Data Processing Addendum

Effective date: October 14, 2026

Version: 1.0

This Data Processing Addendum (the "DPA") is part of the ilaw Terms of Service. It is an agreement between Bits Workshop Ltd ("we," "us," or "our") and the law firm that uses ilaw (the "firm" or "you"). It explains how we handle personal information on the firm's behalf.

The DPA applies to every firm automatically, with no separate signature. A firm that wants a signed copy can ask at legal@bits-workshop.com.

The short version

• The firm controls its client data. We act only on the firm's instructions.
• We use client data only to provide ilaw. We never sell it, share it for ads, or use it to train AI models.
• We expect client data to include sensitive information, such as A-Numbers and Social Security numbers. Annex 3 describes how we protect it.
• We tell the firm before we add a new service provider that will handle client data, and ask for active consent first.
• If a breach affects the firm's data, we tell the firm within 72 hours of confirming it.
• When the firm closes its account, we destroy its data 14 days later.

1. Words we use

• Client data means personal information that the firm or its users bring into ilaw, or that ilaw gets for the firm. This includes records copied from the firm's case information system, such as DocketWise, and answers from USCIS and EOIR lookups.
• Personal information means information about an identifiable person, as defined by the privacy laws that apply.
• Service provider means a company we use to help run ilaw that handles client data for us. Some laws call this a "subprocessor."
• Security incident means someone got into, changed, destroyed, or lost client data without permission. Blocked attacks that reach no data, such as failed sign-ins or port scans, do not count.
• Privacy laws means the U.S. federal and state privacy and data security laws that apply to our handling of client data. This includes the California Consumer Privacy Act (CCPA) and similar state laws.

Other capitalized words have the meanings given in the Terms of Service.

2. Our roles

The firm decides why and how client data is used. We handle client data only on the firm's behalf. Under privacy laws, the firm is the "business" or "controller," and we are its "service provider" or "processor."

Information about users and billing is different. We handle it as described in our Privacy Policy, not under this DPA.

Annex 1 describes the client data we handle and why.

3. Following the firm's instructions

We handle client data only to provide ilaw, and only as the firm instructs. The firm's instructions are these terms, the settings it chooses in ilaw, and any other written instructions that fit ilaw's features. For example, turning on a USCIS lookup for a filing instructs us to send its receipt number to USCIS.

If an instruction would need work outside ilaw's normal features, we will agree on it in writing first. If we believe an instruction breaks a privacy law, we will tell the firm.

4. Sensitive data

Immigration work needs sensitive information. We expect client data to include:

• A-Numbers, Social Security numbers, passport numbers, and other government ID numbers;
• nationality, country of birth, and immigration status;
• information about children and family members named in a case; and
• anything else the firm stores in its case information system, which may include notes about health or other private matters.

We protect all client data as if it were sensitive. Annex 3 lists the extra safeguards. The firm should not bring payment card numbers or passwords for other services into ilaw.

5. Security

5.1 Our safeguards

We keep the security measures in Annex 3 in place. We may update them over time, but we will not make them less protective overall.

5.2 Our staff

Only Bits Workshop staff who need client data to run or support ilaw can see it. Each of them must keep it confidential.

5.3 Security incidents

If we learn of a security incident, we will:

• tell the firm without unreasonable delay, and no later than 72 hours after we confirm it;
• explain what happened, what data was involved, and what we are doing about it, as far as we know at the time;
• suggest steps the firm can take; and
• keep the firm updated and help it investigate.

The firm decides how to notify its clients and any regulators. If the firm asks, we will help write or send those notices. Telling the firm about an incident does not mean we accept fault for it.

5.4 The firm's part

The firm is responsible for:

• choosing who in the firm can use ilaw, and removing people who should no longer have access;
• keeping its own devices and accounts secure; and
• deciding that the measures in this DPA meet its needs, including its duties to protect client confidences.

6. Requests from people about their data

If someone asks us to see, correct, or delete their client data, we will send the request to the firm within 5 business days. We will tell the person that we did. We will not answer the request ourselves unless the firm asks us to or the law requires it.

We will help the firm answer these requests, at no extra charge, as far as ilaw's features allow. For example, we can find a person's records or delete them on the firm's instruction.

7. The firm's responsibilities

The firm is responsible for:

• having the right to bring client data into ilaw;
• giving its clients any notices, and getting any consents, that privacy laws or its professional rules require; and
• the instructions it gives us.

8. Service providers

8.1 Who they are

The firm allows us to use the service providers listed in Annex 4. Annex 4 lists each one, where it handles data, and what it does. The same list appears in Section 4.2 of our Privacy Policy.

8.2 Our duties when we use them

For each service provider, we will:

• have a written contract that protects client data at least as well as this DPA, for the work it does;
• allow it to use client data only to provide its service to us; and
• stay responsible for its work, as if we had done the work ourselves.

8.3 Adding a new service provider

Before a new service provider handles client data, we will:

• email the firm's owners with its name, its location, and what it will do;
• update Annex 4 and our Privacy Policy; and
• ask for the firm's active consent, as Section 13 of the Terms of Service describes for material changes.

Until an owner agrees, we will not send that firm's client data to the new service provider. If the firm does not agree and we cannot find another way, the firm may close its account. We will refund any fees paid for time after the account closes.

9. Reviews and audits

We are a small company, and we do not yet have a third-party security certification such as SOC 2. To help the firm check our work:

• We will answer a reasonable security questionnaire once a year, and when a regulator requires it.
• We will provide documents that describe our security measures.
• If a law or a regulator requires an audit, we will cooperate. The firm and its auditor must give us at least 30 days' notice, agree on the scope with us, and keep what they learn confidential. The firm pays for its own auditor.

If we later get a security certification, the firm agrees to accept its report in place of an audit of the same controls.

10. When the account closes

When the firm's account closes, we stop using client data for anything except returning or deleting it.

• 14-day window. We keep client data for 14 days after the account closes. During that time, a firm owner can ask for a copy in a common file format, or ask us to delete it at once.
• Destruction. After 14 days, we delete the client data and destroy the firm's encryption key. This makes the data unreadable everywhere, including in our backups.
• No copies after that. We cannot provide a copy of the data once the 14 days have passed.

If a law requires us to keep some client data longer, we will keep it confidential and protected, use it only for that legal purpose, and delete it when the law allows.

11. AI and automated decisions

• We do not use client data to train, fine-tune, or improve any AI or machine learning model, ours or anyone else's.
• We require our service providers not to use client data to train their models.
• ilaw does not make automated decisions about people. It reports case information so that attorneys can make their own decisions.

12. Changes to this DPA

We change this DPA the same way we change the Terms of Service (see Section 13 of the Terms). A material change needs a firm owner's active consent before it applies to the firm.

We may make changes that a new privacy law requires. Even then, we will not reduce the protection for client data or add to the firm's duties without an owner's consent.

13. Other terms

• What controls. If this DPA conflicts with the Terms of Service about client data, this DPA controls.
• Liability. The limits on liability in Section 11 of the Terms of Service apply to this DPA.
• How long this DPA lasts. This DPA lasts as long as we hold any client data, even after the Terms of Service end.
• Not part of the price. Our access to client data is not something the firm pays us with. We use it only to provide ilaw.
• Notices. We send notices under this DPA to the firm's owners by email. The firm can send notices to legal@bits-workshop.com.

14. Contact us

privacy@bits-workshop.com

Bits Workshop Ltd
1500 N Grant St #12096
Denver, CO 80203

Annex 1: What we handle and why

What ilaw does: ilaw helps U.S. immigration law firms follow their clients' cases. It copies the firm's matters and contacts from its case information system. It checks case status with USCIS and the immigration courts (EOIR), and tells staff about changes.

Whose data: The firm's clients and prospective clients. People named in their cases, such as spouses, children, parents, beneficiaries, petitioners, and employers. The firm's staff, as listed in its case information system.

What data:

• Identity details: names, dates and places of birth, nationality, and photos or notes in a contact record.
• Government ID numbers: A-Numbers, Social Security numbers, passport numbers, and other ID numbers.
• Contact details: addresses, phone numbers, and email addresses.
• Family and relationship details.
• Case details: matter types and statuses, assigned staff, priority dates, receipt numbers, and form types.
• Government case information: USCIS case statuses and history, Annual Asylum Fee status, and immigration court hearings, judges, decisions, and appeals.
• Document details: the names and folders of documents in the case information system. We do not keep copies of document files.
• Free-text notes and custom fields from the case information system.

What we do with it: Store it, show it to the firm's users, compare new answers with old ones to find changes, and tell users about changes in ilaw and by email. When the firm turns on a lookup, we send the receipt number, A-Number, or nationality to USCIS or EOIR.

How often: Continuously, while the firm's account is open. We copy records from the case information system about once an hour.

How long: While the firm's account is open, then 14 days after it closes (see Section 10).

Where: In the United States.

Annex 2: State privacy laws

For client data covered by the CCPA or a similar state law, we act as the firm's service provider, contractor, or processor. We agree that:

• The firm gives us client data only for the limited purposes in the Terms of Service and this DPA.
• We will not sell or share client data, as those laws define those words.
• We will not keep, use, or disclose client data for any purpose except providing ilaw, or outside our direct relationship with the firm.
• We will not combine one firm's client data with personal information from another firm or from anywhere else, except as those laws allow and ilaw needs.
• We will give client data the same level of privacy protection that those laws require.
• We will tell the firm if we can no longer meet our duties under those laws.
• The firm may take reasonable steps to make sure we handle client data as these laws require. It may also take reasonable steps to stop and fix any use that is not allowed.

We understand these duties and will follow them. Section 8 is how we give notice of new service providers. Section 9 is how the firm can check our work.

Annex 3: Security measures

Accounts and sign-in

• Every user must use two-factor sign-in with an authenticator app. Recovery codes and two-factor secrets are stored encrypted.
• Passwords must be at least 12 characters. We store only a slow, salted hash (scrypt), never the password itself.
• Sign-in attempts and two-factor codes are rate limited, and repeated wrong codes lock the account for a time.
• Sessions end after 7 days without use. Changing a password or second factor signs out every other session.
• Accounts are created only by invitation. There is no public sign-up.

Keeping firms apart

• Every request acts for one signed-in user in one firm.
• The database enforces this with row-level security. It refuses to return one firm's data to another firm, even if our code makes a mistake.

Encryption

• All connections use TLS. Browsers are told to always use secure connections (HSTS).
• Each firm's sensitive data is encrypted with AES-256-GCM, using a key that belongs to that firm alone. Each firm's key is kept in Google Cloud Key Management Service, never in our database.
• Each encrypted value is tied to the firm, table, and record it belongs to. It cannot be read if it is copied anywhere else.
• Database disks and backups are also encrypted by Google Cloud.

Deleting a firm

• Closing a firm's account turns off its key, which makes its data unreadable everywhere, including in backups. The key is destroyed 14 days later.

Logs

• Logs never contain A-Numbers, receipt numbers, client names, passwords, sign-in links, or search terms.
• Browser error reports do not include IP addresses or cookies.
• Logs are kept for 30 days. Error reports are kept for up to 90 days.

Support access

• Our support staff can view a firm's account as a user would, to fix a problem. Each support session lasts at most 15 minutes and shows a banner.
• We record who started each session, when, and why. While a support session is active, all actions are recorded in an audit log. Support staff cannot change passwords, two-factor settings, or firm members during a session.

Hosting and operations

• ilaw runs on Google Cloud in the United States. Google is responsible for the physical security of its data centers.
• The database has no public address. Only ilaw's own servers can reach it.
• Secrets are kept in Google Secret Manager, not in code.
• Code changes are reviewed and tested automatically before they are deployed. Deploys use short-lived credentials, with no stored keys.
• Database backups run daily and are kept for 14 days, with point-in-time recovery for the last 7 days.
• Uptime checks and alerts tell us when ilaw or a background job has a problem.

People

• Only a small number of Bits Workshop staff can reach production systems. Access is removed when it is no longer needed.
• Everyone with access must keep client data confidential.

Incidents

• We investigate any sign of a security incident and notify firms as Section 5.3 describes.

Annex 4: Service providers

Not service providers. Some other parties receive data, but do not act as our service providers for client data:

• USCIS and EOIR receive receipt numbers, A-Numbers, and nationality only when the firm turns on a lookup. They are government agencies acting under their own rules.
• The firm's case information system, such as DocketWise, is the firm's own vendor. We only read from it, with the firm's permission.
• Stripe handles billing details, not client data. Our Privacy Policy covers it.