SaplynSign in

Saplyn Data Processing Addendum

Version: October 6, 2026 · Mommalyn Inc.

This Data Processing Addendum ("DPA") is incorporated into the Saplyn Terms of Service (the "Agreement") between Mommalyn Inc. ("Saplyn") and the customer identified in the Agreement (the "Center"), and governs Saplyn's processing of Customer Data on the Center's behalf. If this DPA conflicts with the Agreement, this DPA controls as to the processing of Customer Data.

1. Definitions

  • "Customer Data" means personal data that the Center or its Authorized Users submit to the Service and that Saplyn processes on the Center's behalf. It excludes Saplyn Account Data.
  • "Saplyn Account Data" means data Saplyn processes as a controller for its own purposes, as described in the Privacy Policy: account and authentication data, the Center's payments to Saplyn, usage analytics, and support communications.
  • "Data Protection Laws" means U.S. federal and state privacy laws applicable to the processing of Customer Data. Terms those laws define (such as "controller," "processor," "sale," and "targeted advertising") have the meanings given there.
  • "Subprocessor" means a third party Saplyn engages to process Customer Data.
  • "Security Incident" means a confirmed breach of Saplyn's security leading to unauthorized access to, or loss or disclosure of, Customer Data.

2. Roles and scope of processing

2.1 Roles. For Customer Data, the Center is the controller and Saplyn is its processor / service provider. For Saplyn Account Data, Saplyn is the controller.

2.2 Details of processing.

  • Nature and purpose: hosting, storing, transmitting, displaying, and analyzing Customer Data to provide the Service as configured by the Center.
  • Duration: the term of the Agreement plus the wind-down period in § 9.
  • Data subjects: children enrolled at or applying to the Center; their parents, guardians, household members, and contacts; the Center's staff and applicants; and people the Center or its families invite.
  • Categories of personal data: identity and contact data; application, enrollment, attendance, and scheduling records; daily care records, photos and media, and developmental observations; health-related data (allergies, diet, medical and medication information, immunizations, incident reports); custody and release restrictions; staff employment and credential records; billing records; messages, documents, and attachments; and content submitted to AI and voice features.

2.3 Sensitive data. Customer Data includes personal data about children and health-related information. The Center is responsible for having the legal right — including any required parental consents — to collect it and to direct Saplyn to process it.

3. Saplyn's obligations

Saplyn will:

(a) process Customer Data only on the Center's instructions — the Agreement, this DPA, and the Center's and its Authorized Users' configuration and use of the Service — unless required by law;

(b) not sell Customer Data, share it for targeted advertising, or retain, use, or disclose it for any purpose (including training AI models) other than providing the Service or as Data Protection Laws permit a service provider. Saplyn may de-identify Customer Data and use the result, which cannot reasonably be used to identify any Center or person, and will not attempt to re-identify it;

(c) ensure that people it authorizes to process Customer Data are bound by confidentiality obligations;

(d) maintain the security measures in § 5;

(e) notify the Center if it can no longer meet its obligations under Data Protection Laws; and

(f) make available information reasonably necessary to demonstrate compliance with this DPA (§ 8.2).

4. The Center's obligations

The Center will: (a) have all consents and notices required for the Customer Data it collects and instructs Saplyn to process; (b) use the Service's access controls appropriately and keep its user lists current; (c) not instruct Saplyn to process Customer Data in violation of law; and (d) respond to data subjects who contact it.

5. Security measures

Saplyn maintains administrative, technical, and organizational measures appropriate to the nature of Customer Data, including encryption in transit and at rest, logical separation of each Center's data, role-based access controls, audit logging, and limiting personnel access to those who need it. Payment card and bank account numbers are collected by Stripe and are not stored by Saplyn. Saplyn may update these measures provided the overall level of protection is not materially reduced.

6. Subprocessors

6.1 The Center authorizes Saplyn to engage the subprocessors on the Subprocessor List and to add or replace subprocessors as described below.

6.2 Saplyn will bind each subprocessor by written contract to data protection obligations consistent with this DPA and remains responsible for each subprocessor's performance.

6.3 Changes. Saplyn will update the Subprocessor List before a new subprocessor processes Customer Data; the updated list is the Center's notice. The Center may object by emailing legal@saplyn.co, and if the objection cannot be resolved the Center may close its account.

7. Assistance

Saplyn will reasonably assist the Center, primarily through the Service's own tools, in responding to data subject requests and in conducting data protection assessments required by law. If a data subject contacts Saplyn about Customer Data, Saplyn will refer them to the Center. Where licensing laws require the Center to retain records despite a deletion request, Saplyn will follow the Center's lawful instruction.

8. Security incidents; audits

8.1 Notification. Saplyn will notify the Center without undue delay after confirming a Security Incident affecting the Center's Customer Data, and will share what it knows about the incident and the steps taken. The Center is responsible for any notices the law requires it to give to individuals or regulators; Saplyn will reasonably cooperate.

8.2 Audits. No more than once per year, and after a Security Incident, the Center may assess Saplyn's compliance with this DPA by written questionnaire and review of Saplyn's relevant documentation.

9. Deletion and return

After termination of the Agreement, the Center may export Customer Data during the 30-day wind-down period. After that period, Saplyn will delete Customer Data within 60 days, except copies in backups (deleted on the backup rotation schedule) and data Saplyn must retain by law. On written request, Saplyn will confirm deletion.

10. Data location

Saplyn hosts Customer Data in the United States.

11. General

This DPA lasts as long as Saplyn processes Customer Data. Each party's liability under this DPA is subject to the limitations of liability in the Agreement, and this DPA is governed by the law governing the Agreement.