Data Processing Addendum

1. Parties and roles

The Customer named on the Taper account determines the purposes of its End-user client records and is the controller for that customer relationship. Jai Austin Barfoot, sole trader, ABN 87 274 343 489, trading as Taper by Aiandi, processes that data to provide the Service. Taper remains responsible for account, security, billing, support, abuse-prevention, and legal-compliance processing it determines for its own operations. These labels do not remove duties imposed directly on either party by applicable law.

2. Processing details

• Purpose: style selection, AI haircut previews, queue management, cut cards, client history, analytics, support, security, and disaster recovery.
• Data: names, contact details, selected styles, visit data, consent records, photos, AI preview outputs, and limited device or request metadata.
• People: the Customer's clients, prospects, staff, and contractors.
• Duration: for the subscription and the retention periods stated in the Privacy Policy, unless law requires longer.

3. Documented instructions

Taper will process Customer Data only to provide and secure the Service, comply with the Customer's documented use of product controls, or comply with law. Taper will tell the Customer if an instruction appears unlawful, unless law prevents notice.

4. Customer obligations

The Customer must have a lawful basis for all Customer Data; provide required collection notices; obtain separate express consent for photo/AI processing and persistent image storage; record adult or guardian age assurance where a minor may be involved; avoid uploading unnecessary data; keep staff access current; and respond to End-user requests. Customer email campaigns require separate activation, versioned owner acceptance and recorded email-specific permission; SMS remains Coming Soon. The Customer instructs Taper to deliver only approved shop offers and to enforce unsubscribe, bounce and complaint blocks. Completed-visit segmentation is limited to that Customer\'s shop; photo consent does not authorise marketing. Taper is not a facial-recognition, surveillance, or identity-verification service.

5. Confidentiality and security

Taper restricts access to people and providers who need it to operate the Service and who are bound by confidentiality obligations. Measures include HTTPS, password hashing, role-based and tenant-scoped access, server-side secret storage, authenticated AI entitlements and quotas, rate limiting, security logging, restricted backups, dependency review, and documented incident response.

6. Subprocessors and overseas processing

Analytics addition, 12 October 2026: Plausible Analytics (Estonia; EU hosting) is the provider for limited website and product funnel measurement when enabled. No shop-client content, photos, contact details, notes or account identifiers are sent. Browser network metadata and the limited events described in the Privacy Policy are processed by this provider. Collection begins only after the updated notice is published.

The Customer authorises Taper to use subprocessors needed to provide the Service. Current categories include DigitalOcean (Sydney hosting), Stripe (billing), Resend (activated customer email campaigns and delivery events), and Resend or an SMTP provider (transactional email), and OpenAI (AI image processing). Stripe, email providers, and OpenAI may process information outside Australia, including in the United States.

Taper will assess material new subprocessors, require appropriate contractual and security commitments, and post or notify Customers of material changes where practical. A Customer with a reasonable data-protection objection should contact privacy@taper.style promptly so the parties can discuss an alternative.

7. Individual rights

Taper will reasonably assist the Customer with access, correction, deletion, consent withdrawal, and complaint requests. The app provides export, per-client photo deletion, full client deletion, and account-closure controls. If an End-user contacts Taper directly, Taper may refer the request to the relevant shop and will assist where legally permitted.

Customer campaign processing schedule: 10 September 2026

Upon explicit campaign activation, processing includes recipient email addresses, recorded permission, completed visit segments, owner-approved message content, delivery events and offer redemptions. No photos or inferred sensitive traits are used for targeting. Delivery contact/payload copies are redacted from active records after 90 days or earlier on linked-client deletion. Restricted shop-specific suppression fingerprints remain as needed to prevent unwanted sending. Consent and account records, backups and provider retention are addressed in the Privacy Policy. Taper does not combine this data with other shops, Aiandi or On Tap for advertising.

8. Deletion, return, and backups

On a valid instruction or scheduled account closure, Taper will delete or return Customer Data unless law requires retention. Deleted production data may remain in access-restricted disaster-recovery backups for up to 30 days before ageing out. Such backups will not be used for ordinary processing and, if restored after an incident, valid deletion requests will be reapplied.

9. Security incidents

Taper will investigate a confirmed incident involving Customer Data and notify the affected Customer without undue delay after obtaining enough information to provide a useful notice. Taper will provide available details about the nature of the incident, affected data, likely consequences, and mitigation, and will cooperate with legally required notifications.

10. Evidence and audits

On reasonable written request, Taper will provide information needed to demonstrate the controls in this Addendum. Audits must be proportionate, protect other customers and Taper's security, avoid service disruption, and use existing reports or remote evidence first. Bespoke audit costs may be charged where permitted and agreed in advance.

11. Priority and contact

If this Addendum conflicts with the Terms about processing Customer Data, this Addendum prevails. Liability remains governed by the Terms to the extent permitted by law. Questions and requests: privacy@taper.style or hello@taper.style.

Customer-image retention update (15 September 2026). Customer originals, previews and thumbnails are limited to 24 hours in Taper. New disaster-recovery backups exclude customer images. Older restricted backups may still contain images until migration removes them; they are not used for routine access. Text-only customer records follow the separate retention periods in the Privacy Policy. AI providers operate under their own retention rules: OpenAI may retain API content in abuse-monitoring logs for up to 30 days by default, with exceptions and different approved account controls. Taper does not promise deletion of provider-held copies within 24 hours. Downloads or copies independently retained by a shop or customer are outside Taper storage; shops must handle them lawfully and must not use downloads to evade this retention policy.