DobroDesk Legal Pack

1. Agreement and definitions

This DobroDesk Legal Pack is an agreement between CoMStudio OÜ, registry code 17167299, Lõõtsa tn 5, 11415 Tallinn, Estonia ("CoMStudio", "we", "us" or "our") and the organization or person that creates, buys or uses a DobroDesk Workspace ("Customer", "you" or "your"). DobroDesk is a CoMStudio product.

This page contains DobroDesk's service terms, privacy roles, Data Processing Addendum ("DPA"), security measures and subprocessor information. An online checkout, order form or other written order accepted by CoMStudio is an "Order". This Legal Pack and each applicable Order form the "Agreement".

If the documents conflict, the DPA controls the processing of Customer Personal Data. An Order controls the commercial details it expressly changes. This Legal Pack controls all other matters. Mandatory law applies where the parties cannot change it by contract.

You accept the Agreement when you create a Workspace, click to accept it, place an Order or use DobroDesk. If you act for an organization, you confirm that you can bind it. DobroDesk is for business use. Individuals must be at least 16 years old and legally permitted to use DobroDesk in their jurisdiction. A minor must obtain any consent required by applicable law from a parent or legal guardian and receive any supervision that law requires.

A person entering into a contract for paid DobroDesk services must be at least 18 and have legal capacity to do so. Where a minor uses paid services, a parent, legal guardian or another adult legally authorized to act on the minor's behalf must accept the paid terms and is responsible for payment.

Defined terms

Authorized User

An employee, contractor or other person that Customer authorizes to use its Workspace.

Connected Service

A third-party mailbox, channel, knowledge source, customer system, migration source or application that Customer connects.

Customer Data

Data, content and instructions submitted to DobroDesk by or for Customer. This includes support messages, customer and company records, files, internal notes, knowledge, integration data, configuration and AI inputs and outputs. Account, billing and service-security data that CoMStudio processes for its own purposes is not Customer Data.

Customer Personal Data

Personal data in Customer Data that CoMStudio processes on Customer's behalf.

End User

A person who communicates with Customer by email, through a website widget or through another connected support channel.

Workspace

Customer's DobroDesk tenant, including its Channels, Inboxes, Teams, Conversations, Customers, Companies and settings.

2. DobroDesk service

DobroDesk is a business customer-support service. It turns customer communications into Conversations and provides shared Inboxes, assignment tools, customer context, knowledge, reporting, automation and AI assistance. Depending on the Order and Workspace, it may also include public help content, APIs, webhooks and enterprise controls.

Customer's subscription includes only the features shown as available in the applicable Order, checkout and Workspace. Preview, beta, trial, roadmap and disabled features are not paid commitments unless an Order expressly says otherwise. They may change or be withdrawn without a service-level commitment.

Customer may use DobroDesk for its internal business operations and to support its own End Users. Customer may not resell DobroDesk, offer it as a standalone service to an unrelated third party or use it to build a competing service without CoMStudio's written agreement.

Accounts and Workspace administration

Customer must:

• provide accurate account and billing information;

• authorize and remove Authorized Users and assign appropriate permissions;

• protect sign-in methods, recovery methods, API tokens, integration credentials and devices;

• take responsibility for Workspace activity unless it was caused by CoMStudio's breach of the Agreement; and

• promptly notify CoMStudio at support@comstud.io about suspected unauthorized access.

CoMStudio may access a Workspace only to provide requested support, maintain or secure the service, investigate abuse, comply with law or perform the Agreement. Access is limited by role and confidentiality obligations.

3. Customer Data

As between the parties, Customer retains its rights in Customer Data. Customer gives CoMStudio and its subprocessors a non-exclusive, worldwide and limited right to host, copy, transmit, transform, display and otherwise process Customer Data only to provide, secure, support and maintain DobroDesk, follow Customer's documented instructions and comply with law.

Customer is responsible for the accuracy, legality and quality of Customer Data. Customer must have the rights, notices, permissions and lawful basis needed to collect it and instruct CoMStudio to process it. Customer must not submit payment-card security codes, account passwords, private cryptographic keys or regulated health, biometric or similar high-risk data unless CoMStudio has expressly agreed in writing that DobroDesk supports that use.

CoMStudio does not sell Customer Data or use it for third-party advertising. CoMStudio may create and use aggregated statistics that do not identify Customer, an Authorized User or an End User to operate, secure, plan and improve DobroDesk. CoMStudio will not attempt to re-identify that information.

Service ownership and confidentiality

CoMStudio and its licensors own DobroDesk, its documentation, service designs and underlying technology. The Agreement gives Customer a limited right to use the service and does not transfer ownership. CoMStudio may use voluntary feedback without restriction, but will not identify Customer publicly as its source without permission.

Each party may receive non-public information that a reasonable person would understand to be confidential. The receiving party will use it only to perform the Agreement, protect it with reasonable care and disclose it only to personnel, advisers and providers who need it and are bound to protect it. These duties do not apply to information independently developed, lawfully received without restriction or publicly available without breach. A legally required disclosure may be made after prior notice where law permits.

Exports, retention and deletion

Customer may use the available export controls to retrieve Customer Data. The standard service keeps Conversations online for the period shown in the Workspace, currently 120 days, after which Conversations may become eligible for private archiving. Archiving is not deletion. Enterprise controls may allow an approved online-retention period from 30 to 3,650 days. These retention periods do not limit Customer's rights under Section 12.7.

At Customer's choice, CoMStudio will return or delete Customer Personal Data after the services involving its processing end or on a verified deletion request, in accordance with Section 12.7. Continued retention at Customer's request must be lawful and follow the DPA. Customer should export anything it needs before deleting a Workspace or ending access. This recommendation does not limit Customer's rights under applicable law to switch services or to port or retrieve exportable data and digital assets.

4. Channels, integrations, migrations and developer access

Customer may connect supported email services, website widgets, messaging channels, knowledge sources, commerce or customer systems, migration sources and developer clients. DobroDesk shows the available connections. Required permissions are shown to Customer before access is granted, either in DobroDesk or on the Connected Service's authorization page. Customer chooses each Connected Service and directs the exchange of Customer Data with it.

Customer must:

• have authority over each connected account, mailbox, domain, website, page, store, workspace, server and data source;

• follow the Connected Service's terms, messaging rules, response windows and consent requirements;

• request only the permissions and data needed for its support workflow;

• check imported data and mappings before relying on them; and

• disconnect a service when Customer no longer has authority or no longer needs the connection.

A Connected Service is controlled by its provider. CoMStudio does not guarantee that a provider will approve, maintain or continue an integration and is not responsible for a provider's systems, terms or processing after Customer directs data to it. CoMStudio may change, pause or stop an integration when the provider changes its interface or terms or continued use creates a security, legal or operational risk. Where practical, CoMStudio will provide notice and an export or transition path.

Once Customer has successfully disconnected a Connected Service through DobroDesk, DobroDesk stops using that connection for further access and removes the authorization credentials stored for it. This does not delete Customer Data already imported into the Workspace. That data remains subject to Customer's instructions and this Legal Pack's retention and deletion rules. Original records held by the Connected Service remain subject to the provider's terms and retention practices. The effect on provider-side authorization, queued operations or deliveries already in progress depends on the Connected Service and its provider.

For the Shopify integration, CoMStudio is solely responsible for DobroDesk, including its development, distribution and support. This also includes liability arising from a merchant's access to or use of DobroDesk or from CoMStudio's access, use, distribution or storage of Shopify merchant data. Shopify is not liable for DobroDesk faults or harm caused by its installation or use. Unless Shopify expressly says otherwise, Shopify cannot help install or use DobroDesk. Contact support@comstud.io for DobroDesk support.

Historical imports are not billable merely because they were imported. A later customer message that continues an imported Conversation may create an accepted Conversation. Migration credentials are deleted when Customer explicitly finishes or disconnects the migration flow, subject to limited retry and security records.

Customer may use published APIs, SDKs, webhooks and MCP only within their documented scopes and limits. Customer is responsible for its applications, callback endpoints, token custody, webhook verification and actions performed by its authorized clients. Customer must not bypass rate limits, probe non-public interfaces or use developer access to obtain another customer's data.

5. AI features

DobroDesk may use hosted open-model infrastructure for classification, language detection and translation, summaries, knowledge retrieval, quality review, drafts and optional automated replies. Customer messages, approved evidence, embeddings, prompts and outputs are not used to train shared or third-party AI models.

Customer-visible AI drafts require human approval by default. Customer may enable supported automated replies for selected Channels or Inboxes. Legal, billing, account deletion, privacy, abuse, security and clearly angry-customer matters remain under human control. DobroDesk routes a request to a person when its safety or evidence rules require it.

AI output can be incomplete, inappropriate or wrong. Customer must configure AI for its use case, review outputs where required and give End Users any notice or choice required by law. If AI interacts directly with an End User or sends content without prior human review, Customer must disclose the AI interaction where law requires and must not present AI-generated content as human-generated. Customer must not use AI for prohibited practices or for decisions that create a significant legal, employment, credit, insurance, healthcare, housing or similarly high-risk effect on a person.

CoMStudio may set technical limits, suspend an AI feature or require human review if use threatens security or service integrity, circumvents limits, violates the Agreement or could make DobroDesk a prohibited or high-risk AI system under applicable law.

6. Fees, usage and billing

Current prices, included usage, flat usage rates, add-ons, taxes and billing frequency are shown before purchase in the Order or checkout. Paddle is the Merchant of Record for Paddle purchases and handles checkout, payment methods, invoices, taxes and remittance. New DobroDesk subscriptions purchased through the Shopify App Store use Shopify billing and appear on the merchant's Shopify bill. Customer authorizes the billing provider shown at checkout to charge the confirmed subscription and usage amounts.

Connecting Shopify is included in DobroDesk. A Workspace with an existing paid subscription or prepaid service term keeps that arrangement and does not need a second subscription to connect a store.

DobroDesk is priced by accepted support Conversations rather than Authorized User seats. An accepted Conversation is a new support Conversation accepted for agent handling, AI handling or escalation. Replies in the same Conversation do not create another charge. Rejected spam, duplicate provider deliveries, bounces, quarantine-only messages, historical imports, internal notes and empty or abandoned widget sessions are not billable Conversations.

The base subscription currently includes 300 accepted Conversations per monthly billing period. Each started package of up to 1,000 additional accepted Conversations costs EUR 24 through Paddle or USD 28 through Shopify billing at every volume. The Shopify Base subscription costs USD 22 per monthly billing period. Shopify usage follows the subscription's billing cycle and is reported during that cycle. Closed-period Paddle usage may be added to the next renewal invoice.

AI assistance, normal integrations and Authorized Users are included unless an Order identifies a separate charge. Public Help Center sites and Enterprise controls may be separate recurring add-ons. Ending an add-on does not automatically end the base Workspace subscription.

Customer must review usage and billing information and report a good-faith billing dispute promptly. CoMStudio may suspend paid features after repeated failed payment attempts while keeping a limited billing-resolution path where practical. Fees exclude taxes unless checkout says otherwise.

The Founding Customer offer terms are set out in Section 7. Customer may buy additional usage at the standard rates shown in billing.

7. Cancellation and refunds

Customer may cancel a subscription through the available billing controls. Cancellation prevents the next renewal and normally takes effect at the end of the current paid period unless the billing interface or an Order says otherwise. Customer remains responsible for undisputed fees incurred before cancellation.

Uninstalling DobroDesk from the store cancels a Shopify-billed subscription and stops future billing cycles. Charges already incurred may still appear on a Shopify bill. Disconnecting a Shopify store does not cancel an existing Paddle subscription or prepaid Order.

Customer may request a full refund of a DobroDesk base subscription or recurring add-on within 14 days after its purchase or renewal, regardless of product usage. This ordinary-plan refund policy does not limit mandatory statutory rights. Any additional refund right that applies under CoMStudio's general Terms remains available. Contact support@comstud.io with the Workspace and transaction. An approved refund is processed through the original billing provider. We review usage corrections, duplicate charges and other billing disputes against the accepted-Conversation ledger and payment record.

Founding Customer offer

This exception applies only to an Order expressly identified at checkout as the one-time 12-month or 24-month Founding Customer offer. It covers one Workspace. The service term begins on activation and includes the quantities and items stated at checkout. Customer may request a full refund of the founder package within 30 days after activation, regardless of usage, by contacting support@comstud.io with the transaction or Workspace reference. The ordinary 14-day refund policy for other plans and all mandatory statutory rights remain in effect. Separately purchased usage and add-ons follow their applicable terms.

The Founding Customer Order does not renew or start a recurring subscription automatically. After its term, Customer may confirm a continuation checkout for an ordinary subscription with a 50% discount on the Base fee and on the fee for one Help Center for the first 12 months. Additional Help Centers and all other add-ons remain at their standard rates. The continuation subscription starts only after Customer explicitly confirms checkout. Its renewal choice is presented at checkout and applies after the 12-month continuation period. The Founding Customer Order does not authorize a subscription payment. This offer cannot be transferred through a shared coupon. Additional Help Centers, usage, voice, conversation and automation packs remain at their standard prices. Separately purchased usage and add-ons remain subject to their applicable terms.

8. Acceptable use

The following rules apply when Customer uses DobroDesk and when an Authorized User uses it. Neither may use DobroDesk:

• to violate the legal rights of others (for example, this may include infringing or misappropriating the intellectual property rights of others in violation of applicable laws);

• to engage in any activity that violates applicable law, or contravenes sanctions or export controls; or

• to impersonate another person or misrepresent the source or status of a communication.

In particular, Customer and Authorized Users agree not to use DobroDesk for the transmission of any of the following:

• unsolicited bulk messages (for example, unsolicited mass email, promotions, advertising or other solicitations sent in bulk);

• phishing or abusive content; or

• malware of any kind, including a virus or a worm.

Customer and Authorized Users agree not to use DobroDesk to scan or attack DobroDesk or another service. Nor may they overload either service or otherwise interfere with it. They further agree not to use DobroDesk to circumvent any access control, usage limit, response window, provider policy or safety measure. No non-public part of the service may be reverse engineered except where applicable law expressly allows it.

Customer and Authorized Users must not conduct unlawful surveillance through DobroDesk. Before collecting or disclosing personal data through it, they must meet any requirement as to authority or a lawful basis for the act in question, and give any notice it requires. If the data were lawfully collected in the first place, that does not by itself settle whether they may lawfully be disclosed. Before passing the data on they must meet the requirements for that disclosure, including giving any notice it requires.

Customer and Authorized Users must not use AI output from DobroDesk as verified professional advice. Consider, too, the use of an answer from DobroDesk when making a high-risk decision about a person. For such a decision (for instance, whether to grant or deny a person a loan), the output from DobroDesk must not be the sole basis for the decision. Both restrictions also apply to AI output from another AI system when brought into DobroDesk.

CoMStudio may investigate if it suspects a violation. A report of abuse might concern an End User who received a message, for instance. If the risk allows, Customer will hear from CoMStudio about the issue and have an opportunity to correct it. CoMStudio may limit the affected access or suspend it where doing so is reasonably necessary to protect End Users, other customers, providers or the service. A security threat may call for immediate action by CoMStudio. So may unlawful activity, sanctions or material harm.

9. Term, suspension and termination

The Agreement starts when Customer first accepts it. It continues while Customer has an active Workspace, subscription or Order, unless it is terminated under this section.

Either party may terminate the Agreement for a material breach if the other party does not remedy it within 30 days after written notice.

CoMStudio may suspend access where reasonably necessary because of a security incident, unlawful use, sanctions or risk to the service. Where practicable, CoMStudio will give notice and an opportunity to address the issue. It may act before giving written notice of a material breach or before the cure period ends where reasonably necessary to prevent imminent harm, comply with law or protect the service, its users or third parties. Where practicable, the suspension will be limited to the affected account, feature or activity. Section 6 governs suspension for overdue payment.

A paid subscription renews until cancelled for the period and on the renewal choice expressly confirmed at checkout. A one-time Founding Customer Order does not renew or authorize a recurring payment. A continuation subscription starts only after Customer expressly confirms checkout, as described in Section 7.

Subject to applicable switching and retrieval rights, when the Agreement ends, Customer's right to use DobroDesk ends immediately and outstanding fees remain payable when due under the applicable agreement. Provisions that by their nature should survive, including obligations concerning ownership, confidentiality, payment, liability, disputes and data protection, continue to apply. Customer Data is handled as described in Section 3 and the DPA.

Where the Data Act switching provisions apply to DobroDesk, the Switching and exit terms apply to the affected DobroDesk service. They do not limit Customer's other rights under this Legal Pack or applicable law.

10. Warranties, indemnity and liability

CoMStudio will provide paid DobroDesk services with reasonable skill and care and use commercially reasonable measures to protect the service. Except for that commitment and any warranty that law does not allow it to exclude, DobroDesk is provided "as is" and "as available". CoMStudio does not promise uninterrupted operation, a particular business result or continued availability of a Connected Service. A service-level agreement applies only if an Order expressly includes one.

Customer will defend and indemnify CoMStudio against a third-party claim to the extent it results from Customer Data, Customer's unlawful communications, Customer's Connected Services or Customer's material breach of the Agreement. CoMStudio must give prompt notice and reasonable cooperation. Customer controls the defense but may not settle a claim in a way that admits fault or imposes obligations on CoMStudio without written consent.

To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, punitive or consequential damages or for lost profits, revenue, goodwill or anticipated savings. CoMStudio's total aggregate liability arising from DobroDesk is limited to the greater of EUR 500 or the fees paid for DobroDesk during the six months before the event giving rise to the claim.

These exclusions and limits do not apply to fraud, wilful misconduct, death or personal injury caused by negligence or liability that applicable law does not allow a party to exclude or limit. The limitations apply across all legal theories and together form one aggregate cap.

11. Privacy and data roles

As controller, CoMStudio decides why and how it processes website visitor data, account and Authorized User details, business contacts, billing metadata, direct support requests, service-security data and its own legal records.

CoMStudio acts as processor for Customer Personal Data in support Conversations, customer records, files, knowledge and Connected Services. It processes that data on Customer's documented instructions under the DPA. Depending on the relevant processing, Customer may be the controller or a processor acting for another controller.

If you communicate with a company that uses DobroDesk, that company is normally the controller of your support Conversation. Contact that company first about rights concerning the Conversation. CoMStudio will assist the company as required by the DPA and law.

Personal data CoMStudio controls

CoMStudio may collect this controller data:

• name, business email, account identifiers, organization, role, locale, time zone and authentication events;

• Workspace subscription, billing contact, billing-provider customer and transaction identifiers, invoice status, tax status and refunds;

• service usage, device, browser, IP address, request, security, fraud-prevention and diagnostic records;

• communications sent directly to CoMStudio, including sales, support, privacy and security requests; and

• cookie or similar essential session data and aggregate, cookieless website analytics.

We use it to:

• create and administer accounts and perform the Agreement;

• authenticate users, secure DobroDesk, prevent abuse and investigate incidents;

• provide support and service communications;

• administer subscriptions, invoices, taxes, refunds and financial records;

• understand aggregate service performance and improve reliability; and

• comply with legal obligations and establish, exercise or defend legal claims.

When Shopify App Pricing manages billing, Shopify hosts plan approval and bills recurring and usage charges through the merchant's Shopify billing account. DobroDesk receives the subscription state, billing identifiers and usage-event results needed to provide and reconcile the app. Paddle remains the Merchant of Record for self-serve purchases made through DobroDesk checkout.

We rely on contract performance, steps requested before a contract, CoMStudio's legitimate interests in operating and securing its business, legal obligations and consent where law requires it. CoMStudio does not sell personal data or share it for cross-context behavioural advertising.

DobroDesk product analytics and future analytics services

When enabled for DobroDesk, first-party analytics helps CoMStudio understand product use, investigate failed processes and maintain service reliability and security. It records batched actions, page routes, authentication, verification and return states, selected sections, links and buttons, clicks, outcomes and event times. It also records broad platform and browser categories, primary language, approximate country derived from the request, the referring domain or an internal page path and approved campaign and referral values from URL parameters (utm_source, utm_medium, utm_campaign, utm_content, ref and source).

After sign-in has been verified, CoMStudio may associate the account identifier with authentication records, service diagnostics and limited product-use records observed by the server. Each product-use record contains a defined product area or operation, its result and a timestamp. The service uses the same request that carries out an authenticated operation, so analytics does not require an additional operation from the user. The server verifies Account and Workspace access. The browser sends no analytics identifier and does not make a separate analytics request for these records. These records do not include screen views, scrolling or browser-side clicks.

The separate client-side analytics uses no cookies, localStorage, sessionStorage, browser fingerprinting APIs or client hints. For a selected section, link or button, it records a visibility event only when the marked element is at least 50% visible for approximately one second, and it may also record a click. These events do not show that a person read the content or paid attention to it. They do not record opinions, exact viewport geometry or scroll coordinates.

Except for the approved campaign and referral parameters listed above, analytics records exclude URL query values. They also exclude request bodies, full URLs, full referrers, page content, user-supplied IDs and IP addresses. Diagnostic records are limited to codes that do not contain sensitive data, length-limited comments and reference identifiers needed to investigate a failed process.

Daily visitor estimates for public pages

For daily visit estimates, CoMStudio may temporarily read trusted HTTP request headers to determine a broad platform category, browser family and primary language. It combines these standardized values with the request IP address and an unpredictable secret rotated daily to generate a pseudonymous daily visitor token. Browser versions, full user-agent strings and additional client, device or hardware signals are excluded. Raw IP addresses and user-agent strings are not retained in analytics records. An event batch delayed by less than 24 hours may be checked against the current or previous daily secret. Tokens never carry over to another day. A change of network or browser family can affect the estimate, which is not a guaranteed count of unique people. These tokens are pseudonymous, not anonymous. They are never joined to account identifiers or linked across days, products, customer sites or workspaces. Account-linked product-use and diagnostic records remain separate from public visitor estimates.

Detailed event, account-linked product-use and diagnostic records are retained for up to 30 days. Aggregates are retained for up to 365 days. Return visits and departures are inferred from periods of inactivity, allowing a grace period for a visitor to resume activity. These estimates do not show that a person closed the site or intended to leave. CoMStudio relies on legitimate interests for this processing where permitted by law and respects applicable privacy opt-out signals. Requests for access and objections to processing may be sent to support@comstud.io.

Separate analytics service

CoMStudio's separate analytics service remains in development. It is not generally available under this Privacy Policy or Legal Pack. If the service becomes available, CoMStudio will process data on the customer's instructions as processor, with the customer determining the purposes of processing. Such processing will be subject to applicable law. CoMStudio will not sell the customer's analytics data or use it for advertising. It will not use the data to identify a person across different customers' workspaces or for CoMStudio's own independent purposes.

Public-page analytics

CoMStudio uses the standard Ahrefs Web Analytics snippet on public marketing pages, the main-site Help pages and the localized public sign-in page. It does not run on Founders pages, authenticated application or payment pages, the DobroDesk application, the customer widget or tenant-hosted Help pages. Auth API and callback endpoints do not load it. On sign-in, the integration reports only the canonical page location without its URL query or hash.

Ahrefs may process the public page URL, the referrer supplied by the browser, user-agent and device information, language, approximate country and city derived from the visitor's IP address and automatic interactions such as link clicks and form submissions. The integration does not send DobroDesk account identity or custom properties. Ahrefs says in its Web Analytics documentation that its standard setup does not use cookies or persistent identifiers. Ahrefs uses the visitor's IP address to derive approximate country and city and calculate daily unique visitors. Raw IP addresses are discarded and not stored. CoMStudio reviews notice and consent requirements before changing this setup or enabling analytics cookies or advanced conversion tracking.

Recipients and controller-data retention

CoMStudio may share controller data with infrastructure and security providers, Paddle or Shopify where used for billing, professional advisers, authorities where legally required and a protected corporate successor. Account and business-contact data is kept while the relationship is active and afterwards only as needed for support, security, disputes and legal obligations. Transaction, invoice and tax records are kept for the period required by accounting and tax law. Security records are kept only as long as reasonably necessary for the relevant risk and investigation.

Privacy rights

Depending on applicable law, a person may request access, correction, deletion, restriction, portability or objection, withdraw consent or appeal a denied request. A person may also complain to a data-protection authority. Send requests about data CoMStudio controls to support@comstud.io. CoMStudio may verify identity and authority before acting.

People in the European Economic Area may complain to the Estonian Data Protection Inspectorate or their local supervisory authority. California and other US residents may exercise applicable access, correction and deletion rights and may ask CoMStudio to confirm that it does not sell or share their personal information for targeted advertising. CoMStudio will not discriminate against a person for exercising a privacy right.

Children and End User notices

DobroDesk accounts are available to individuals aged 16 or older who may lawfully use the service in their jurisdiction. Minors must meet the consent, supervision and paid-service requirements in the DobroDesk service terms.

Customer decides whether and how its support service may be used by minors and is responsible for any parental notice or consent required for End User data. Customer must give End Users a clear privacy notice that identifies Customer, explains its use of DobroDesk and Connected Services and describes any AI or automated interaction where law requires that disclosure.

The DobroDesk widget uses essential session and security technology to start and resume a support Conversation. Customer must include this processing in its notice and obtain consent where local law requires consent for storage or access on an End User's device.

12. Data Processing Addendum

This DPA applies whenever CoMStudio processes Customer Personal Data as Customer's processor or service provider. It forms part of the Agreement without a separate signature. "Data Protection Law" means privacy and data-protection law that applies to the processing, including the GDPR, UK GDPR and applicable US state privacy law. GDPR terms such as controller, processor, personal data, data subject and processing have their GDPR meanings.

12.1 Instructions and compliance

Customer appoints CoMStudio to process Customer Personal Data to provide, secure, support and maintain DobroDesk, follow settings and actions initiated by Customer and Authorized Users, support Connected Services selected by Customer, comply with the Agreement and follow other documented instructions agreed by the parties. CoMStudio will not use Customer Personal Data for another purpose unless law requires it. Where legally permitted, CoMStudio will notify Customer before that required processing.

Customer must ensure that its instructions and use of DobroDesk comply with Data Protection Law and that it has a lawful basis, required notices and rights to provide Customer Personal Data. CoMStudio will inform Customer if it reasonably believes an instruction violates Data Protection Law and may pause the affected processing while the parties resolve the issue.

12.2 Confidentiality and personnel

CoMStudio will ensure that people authorized to process Customer Personal Data have confidentiality obligations and receive appropriate security and privacy guidance. Their access is limited to what their work requires. CoMStudio personnel may read private Customer content only with Customer's explicit permission or where required by law. Access is limited to the content and purpose covered by that permission or legal requirement.

12.3 Security

Customer can set the access, retention, integration and security controls available in DobroDesk. It is Customer’s responsibility to configure those controls for the way it uses the service and the risks that use presents.

Section 13 summarizes the measures CoMStudio currently uses. CoMStudio will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

12.4 Security incidents

CoMStudio will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data. The notice will include information reasonably available about the incident, affected data, likely consequences and mitigation. The notice is not an admission of fault. Customer is responsible for notices to data subjects or authorities unless law assigns that duty to CoMStudio.

12.5 Data-subject requests and regulatory assistance

If CoMStudio directly receives a request about Customer Personal Data, CoMStudio will notify Customer about the request without undue delay where law permits. It shall not respond substantively to the request on Customer's behalf unless instructed to do so by Customer or required to do so by law. Where practical, CoMStudio will direct the requester to Customer.

Through available product controls and support, CoMStudio shall provide reasonable assistance to Customer in responding to data subjects' requests, taking into account the nature of the processing. Taking into account the nature of the data processing and the information available to CoMStudio, CoMStudio shall also assist Customer in ensuring compliance with Customer's obligations under Articles 32 to 36 of the GDPR and provide reasonable information needed for data-protection impact assessments and prior consultations.

12.6 Audits

For Customer's compliance review, CoMStudio will give it all information necessary to verify CoMStudio's compliance with this DPA and, where applicable, Article 28 of the GDPR. Customer should first review the current security documentation, product information, and independent assurance that CoMStudio makes available.

If that is not sufficient, CoMStudio will allow for and contribute to one reasonable audit in a 12-month period. CoMStudio will also allow for and contribute to an additional audit following a confirmed personal-data breach, another confirmed breach or a regulator request, or where there are indications of non-compliance with this DPA or Data Protection Law. Customer or an auditor appointed by Customer may conduct these audits and inspections to assess CoMStudio's compliance with this DPA. Each audit must take place during normal business hours, avoid unreasonable disruption, and protect other customers, security, and confidentiality. Customer bears its own audit costs unless that audit identifies a material breach of this DPA by CoMStudio. Nothing in this section limits information, audit, or inspection rights required by applicable law or applicable Standard Contractual Clauses.

12.7 Return and deletion

Customer need not wait for the services to end to ask for its data back. After the services end, or whenever Customer requests it, CoMStudio will return Customer Personal Data to Customer or delete them, whichever Customer chooses. If DobroDesk's export features do not return everything, Customer may ask for the return by emailing support@comstud.io. CoMStudio will delete the remaining copies whether Customer asks for return or deletion.

A copy of the data might still be in a routine backup. CoMStudio will protect it and leave it unused for any other purpose until it is deleted or overwritten in the ordinary backup cycle. CoMStudio may bring a copy back only as needed for service recovery. A restored copy is still covered by this DPA.

If applicable law requires CoMStudio to retain particular Customer Personal Data, it may retain only that data for the period required by law, protect it and restrict further processing to that legal purpose.

The DPA remains in effect until the data are deleted. CoMStudio may retain de-identified information that cannot reasonably identify Customer or a data subject.

12.8 Liability and order of precedence

The Agreement's liability limitations apply to this DPA in aggregate with all other claims under the Agreement. This DPA controls if it conflicts with another part of the Agreement on the protection or processing of Customer Personal Data. Applicable Standard Contractual Clauses and the UK Addendum prevail over conflicting terms of this DPA or the Agreement. Nothing in the Agreement limits any data subject right or any party's liability to the extent that it cannot be limited under applicable law, those clauses or the UK Addendum.

12.9 US state privacy requirements

Where a US state privacy law applies to Customer Personal Data, CoMStudio acts as Customer's service provider or contractor. CoMStudio will not sell or share Customer Personal Data, retain, use or disclose it outside the business purposes in the Agreement or combine it with personal data received from another person except as applicable law permits. CoMStudio will notify Customer if it can no longer meet these obligations. Customer may take reasonable and appropriate steps to verify and require remediation of CoMStudio's use of Customer Personal Data, subject to the audit protections in this DPA.

12.10 Other privacy laws

References to GDPR concepts do not limit this DPA to Europe. If the LGPD, PIPEDA or another applicable privacy law imposes equivalent controller, processor, operator or service-provider duties, the parties will apply this DPA consistently with those duties and mandatory local law. CoMStudio will provide reasonable cooperation for a legally required regional addendum.

Processing details

13. Security measures

CoMStudio's current technical and organizational measures for DobroDesk include:

• encrypted network transport and managed encryption for stored service data;

• Workspace and object-level tenant separation with authorization checked at service boundaries;

• role-based access, least-privilege administration and separate controls for sensitive actions;

• protected credential storage and no display of stored provider secrets after initial entry;

• signed webhook verification, replay protection, idempotency and validation of incoming data against defined limits;

• private storage for messages, files, raw email, exports, invoices and audit artifacts;

• logging, audit events, monitoring, abuse controls and incident-response procedures;

• backup, archive-integrity and recovery processes proportionate to the service tier; and

• secure development review, dependency maintenance and production change controls.

Security measures may change as technology and risk change. CoMStudio will not materially reduce the overall protection of Customer Personal Data during a paid subscription without an appropriate replacement measure.

14. Subprocessors and connected services

Customer generally authorizes CoMStudio to use the subprocessors below. CoMStudio will impose written data-protection and security obligations appropriate to their processing and remains responsible for those obligations to the extent required by Data Protection Law.

CoMStudio will give Customer at least 20 days' written notice before adding or replacing a subprocessor that will process Customer Personal Data. The notice will identify the provider, its processing activities and processing locations. Customer may object on reasonable data-protection grounds during that period. The parties will work in good faith on an alternative. If none is available, Customer may stop the affected optional feature or terminate the affected service and receive a refund of prepaid fees for its unused period.

Customer-directed Connected Services

Google and Microsoft identity and mailboxes, Notion, Atlassian Confluence, HubSpot, Shopify, Meta services including WhatsApp, Facebook and Instagram, Telegram, Slack, Discord, Freshdesk, Intercom and Zendesk are Connected Services that Customer chooses and directs. Their providers process data under Customer's account and their own terms. They are not general DobroDesk subprocessors just because Customer enables an integration. Data sent to a Connected Service at Customer's direction is then subject to that provider's privacy and retention practices.

When Customer imports records through a migration source, the imported records become Customer Data in the Workspace and are processed under Customer's instructions and the Legal Pack's retention and deletion rules. The provider's original records remain subject to the provider's own terms and retention practices.

Connected service scope

The catalogue groups Connected Services by the work they support: channels and mailboxes, customer and order context, knowledge sources, bookings, migration sources and developer access. Examples include Stripe, Notion, Confluence, Calendly, Google Calendar and the supported migration tools. Customer may also connect Krynia, another CoMStudio service, as a knowledge source under its applicable terms. For Shopify, the requested permissions are shown in Shopify's authorization flow before authorization. For other connections, the catalogue shows the available connection and its required permission before authorization. Customer chooses each service and directs the exchange of data with it.

For the requested Shopify scopes, order access, permitted actions and safeguards, see DobroDesk and Shopify customer data. The connected Workspace's permissions and customer-matching controls apply. DobroDesk does not create a bulk export or unrestricted history feed. Shopify remains authoritative for its records and its own retention practices apply.

Actions and developer access

Customer context connections may show matched customer, invoice, subscription or order details in a support Conversation. A published Procedure may offer a one-time payment through Stripe Checkout when the required permissions are granted and the visitor confirms the payment. It may check availability through a connected booking service and create a Google Calendar appointment only after the visitor confirms the time. Customer-authorized API tokens and MCP clients are limited to the permissions selected for them. Customer HTTPS endpoints may receive signed conversation, message or action events through webhooks. Available actions are limited by the enabled feature, its documented permissions and any confirmation that feature requires.

Knowledge sources and uploaded files

Customer selects pages or files for import where the connected source supports that choice. Customer reviews imported content, assigns its Workspace scope and activates an approved revision before DobroDesk uses it for a selected support or AI feature. The selected scope and feature permissions determine where that content can be used. For the Notion connector, when Notion reports permission loss or confirmed deletion of the selected source, DobroDesk pauses the affected imported content and removes its approved content from retrieval. A transient Notion connector failure may preserve the approved revision while the connection is repaired. Other connectors may have different lifecycle signals. The Legal Pack's general retention and deletion rules govern records held in the Workspace. Provider originals remain subject to the provider's own terms.

Billing providers

Paddle is the Merchant of Record for Paddle purchases and processes payment and tax data as an independent controller under its own privacy notice. Shopify processes Shopify-billed subscription and usage charges under its own terms and privacy notice. CoMStudio receives transaction identifiers, status and the billing metadata needed to provide the subscription and reconcile charges. Shopify billing usage events contain quantities or amounts and billing references, without customer names, email addresses or phone numbers. CoMStudio does not receive full payment-card numbers or security codes.

15. International transfers

DobroDesk may process data in the European Union, the United States and global network locations needed to deliver and secure the service. Workspace data-region controls apply only where an Order and the Workspace expressly show that they are enabled. Email, Internet delivery and Connected Services may involve processing outside the selected storage region.

Where a transfer of Customer Personal Data from Customer to CoMStudio is a restricted transfer from the European Economic Area to a country without an adequacy decision, the parties enter into the European Commission's 2021 Standard Contractual Clauses. Module Two applies to controller-to-processor transfers and Module Three applies to processor-to-processor transfers. Customer is the data exporter and CoMStudio is the data importer. Acceptance of the Agreement is treated as signature. The optional docking clause applies. Clause 9 uses Option 2 and the 20-day notice period. The optional language in Clause 11 does not apply. Estonian law governs under Clause 17 where a choice is required and the courts of Estonia are selected under Clause 18. The competent supervisory authority is determined under Clause 13.

For a restricted transfer by CoMStudio to a subprocessor, CoMStudio is the data exporter and the recipient subprocessor is the data importer. CoMStudio will ensure the applicable transfer safeguards, including the appropriate Standard Contractual Clauses module where required, reflect those actual roles. The Customer-to-CoMStudio allocation above does not replace safeguards for onward transfers.

For the annexes, the parties and contact details are those in the Agreement and Order. The transfer and processing details are in the Processing details table, the security measures are in the Security measures section and the authorized subprocessors are in the Subprocessors table. Transfers occur continuously or as initiated through Customer's use of DobroDesk during the Agreement term and the limited deletion period afterwards.

For restricted transfers from the United Kingdom, the EU Standard Contractual Clauses are modified by and incorporate the UK International Data Transfer Addendum issued by the UK Information Commissioner's Office. Its tables use the parties, modules, processing details, security measures and subprocessors in this Legal Pack and its mandatory clauses apply. For transfers from Switzerland, references in the clauses are adjusted as required by the Swiss Federal Act on Data Protection. CoMStudio will provide reasonable information about applicable transfer safeguards on request.

16. Supported territories and sanctions

DobroDesk is offered internationally but not to organizations established in Russia or Belarus or to people located there when accessing or administering a Workspace. It is also unavailable where providing the service would violate sanctions, export controls or a binding restriction imposed on CoMStudio or a required provider. Customer must not conceal its location or identity to bypass these restrictions.

This restriction concerns DobroDesk accounts and Authorized User access. It does not by itself require Customer to reject a lawful support message from an End User because that person is travelling or located elsewhere. Customer remains responsible for its own sanctions, trade and communications compliance.

17. Changes and notices

Changes to the Legal Pack

CoMStudio may revise this Legal Pack to reflect the law, security, providers, pricing models or changes in how DobroDesk works. It will publish the current version with the date it takes effect. Previous versions will remain available from the Legal Center.

CoMStudio will announce a material change both by email and in the product. The announcement is due at least 30 days before the change takes effect. CoMStudio may give less notice only if it needs to do so to address the law, an urgent security risk or a provider change beyond CoMStudio’s control.

Section 14 sets its own notice period when CoMStudio intends to add or replace a subprocessor. Even if the announcement under this section has to be made on shorter notice, Customer is still entitled to the 20 days’ prior notice required under section 14.

Customer may object in its own words to a material change that substantially reduces its contractual rights. If it does, Customer may stop using and terminate the affected paid service before the change takes effect. Customer may then request a prorated refund of the fees it prepaid for the unused period. Where the law permits, continued use after the effective date constitutes acceptance. Section 18 lists support@comstud.io for legal notices to CoMStudio.

18. Contact, governing law and general terms

Notices to the parties

Legal, service and privacy notices to CoMStudio may be sent to support@comstud.io. CoMStudio may give notice to Customer through DobroDesk or at the Workspace Owner's current email address. Customer is responsible for keeping the latter address up to date.

Governing law and venue of jurisdiction

Estonian law governs this Agreement without regard to conflict of laws principles. The parties will first attempt in good faith to resolve a dispute through written notice. Except where applicable law requires another forum, the exclusive competence to decide on any controversy resulting from or connected to this Agreement lies with the courts of Harju County, Estonia.

Relationship of the parties

CoMStudio and Customer are independent contractors. Neither is liable for a delay caused by events beyond its reasonable control. Customer's payment obligations are excluded from this provision on delay.

Assignment of contract

An assignment by Customer requires the written consent of CoMStudio. CoMStudio may assign the Agreement (i) to an affiliate or (ii) in connection with a merger, reorganization or sale of substantially all relevant assets. The successor must assume the Agreement in either case.

Severability

Should any provision of the Agreement be deemed or become invalid or unenforceable under applicable law, the invalidity or unenforceability of such provision shall not affect the validity of the remaining provisions, which shall remain in full force and effect. An unenforceable provision will be limited to the minimum extent necessary.

No Waiver

A party's failure to assert any right or provision under the Agreement shall not constitute a waiver of any such right or provision.

The text of sections 8 and 9 is adapted from SDU eScience Terms of Service v1.4 and its acceptable use provisions, themselves adapted from Google Cloud Platform terms, under CC BY 4.0, with changes by CoMStudio.

The text of section 12.5 is adapted from the Common Paper DPA v1.1 and section 12.6 from the Common Paper DPA under CC BY 4.0, with changes by CoMStudio.

Sources and licence: SDU eScience Terms v1.4 and CC BY 4.0.