respiresoft.com.

Other policies

• Terms of sale and service
• Software licence agreement
• Privacy policy
• Refund policy
• Acceptable use policy
• Cookie policy
• Open-source licences
• Phone app privacy
• Delete your account
• Support and contact