Data Processing Agreement
Effective Date: The date the Customer accepts the Terms of Service, or November 8, 2026, whichever is later
Service: Pluto, a product operated by Formed Skin LLC, a Washington limited liability company
Between: Formed Skin LLC, the company that operates Pluto, as "Processor" or "Service Provider" (references to "Pluto" in this DPA mean Formed Skin LLC); and the business that accepts the Pluto Terms of Service ("Customer", "Controller", or "Business")
Contact: hello@madewithpluto.com
1. Background and Scope
This Data Processing Agreement ("DPA") is part of the Pluto Terms of Service (the "Agreement") between Formed Skin LLC and Customer. It applies automatically, without a separate signature, whenever Pluto processes Personal Data on Customer's behalf in providing the Service — most commonly, personal information about Customer's own customers or contacts (for example, names, emails, and order records) that Customer stores in, or syncs into, the Service.
This DPA does not cover Pluto's handling of Customer's own account and billing information (the names and email addresses of Customer's Workspace users and billing contact), which Pluto handles as an independent controller under the Pluto Privacy Policy.
If this DPA and the Agreement conflict about the processing of Personal Data, this DPA controls.
2. Definitions
- "Personal Data" means any information relating to an identified or identifiable natural person that Pluto processes on Customer's behalf in connection with the Service, as further described in Annex 1.
- "Data Protection Laws" means all laws and regulations applicable to the processing of Personal Data under this DPA, including, as applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and other applicable U.S. state privacy laws.
- "Controller," "Processor," "Data Subject," and "Processing" have the meanings given in applicable Data Protection Laws, and "Business," "Service Provider," "Consumer," and "Sell/Share" have the meanings given in the CCPA, in each case applied to the corresponding roles of Customer and Pluto.
- "Sub-processor" means a third party engaged by Pluto to process Personal Data in order to provide the Service, as listed in Annex 3.
- "Security Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data processed under this DPA.
3. Roles of the Parties
Customer is the Controller (or Business, under the CCPA) of the Personal Data it submits to or generates within the Service, and Pluto is the Processor (or Service Provider). Pluto acts only on Customer's documented instructions, which are this DPA, the Agreement, and Customer's use of the Service's ordinary features.
Pluto will process Personal Data only: (a) to provide, secure, maintain, back up, troubleshoot, and support the Service; (b) to follow Customer's documented instructions given through the Service or in writing; and (c) as required by law, in which case Pluto will tell Customer about that legal requirement first, unless the law prohibits it.
Pluto will not: (a) Sell or Share Personal Data; (b) retain, use, or disclose Personal Data for any purpose other than providing the Service, including for Formed Skin LLC's own commercial purposes or those of Formed, the skincare business it also operates; (c) retain, use, or disclose Personal Data outside the direct business relationship between Pluto and Customer; or (d) combine Personal Data received from Customer with personal data received from another source, except as Data Protection Laws permit.
Pluto will tell Customer promptly if it decides it can no longer meet its obligations under this DPA or Data Protection Laws. Customer may then direct Pluto to take reasonable steps to stop and fix any unauthorized use of Personal Data.
4. Personnel
Pluto will ensure that people authorized to process Personal Data are bound by a written confidentiality obligation and understand their data-protection responsibilities.
5. Security Measures
Pluto will implement and maintain reasonable technical and organizational measures, appropriate to the nature of the Personal Data, to protect it against Security Incidents, as described in Annex 2. Pluto may update these measures over time, provided the update does not materially reduce the overall level of protection.
6. Sub-processors
Customer authorizes Pluto to use the Sub-processors listed in Annex 3. Pluto will: (a) engage each Sub-processor under written terms that include confidentiality and data-protection obligations; (b) remain responsible for each Sub-processor's performance in providing the Service; and (c) email the Workspace owner at least 10 days before engaging a new Sub-processor that will process Personal Data, so Customer can object on reasonable data-protection grounds. If the parties cannot resolve Customer's objection, Customer may cancel its subscription under Section 4.5 of the Terms, as its sole remedy.
Pluto's Sub-processors are engaged under their own standard terms. Pluto has not separately negotiated bespoke data-protection agreements with each of them, and does not represent that it has.
Integrations Customer connects are not Sub-processors. When Customer connects a third-party service — Shopify, Google Calendar, Meta or Instagram, Klaviyo, or Judge.me — or supplies its own AI provider API key, that service acts for Customer, under Customer's own agreement with it. Customer is responsible for what it sends to and receives from that service.
7. Assistance to Customer
Taking into account the nature of the processing, Pluto will give Customer reasonable help, at Customer's expense for anything beyond standard in-product functionality, to: (a) respond to requests from Data Subjects exercising their rights under Data Protection Laws, where Customer cannot reasonably do so using the Service itself; (b) meet Customer's obligations regarding data protection assessments, where Data Protection Laws require them and they relate to Pluto's processing; and (c) demonstrate compliance with this DPA, as described in Section 10.
If Pluto receives a request from a Data Subject about Personal Data it processes for Customer, it will pass the request to Customer and will not respond to it directly, except to tell the person to contact Customer.
8. Security Incident Notification
Pluto will notify Customer without undue delay, and in any event within 72 hours of becoming aware of a Security Incident affecting Customer's Personal Data, to the extent legally permitted. The notification will describe, as far as then known, the nature of the incident, the categories and approximate volume of Personal Data affected, and the measures taken or proposed to address it. Pluto will provide further information as it becomes available and will not publicly name Customer in connection with the incident without Customer's consent, except as required by law.
9. Location of Processing
Personal Data is processed and stored in the United States. The Service is operated from the United States and is not currently offered to, or marketed to, individuals in the European Economic Area, United Kingdom, or Switzerland.
This DPA is therefore written for U.S. state privacy law. It does not contain a complete set of GDPR Article 28 processor terms or any international transfer mechanism, and Pluto does not represent that it does. Before offering the Service in those jurisdictions, Pluto would put an appropriate transfer mechanism in place, complete the Article 28 terms, and update this DPA.
10. Audits
On at least 30 days' written notice, and no more than once in any 12-month period (except after a Security Incident or as a regulator requires), Pluto will make available the information reasonably necessary to show it complies with this DPA. That may be a written summary, a completed security questionnaire, or a relevant third-party certification Pluto then holds, at Pluto's reasonable discretion, instead of an on-site audit. Any audit will take place during business hours, under confidentiality obligations, and at Customer's expense unless it finds a material non-compliance.
11. Return and Deletion of Data
During the Agreement, Customer can export its records as CSV files from within the Service at any time, and can delete records, or a whole Workspace, itself.
When the Agreement ends, Pluto will keep Personal Data available for export for 30 days, as the Terms of Service describe, and will then delete it, or de-identify it, from its live systems. Copies in backups are deleted as those backups expire, on the schedule in the Data Retention section of the Privacy Policy. Pluto may keep Personal Data longer only where the law requires it. This DPA continues to apply to anything kept.
12. De-identified Data
If Pluto de-identifies Personal Data, it will take reasonable steps to ensure the data cannot be linked back to a person or household, will not attempt to re-identify it, and will require anyone it shares de-identified data with to do the same. De-identified data is also subject to Section 5.3 of the Terms of Service, which forbids anything that could reveal a Customer's formulas, suppliers, costs, customer records, or trade secrets.
13. Liability
Each party's liability arising out of or related to this DPA, whether in contract, tort, or otherwise, is subject to the limitations of liability in the Agreement, applied in aggregate across the Agreement and this DPA, except where Data Protection Laws prohibit limiting liability for the type of claim at issue.
14. Term and Changes
This DPA takes effect on the Effective Date and continues for as long as Pluto processes Personal Data on Customer's behalf.
Pluto may update this DPA in the same way, and with the same notice, as the Agreement allows for the Terms of Service. If a change in Data Protection Laws requires new terms, the parties will cooperate in good faith to adopt them.
15. General
This DPA is governed by the same law as the Agreement. If any provision is found unenforceable, the rest remain in effect. Customer accepts this DPA by accepting the Terms of Service. Where Customer needs a countersigned copy, it can ask at hello@madewithpluto.com; either form is equally binding.
Notices under this DPA go to hello@madewithpluto.com, and from Pluto to the email address of the Workspace owner.
Annex 1 — Details of Processing
Subject Matter. Formed Skin LLC's provision of the Pluto inventory, formulation, and production-management Service to Customer, including hosting, display, storage, backup, email delivery, and AI-assisted processing of data Customer submits or connects.
Duration. For the term of the Agreement, plus the export and backup periods in Section 11.
Nature and Purpose of Processing. Storage, organization, retrieval, and display of Personal Data within the Service; nightly backup; delivery of emails a Workspace member sends through the Service, such as quotes; sending relevant content to an AI model Sub-processor when someone in the Workspace uses an AI Feature; fault diagnosis; and transfer to and from third-party integrations Customer connects.
Categories of Data Subjects.
- Customer's own personnel and Workspace members, to the limited extent their information is processed under this DPA rather than as Pluto's own controller data.
- Customer's customers, contacts, or order recipients whose information Customer stores in or syncs into the Service.
- Customer's suppliers and business contacts.
- People who leave a public review or a public comment on Customer's advertisements, where Customer has connected a reviews or advertising integration that returns their name or the text they wrote.
Categories of Personal Data.
- Identity and contact data: name, email address, phone number, company name, and business address.
- Transaction data: order records, quotes, order values, purchase history, and derived per-customer statistics.
- Publicly posted content: review text, review ratings, and comment text, together with the display name the platform attaches to them.
- Any other Personal Data Customer chooses to enter into free-text fields, notes, or uploaded documents and images. Customer agrees not to submit special categories of Personal Data (health, government identification numbers, financial account credentials, or similar sensitive data) unless the parties separately agree in writing to support that data.
Special Categories of Data. None are intended to be processed under this DPA. See the restriction above.
Annex 2 — Technical and Organizational Security Measures
- Encryption of stored third-party integration credentials and AI provider API keys using AES-256-GCM, with the encryption key held in the application environment and never in the database.
- Encryption in transit (TLS) for all data sent between the Customer's browser and the Service.
- Database-level row-level-security policies enforcing per-Workspace isolation, checked by an automated isolation test suite that runs in continuous integration on every proposed change and on every change to the main branch, with a separate check that fails the build if that suite did not run.
- Access controls limiting internal access to Personal Data to people who need it to operate or support the Service.
- Error monitoring configured to exclude request bodies, cookies, user identities, IP addresses and session recordings, and to discard any error report that appears to contain a secret.
- Nightly backups of the database and uploaded files to a storage provider separate from the database host, kept for 30 days, plus the database provider's own managed backups.
- A defined incident-response process, including the notification commitments in Section 8.
Annex 3 — Authorized Sub-processors
As of the Effective Date, Formed Skin LLC uses the following Sub-processors. This list matches the providers named in the Privacy Policy.
| Sub-processor | What it does | Personal Data it receives | Location |
|---|---|---|---|
| Supabase | Database, file storage, and sign-in | All Customer Data | United States |
| Vercel | Application hosting | All Customer Data passes through it; server logs | United States (US East) |
| Cloudflare | Backup storage (R2) | A nightly copy of the database and uploaded files | United States |
| Resend | Email delivery | Invitations, quotes a Workspace member emails (with the PDF), and support requests | United States |
| Sentry | Error monitoring | Technical fault reports; URLs may contain Workspace identifiers | United States |
| Anthropic | AI Features, including reading documents and images | Content sent when someone uses an AI Feature | United States |
| OpenAI | AI Features (text assistant), where a Workspace chooses it | Content sent when someone uses an AI Feature | United States |
| Google Maps Platform | Address search, where enabled | Address text typed into an address search box | United States |
| Stripe | Billing | Billing contact details only; no Customer Data | United States |
When the AI providers receive anything. Anthropic and OpenAI receive content only for a Workspace whose plan includes AI Features, and only when someone in that Workspace uses one. Nothing is sent to them in the background. Pluto does not use Customer Data to train AI models; each provider handles what it receives under its own commercial or API terms.