GlamOps Data Processing Addendum

Version: 1.0 Effective date: October 9, 2026 Last updated: October 10, 2026

This Data Processing Addendum ("Addendum" or "DPA") is between GlamOps LLC, an Oregon limited liability company ("GlamOps," "we," "us"), and the business that has accepted the GlamOps Terms of Service ("Business," "you"). It forms part of the GlamOps Terms of Service (the "Terms"). By accepting the Terms, you also accept this Addendum. No separate signature is needed, but either party may ask for a countersigned copy.

1. What this Addendum covers

1.1 Purpose. You use GlamOps to run your business: your Booking Site, client records, appointments, intake and consent forms, payments through Stripe, email and text messages, and the Concierge assistant. To provide these features, GlamOps processes personal data about your Clients on your behalf. This Addendum sets out how we handle that data and what each of us is responsible for.

1.2 Laws this Addendum is meant to satisfy. This Addendum is written to meet the contract requirements for processors and service providers under US state privacy laws that may apply to you or us. These include:

• (a) the Oregon Consumer Privacy Act (ORS 646A.570 to 646A.589), including the processor contract terms in ORS 646A.581;
• (b) Oregon's data security and breach notification laws (ORS 646A.600 to 646A.628);
• (c) the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA");
• (d) the Washington My Health My Data Act (the "MHMDA") and Nevada's consumer health data law (SB 370, 2023); and
• (e) other US state comprehensive privacy, consumer health data, and data security laws that apply to the processing described here.

Together these are "Data Protection Laws."

1.3 Even if a law does not apply. Most solo businesses and GlamOps itself are likely below the size thresholds of many of these laws today. We follow this Addendum anyway, for all Business Client Data, whether or not a given law technically applies.

1.4 Order of precedence. If this Addendum conflicts with the Terms about personal data, this Addendum controls. If it conflicts with a Data Protection Law, the law controls.

2. Definitions

Words defined in the Terms have the same meaning here. In addition:

2.1 "Business Client Data" means the personal data within Customer Data (as defined in the Terms) about your Clients, prospective clients, and your Team Members (if any) that GlamOps processes on your behalf while providing the Services. It includes data your Clients enter on your Booking Site or in the Client Portal, data you enter or import, intake and consent form responses, signatures, photos you upload, appointment history, notes, messaging records, and consent and opt-out records. Annex 1 describes it in more detail.

2.2 "Client" has the meaning in the Terms: any individual who books with, buys from, signs a form for, receives messages from, or otherwise interacts with you through the Services, including through your Booking Site or the Client Portal ("My appointments").

2.3 "Consumer Health Data" means Business Client Data that identifies, or could reasonably be linked to, a person's past, present, or future physical or mental health status. For example: skin conditions, allergies, medications, pregnancy, treatments, and other health-related answers on intake forms. It has the meaning in the MHMDA and Nevada SB 370 where those laws apply.

2.4 "Sensitive Data" means Business Client Data that is "sensitive data" or "sensitive personal information" under any applicable Data Protection Law. This includes data revealing a mental or physical condition or diagnosis, a child's data, and precise geolocation.

2.5 "Controller" includes a "business" under the CCPA and a "regulated entity" under the MHMDA. "Processor" includes a "service provider" under the CCPA and a "processor" under the MHMDA and Nevada SB 370.

2.6 "Security Incident" means a breach of security that leads to unauthorized access to, or acquisition, disclosure, alteration, loss, or destruction of, Business Client Data. It does not include unsuccessful attempts that do not compromise the security of Business Client Data, such as blocked log-in attempts, pings, port scans, or denial-of-service attacks.

2.7 "Subprocessor" means a third party GlamOps engages that processes Business Client Data to help provide the Services.

2.8 "Sell," "share," "targeted advertising," "business purpose," "deidentified data," and "consumer" have the meanings given in the applicable Data Protection Law.

2.9 "Services," "Platform," "Booking Site," "Client Portal," "Customer Data," "Aggregated Data," "Team Member" and "Account Owner" have the meanings in the Terms. The Services include the Concierge assistant.

3. Roles of the parties

3.1 You are the controller. For Business Client Data, you decide why and how the data is processed. You are the "controller," "business," or "regulated entity" under Data Protection Laws.

3.2 GlamOps is your processor. GlamOps processes Business Client Data only on your behalf and under your instructions. GlamOps is your "processor" or "service provider."

3.3 When GlamOps is a controller. GlamOps is a controller, not a processor, for the following data, which our Privacy Policy (https://glamops.net/legal/privacy) covers instead of this Addendum:

• (a) your own account data as a GlamOps customer (your name, email, login details, subscription and billing information, support requests);
• (b) visitors to glamops.net's marketing pages; and
• (c) limited technical data that GlamOps needs to keep the Services secure and working (for example, security logs and fraud and abuse signals), used only for those purposes.

3.4 Stripe. Payments to your business are processed by Stripe under your own agreement with Stripe (the Stripe Connected Account Agreement). You are the merchant of record. Stripe processes card and payment data under that agreement, mostly as its own controller or as your processor. GlamOps does not receive or store full card numbers. GlamOps does pass some booking and payment details to Stripe to create charges for you. For that limited data flow, Stripe is listed as a Subprocessor.

3.5 If GlamOps goes beyond your instructions. If GlamOps ever began to decide the purposes and means of processing Business Client Data on its own, it would become a controller for that data under ORS 646A.581(4) and similar laws. GlamOps agrees not to do that except as this Addendum allows.

4. Your responsibilities as controller

4.1 Lawful collection. You are responsible for making sure that you have the right to collect Business Client Data and to have GlamOps process it as described in this Addendum. This includes data you import from another system.

4.2 Notices to Clients. You will give your Clients any privacy notice that Data Protection Laws require. GlamOps provides a template privacy notice and a template consumer health data privacy policy that you may adopt, and links to them from your Booking Site footer by default. You are responsible for reviewing them, completing them, and making sure they are accurate for your business.

4.3 Consents. You are responsible for getting and keeping any consent the law requires. That includes:

• (a) consent to collect and to share Consumer Health Data where the MHMDA, Nevada SB 370, or another law requires it. GlamOps provides consent tools on intake forms, but you decide which questions to ask and whether consent is required;
• (b) prior express written consent before sending marketing text messages, and prior express consent before sending informational text messages, as set out in the GlamOps Messaging Terms (https://glamops.net/legal/messaging-terms);
• (c) any consent needed to send marketing emails, as set out in the Messaging Terms;
• (d) parental or guardian consent for Clients who are minors; and
• (e) a Client's agreement to your cancellation, no-show, deposit, and saved-card policies.

4.4 Your instructions must be lawful. You will not instruct GlamOps to process Business Client Data in a way that breaks a Data Protection Law. GlamOps will tell you if it believes an instruction does, as described in Section 5.3.

4.5 Data you choose to collect. You decide what questions to put on intake forms and what notes and photos to store. Collect only what you need for your services. Do not use the Services to store government ID numbers, Social Security numbers, full card numbers, or insurance or medical-record numbers.

4.6 No third-party tracking code. The Services do not let you add third-party analytics, advertising or session-recording code to your Booking Site, Client Portal, intake forms or payment pages.

5. Processing instructions

5.1 What GlamOps will do. GlamOps will process Business Client Data only:

• (a) to provide, maintain, secure, and support the Services for you, as described in the Terms and Annex 1;
• (b) as you direct through your use and configuration of the Services (for example, sending a campaign, sending reminders, running a report, or asking the Concierge assistant a question);
• (c) as you otherwise instruct in writing, if GlamOps agrees the instruction is consistent with the Terms; and
• (d) as required by law, in which case GlamOps will tell you before processing unless the law forbids it.

Your Terms, this Addendum, and your settings in the Services are your complete instructions to GlamOps at the time you accept. Additional instructions need to be agreed in writing.

5.2 Nature, purpose, type of data, and duration. Annex 1 sets out the nature and purpose of processing, the types of personal data, the categories of people involved, and how long processing lasts, as ORS 646A.581 requires.

5.3 Unlawful instructions. GlamOps will tell you promptly if it believes an instruction breaks a Data Protection Law. GlamOps may decline to follow that instruction until you change or confirm it.

5.4 Notice if GlamOps cannot comply. GlamOps will tell you if it decides it can no longer meet its obligations under the CCPA or another Data Protection Law. If that happens, you may take reasonable and appropriate steps to stop and fix any unauthorized processing, including suspending GlamOps's processing of the affected data or ending the Terms.

6. Limits on GlamOps's use of Business Client Data

6.1 No selling or sharing. GlamOps will not sell Business Client Data or share it for cross-context behavioral advertising or targeted advertising.

6.2 No use outside our relationship. GlamOps will not keep, use, or disclose Business Client Data:

• (a) for any purpose other than the business purposes in this Addendum, including for any other commercial purpose; or
• (b) outside the direct business relationship between you and GlamOps.

6.3 No combining. GlamOps will not combine Business Client Data with personal data it receives from or on behalf of another person (including other Businesses on GlamOps), or that it collects from its own interactions with a person, except where Data Protection Laws allow it for a business purpose. In particular, GlamOps will not build a profile of a Client that spans more than one Business.

6.4 No marketing to your Clients. GlamOps will not use Business Client Data to market GlamOps or anyone else's products to your Clients.

6.5 No AI model training. GlamOps will not use Business Client Data to train, fine-tune, or improve any artificial intelligence or machine learning model, and will not let any Subprocessor do so.

6.6 Permitted internal uses. GlamOps may use Business Client Data, to the extent Data Protection Laws allow a processor or service provider to do so, to:

• (a) detect, prevent, and respond to security incidents, fraud, abuse, spam, and illegal activity;
• (b) fix errors and keep the Services working;
• (c) comply with law, legal process, and carrier, email-provider, and card-network rules; and
• (d) build or improve the quality of the Services, but only in ways that do not involve building a profile of a Client or using the data for anyone else.

6.7 Aggregated Data. GlamOps may create Aggregated Data (deidentified or aggregated data, as defined in the Terms) from Business Client Data (for example, total bookings across the Platform) to run and improve the Services. If it does, GlamOps will:

• (a) take reasonable measures to make sure the data cannot be linked to an identified or identifiable person or to your business;
• (b) publicly commit to keep and use it only in deidentified form and not try to re-identify it; and
• (c) contractually require anyone it shares deidentified data with to do the same.

GlamOps will never create deidentified data from Consumer Health Data or intake form answers, and will never use Aggregated Data for marketing.

6.8 Certification. GlamOps certifies that it understands the restrictions in this Section 6 and will comply with them.

7. Confidentiality of personnel

7.1 GlamOps will make sure that every person who processes Business Client Data for GlamOps (including employees, contractors, and the founder) is bound by a duty of confidentiality, either by written agreement or by law, as ORS 646A.581 requires.

7.2 GlamOps will limit access to Business Client Data to people who need it to provide the Services, support you, or keep the Services secure, and will train them on their responsibilities.

7.3 GlamOps staff will not view the contents of your intake forms, notes, or photos except: (a) when you ask for support and give permission; (b) to investigate a security incident or abuse; or (c) to comply with law.

8. Security

8.1 Safeguards. GlamOps will maintain reasonable administrative, technical, and physical safeguards to protect Business Client Data, taking into account the nature of the data (including Consumer Health Data) and GlamOps's size. These safeguards are designed to meet ORS 646A.622 and are described in Annex 2.

8.2 Changes. GlamOps may update its security measures over time, but will not make changes that materially reduce the overall protection of Business Client Data.

8.3 Your part. You are responsible for:

• (a) keeping your login details secure and turning on multi-factor authentication when the Services offer it;
• (b) controlling who on your team has access;
• (c) keeping the devices you use to access GlamOps secure; and
• (d) securing any data you export or download from the Services.

9. Subprocessors

9.1 General authorization. You authorize GlamOps to use Subprocessors to provide the Services. The current list is at https://glamops.net/legal/subprocessors. At the effective date, it includes:

9.2 Written contracts. Before a Subprocessor processes Business Client Data, GlamOps will have a written contract with it that requires it to meet obligations at least as protective as those in this Addendum, including confidentiality, security, and the restrictions in Section 6, as ORS 646A.581 and ORS 646A.622 require.

9.3 Responsibility. GlamOps remains responsible to you for its Subprocessors' performance of these obligations.

9.4 Notice of new Subprocessors. GlamOps will give you at least 30 days' notice before adding or replacing a Subprocessor that processes Business Client Data. We will do this by updating the Subprocessors page and sending an email to the Account Owner and an in-app notice. You can subscribe to updates from the Subprocessors page. In an emergency (for example, a vendor suddenly stops service), GlamOps may make a change with shorter notice and will tell you as soon as possible.

9.5 Objections. You may object to a new Subprocessor on reasonable data protection grounds by emailing admin@glamops.net within 30 days after our notice. If you object, GlamOps will try in good faith to address your concern, for example by offering a way to avoid using the affected feature. If we cannot resolve it within 30 days, you may end the Terms by written notice and receive a pro-rated refund of any prepaid fees for the period after termination. This is your only remedy for an objection.

10. Help with Client privacy requests

10.1 Tools. The Services give you tools to help you respond to requests from Clients to access, correct, delete, or obtain a copy of their data, to opt out of marketing messages, and to withdraw consent. These include client record export, editing, deletion, and marketing subscription controls.

10.2 Further help. If you cannot respond to a request using those tools, GlamOps will provide reasonable help, taking into account the nature of the processing and the information available to GlamOps.

10.3 Requests sent to GlamOps. If a Client contacts GlamOps directly with a privacy request about Business Client Data, GlamOps will:

• (a) not respond to the substance of the request, except to tell the Client to contact you and, where appropriate, give the Client your business contact details; and
• (b) forward the request to you within 5 business days, unless the law forbids it.

10.4 List of third parties. On request, GlamOps will give you the information you need to provide a Client with a list of the specific third parties to which their data was disclosed, as the Oregon Consumer Privacy Act requires.

10.5 Deletion requests. When you delete a Client record in the Services, GlamOps will delete it as described in Section 16. GlamOps will also pass deletion requests on to Subprocessors where required. GlamOps will keep a Client's text and email opt-out record after deletion, limited to the phone number or email address and opt-out date, so that the Client is not messaged again. This is necessary to comply with the law and with the Client's request.

11. Help with assessments and compliance

11.1 Data protection assessments. If you need to carry out a data protection assessment or risk assessment (for example, for processing Sensitive Data under ORS 646A.586 or similar laws), GlamOps will give you the information about the Services reasonably needed to do it.

11.2 Information to show compliance. On reasonable written request, GlamOps will make available the information you need to show that GlamOps is meeting its obligations under this Addendum. Section 17 explains how.

11.3 Regulators. GlamOps will cooperate reasonably with you in responding to an inquiry from a regulator about Business Client Data processed by GlamOps.

12. Security incidents

12.1 Notice to you. If GlamOps becomes aware of a Security Incident affecting Business Client Data, it will notify you without undue delay (our target is within 72 hours after becoming aware of it), and never later than 10 days after discovering a breach of security, as ORS 646A.604 requires of vendors.

12.2 What the notice will include. The notice will be sent to the Account Owner's email address and will include, as far as known at the time:

• (a) a description of what happened, including the date or estimated date;
• (b) the types of Business Client Data involved and the approximate number of Clients affected;
• (c) the steps GlamOps has taken or will take to contain and fix the incident;
• (d) steps you or affected Clients can take to protect themselves; and
• (e) a contact person at GlamOps.

If GlamOps does not have all this information at first, it will provide it in stages as it learns more.

12.3 Investigation and help. GlamOps will promptly investigate, take reasonable steps to contain and reduce the harm, and keep you updated. GlamOps will give you reasonable help with any notice you must send to Clients, regulators, or consumer reporting agencies. Under Oregon law, as summarized in our research:

• (a) affected consumers must generally be notified without unreasonable delay and no later than 45 days after discovery or after notice from a vendor;
• (b) the Oregon Attorney General must be notified if more than 250 consumers are affected; and
• (c) consumer reporting agencies must be notified if more than 1,000 consumers are affected.

12.4 Attorney General notice by GlamOps. If a Security Incident at GlamOps affects more than 250 Oregon consumers, or an unknown number, GlamOps will notify the Oregon Attorney General as a vendor unless you (or GlamOps on your behalf) have already done so. Because one incident at GlamOps could affect many Businesses, GlamOps may coordinate a single notice covering all affected Businesses, with your agreement.

12.5 Who sends Client notices. You are responsible for deciding whether to notify your Clients and regulators, unless the law requires GlamOps to do so. If you ask, GlamOps may send notices to your Clients on your behalf, in a form you approve, at GlamOps's cost where the incident was caused by GlamOps or its Subprocessors.

12.6 Not an admission. Notifying you of a Security Incident is not an admission of fault or liability.

12.7 Law-enforcement delay. If a law-enforcement agency asks in writing that notice be delayed, GlamOps may delay notice to the extent the law allows, and will tell you as soon as the agency permits.

13. Consumer Health Data and other Sensitive Data

13.1 Treated as sensitive. GlamOps treats all intake and consent form answers, and any notes or photos you mark as health-related, as Consumer Health Data, whether or not a particular law would classify them that way.

13.2 Extra commitments. For Consumer Health Data, GlamOps will:

• (a) process it only to provide the features you use (storing forms, showing them to you, letting the Client view or sign them, and exporting them);
• (b) never sell it, share it for advertising, or use it for geofencing;
• (c) never send it to the Concierge assistant (see Section 14.4);
• (d) store form files and photos in private storage, accessible only through authorized, time-limited links; and
• (e) not use location data to send messages to Clients near any place, including health care facilities.

13.3 MHMDA and Nevada processor terms. Where the MHMDA or Nevada SB 370 applies, GlamOps will process Consumer Health Data only under this binding contract and within your instructions, will help you meet your obligations under those laws using appropriate technical and organizational measures, and will not process it in a way that is inconsistent with your consumer health data privacy policy as you have published it through the Services. If GlamOps processed Consumer Health Data outside your instructions, it would be treated as a regulated entity for that data.

13.4 Your consent duties. You are responsible for obtaining any separate consents to collect and to share Consumer Health Data that the MHMDA or other laws require. GlamOps provides an optional separate consent step on intake forms (see the GlamOps Booking Terms for Clients at https://glamops.net/legal/booking-terms). Accepting your booking terms is not, by itself, valid consent to collect Consumer Health Data under the MHMDA.

13.5 Precise geolocation. The Services do not collect Clients' precise geolocation. GlamOps will not sell precise geolocation data.

13.6 Minors. GlamOps will not process the data of any Client it knows is under 16 for targeted advertising, sale, or profiling, and will not process any Client data for those purposes at all.

14. AI processing (Concierge)

14.1 What Concierge does. Concierge is an optional assistant for the Account Owner and managers on your team. It is not available to other Team Members. It answers questions about your business using your data in GlamOps. It is part of the Pro plan, and each Business can ask up to 100 questions per calendar month. It is not offered to Clients.

14.2 Turning it on. Concierge only processes Business Client Data after the Account Owner turns it on for the Business and agrees to the Concierge disclosure (https://glamops.net/legal/concierge). Each manager must also agree on the first-use consent screen before their own first use. You can turn it off at any time in Settings → Concierge.

14.3 How data flows. When you ask a question, GlamOps sends your question and the relevant Business Client Data needed to answer it (for example, client names, appointment history, and notes) to Anthropic, PBC, a Subprocessor, through Anthropic's commercial API. Under Anthropic's commercial terms as summarized in our research:

• (a) Anthropic may not train its models on this data; and
• (b) inputs and outputs are deleted from Anthropic's systems within 30 days by default, except where content is flagged for a usage policy violation, which Anthropic may keep for up to 2 years.

GlamOps does not store your Concierge questions or answers. A conversation exists only in the open Concierge page. GlamOps keeps only a count of the questions each Business asks per month.

14.4 Health data minimization. GlamOps never sends intake form answers, Client photos or other Consumer Health Data to Anthropic.

14.5 No automated decisions. Concierge does not make decisions that produce legal or similarly significant effects about Clients. Its outputs are suggestions for you to review. Concierge may suggest actions in the Services (for example, filling in a promo code form), but a person must confirm them before they take effect. Concierge cannot send messages or take payments on its own.

14.6 No diagnosis or treatment advice. Concierge is designed not to diagnose skin or health conditions or recommend medical treatment. You remain responsible for your professional judgment.

15. Data location and transfers

15.1 GlamOps offers the Services only in the United States. GlamOps stores and processes Business Client Data in the United States, and requires its Subprocessors to do the same.

15.2 GlamOps will tell you in advance, through the process in Section 9.4, before moving the storage of Business Client Data outside the United States.

16. Return and deletion of data

16.1 During the Terms. You can export your client list, appointment history, and signed forms at any time using the export tools in the Services. When you delete a Client record, GlamOps deletes it from the live Services within 30 days.

16.2 When the Terms end. When your subscription ends or your account is closed:

• (a) you will have 30 days to export your Business Client Data (the "export window"). During that time your account is read-only; and
• (b) after the export window, GlamOps will delete Business Client Data from the live Services within 30 days, unless you ask GlamOps in writing to return it first, in which case GlamOps will provide an export in a commonly used format.

16.3 Backups. Deleted data may stay in encrypted backups until the backups are overwritten in the normal cycle, which is no more than 35 days. Backup data is not used for any purpose other than disaster recovery and stays protected under this Addendum until it is gone.

16.4 What GlamOps keeps. GlamOps may keep the following after deletion, only for as long as needed and protected under this Addendum:

• (a) opt-out and unsubscribe records (phone number or email address, date, and channel), so that a person who opted out is never messaged again, for at least 10 years (Virginia requires opt-outs to be honored for 10 years);
• (b) records of consents and acceptances (for example, text consent and cancellation-policy acceptance), for at least 5 years after the last message sent or charge made in reliance on them (longer if a claim is pending), to defend against claims and payment disputes;
• (c) payment and transaction records needed for tax, accounting, or Stripe and card-network rules; and
• (d) data GlamOps must keep by law or for an active legal claim.

16.5 On your instruction. You may also tell GlamOps to delete Business Client Data at any time by deleting it in the Services or contacting admin@glamops.net. GlamOps will confirm in writing once deletion is complete, if you ask.

17. Information and audits

17.1 Documentation first. On written request, no more than once every 12 months (or more often after a Security Incident or if a regulator requires it), GlamOps will provide:

• (a) a written description of its security program and how it meets Annex 2;
• (b) answers to a reasonable security questionnaire;
• (c) a copy of any third-party security report or certification GlamOps has (for example, a SOC 2 report, if and when available), under confidentiality; and
• (d) the current Subprocessor list and confirmation that written contracts are in place.

17.2 Assessments. If the documentation in 17.1 is not enough to show GlamOps's compliance, or a Data Protection Law gives you the right, you (or an independent assessor you choose who is bound by confidentiality and is not a GlamOps competitor) may carry out a reasonable assessment of GlamOps's policies and technical and organizational measures. GlamOps will cooperate, as ORS 646A.581 requires. Any assessment must:

• (a) be requested with at least 30 days' written notice;
• (b) take place during normal business hours and not unreasonably disrupt the Services;
• (c) be limited to GlamOps's processing of your Business Client Data, and not include other customers' data or Subprocessors' facilities;
• (d) be at your cost, unless it reveals a material breach of this Addendum by GlamOps; and
• (e) follow a written scope agreed in advance.

17.3 Independent assessment. Instead of an assessment under 17.2, GlamOps may offer a report from an independent assessor it has engaged, using an appropriate and accepted control standard, at least once a year at GlamOps's expense, to the extent a Data Protection Law allows that alternative.

18. Children

The Services are meant for Businesses that serve adults. Clients must be at least 18 to create a Client Portal account or book on their own. A parent or guardian must book for, and complete forms for, a Client under 18. You are responsible for following any laws that apply when you provide services to minors. GlamOps does not knowingly collect personal data directly from children under 13.

19. HIPAA

The Services are not designed to store protected health information (PHI) under HIPAA. GlamOps is not a business associate and does not offer business associate agreements. If you are a HIPAA covered entity (for example, a medical practice or med spa that bills health insurance electronically), you must not use the Services to store PHI. Med spas and other businesses that provide medical services may not use the Services at this time.

20. Legal requests

If GlamOps receives a subpoena, court order, or government request for Business Client Data, GlamOps will:

• (a) try to redirect the requester to you;
• (b) notify you promptly before disclosing, unless the law forbids it; and
• (c) disclose only the minimum data the law requires, and challenge requests GlamOps reasonably believes are unlawful.

21. Liability

Each party's liability arising out of or relating to this Addendum is subject to the limitations and exclusions of liability in the Terms. Nothing in this Addendum limits either party's liability where the Terms or applicable law do not allow it to be limited.

22. Term, changes, and other terms

22.1 Term. This Addendum applies for as long as GlamOps processes Business Client Data for you, including after the Terms end until the data is deleted or returned under Section 16.

22.2 Changes. GlamOps may update this Addendum to reflect changes in the law, the Services, or Subprocessors. GlamOps will give you at least 30 days' notice of material changes by email and in the app. Material changes that reduce your rights will need your renewed agreement, as described in the Terms. Changes required by law may take effect sooner.

22.3 Governing law. This Addendum is governed by the law and dispute terms in the Terms.

22.4 Contact. Privacy questions about this Addendum: admin@glamops.net, GlamOps LLC.

Annex 1 — Description of processing

1. Parties and roles

• Controller: the Business (as defined in the Terms).
• Processor / service provider: GlamOps LLC, admin@glamops.net.

2. Categories of people whose data is processed

• (a) Clients and prospective clients of the Business, including people who book, are imported into the Business's client list, use the Client Portal, receive messages, or fill out forms.
• (b) Parents or guardians who book for or sign forms for a minor Client.
• (c) The Business's Team Members (if any), to the extent their data appears in Business Client Data (for example, which staff member performed a service). (The Account Owner's own account data is covered by the Privacy Policy.)

3. Categories of personal data

4. Sensitive Data

Consumer Health Data on intake and consent forms; data about minors, if the Business serves them. Not collected: precise geolocation, government ID numbers, Social Security numbers, full card numbers, health insurance numbers, biometric data.

5. Nature and purposes of processing

GlamOps processes Business Client Data to provide the Services to the Business, including:

• (a) hosting the Business's Booking Site and Client Portal;
• (b) taking and managing bookings, calendars, and waitlists;
• (c) creating payment requests, deposits, balances, tips, and no-show fees through the Business's Stripe account;
• (d) collecting, storing, displaying, and exporting intake and consent forms and electronic signatures;
• (e) sending appointment confirmations and reminders, and marketing emails and texts that the Business writes and sends, and handling opt-ins, opt-outs, HELP, and STOP replies;
• (f) providing reports and the Concierge assistant to the Business;
• (g) importing and exporting the Business's data;
• (h) customer support at the Business's request;
• (i) security, fraud and abuse prevention, backups, and disaster recovery; and
• (j) meeting legal obligations and carrier, email provider, and card-network rules, including toll-free number verification and consent recordkeeping.

6. Duration of processing

For as long as the Business uses the Services, plus the export window and deletion periods in Section 16, and the limited retention in Section 16.4.

7. Frequency

Continuous.

8. Subprocessors

See Section 9 and https://glamops.net/legal/subprocessors.

Annex 2 — Security measures

GlamOps maintains the following measures, designed to meet the "reasonable safeguards" elements of ORS 646A.622 and scaled to GlamOps's size and the sensitivity of the data.

1. Governance

• (a) A named security coordinator.
• (b) A written information security program and incident response plan, reviewed at least once a year.
• (c) A risk assessment (risk register) at least once a year and after significant changes.
• (d) Security and privacy training for anyone with access to Business Client Data, at onboarding and once a year.

2. Access control

• (a) Multi-factor authentication on all administrative accounts, including hosting, database, source code, payment, email, and messaging providers.
• (b) Least-privilege access for GlamOps personnel, reviewed at least quarterly.
• (c) Prompt removal of access when someone no longer needs it.
• (d) Business accounts protected by authentication, with multi-factor authentication for Business users when the Services offer it.
• (e) Rate limiting and bot protection on public sign-in, booking, and form pages.

3. Tenant isolation

• (a) Each Business's data is logically separated in a shared database using row-level security (RLS) policies that limit every query to the signed-in Business's data, or to the signed-in Client's own records in the Client Portal.
• (b) RLS policies are tested when they change and reviewed at least quarterly.
• (c) Service-level database keys that bypass RLS are kept only on the server, never sent to browsers or apps.

4. Encryption

• (a) Data is encrypted in transit using TLS.
• (b) Data is encrypted at rest by GlamOps's hosting and database providers.
• (c) Intake forms, signed documents, and photos are stored in private storage buckets, reached only through signed, time-limited links.
• (d) Card data is collected directly by Stripe's hosted or embedded payment fields and never touches GlamOps servers.

5. Application security

• (a) Code review before changes go live.
• (b) Automated dependency vulnerability alerts and timely patching.
• (c) Content Security Policy and related protections on booking and payment pages.
• (d) Secrets kept in managed environment variables, not in source code.

6. Monitoring, logging, and response

• (a) Error and security logging with alerts to the security coordinator.
• (b) An incident response plan that covers the 10-day vendor notice to Businesses and the 45-day consumer notice timeline under Oregon law.
• (c) Security logs kept for 1 year and protected from unauthorized change.

7. Backups and recovery

• (a) Backups of the production database, encrypted, kept for up to 35 days.
• (b) A restore test at least once a year.

8. Vendors

• (a) Subprocessors are chosen for their ability to protect data.
• (b) A written data processing agreement is in place with each Subprocessor before it receives Business Client Data.
• (c) Subprocessor security is reviewed at least once a year.

9. Data minimization and disposal

• (a) The Services collect only what is needed for its features. Businesses choose their own intake questions.
• (b) Data is deleted on the schedules in Section 16.
• (c) Data no longer needed is securely disposed of.

10. Testing

• (a) Key controls (access reviews, RLS policies, backup restore) are tested regularly.