Data Processing Addendum

An integral part of the Terms of Service. Updated: October 15, 2026

This document describes how AnyCodeStudio processes customer data in the AnyTelematics service. It supplements the Terms of Service and applies to every customer without separate signature. Business customers who need a signed copy can request one at the address below.

1. Roles of the parties

The customer is the controller — under CCPA/CPRA, the business. AnyCodeStudio (sole proprietorship AnyCodeStudio, Republic of Kazakhstan) is the processor — under CCPA/CPRA, the service provider. The customer is responsible for the lawfulness of the collection and for the required notices and consents; we are responsible for processing in line with this document.

2. What is processed

• Categories of data: names and email addresses of the customer's users; IMEI, model and asset name of the devices; coordinates, speed, sensor readings and the routes, stops and mileage derived from them; subscription status and transaction identifiers; server request logs.
• Categories of data subjects: the customer's staff who use the service; drivers and operators of equipment fitted with the customer's devices.
• Purpose: providing the functionality of the service — live map, route history, geofences, reports, notifications, billing and support.
• Duration: for the term of the subscription and until the data is deleted under clause 9.

3. Customer instructions

We process customer data only on the customer's documented instructions, which are this document, the Terms of Service and the customer's own actions in the service. We do not use customer data for our own purposes: we do not sell it, do not disclose it for advertising, do not train models on it, do not use it to enrich other datasets and do not combine it with other customers' data, except as expressly permitted by law for a service provider. If in our assessment an instruction conflicts with applicable law, we will say so and may suspend carrying it out.

4. Confidentiality and staff access

Access to customer data is limited to those who need it to provide the service and support, under confidentiality obligations. Access follows the principle of least privilege and ends when the task that required it ends.

5. Security measures

• encryption in transit (TLS) for the web interface, the mobile app and API calls;
• encryption at rest provided by the cloud platform;
• tenant separation at the application level: every query is scoped to the company of the current user;
• password authentication with hashing, or Google sign-in, plus roles and permissions inside the customer's company;
• rate limiting on the sign-in and account recovery endpoints;
• a device allowlist: data is accepted only from trackers registered in the service;
• database backups provided by the cloud platform;
• logging of requests and of actions that modify data.

6. Sub-processors

We engage the following sub-processors:

Each sub-processor is bound by data protection obligations no less protective than those set out here. We notify customers of any replacement or addition at least thirty days before processing begins, by email and by updating this page. A customer who objects to a new sub-processor may terminate before that period expires.

7. Data subject requests

We forward requests from employees and other individuals to the customer and do not answer them ourselves: we have no authority over customer data. At the customer's request we assist within a reasonable time — providing an export, correcting or deleting data. Company-wide export and deletion are also available to the customer directly in the service.

8. Security incidents

We notify the customer of any incident affecting their data without undue delay and no later than seventy-two hours after we become aware of it. The notice describes the nature of the incident, the categories of data affected, the likely consequences and the measures taken. Notifying data subjects and regulators, where required, is the customer's responsibility; we provide the information needed for it.

9. Deletion and return of data

The customer may delete their data at any time under Account → Delete company. Deletion is irreversible and covers users, devices, coordinate history, assets and financial records; an active subscription is canceled. Where the agreement ends for another reason, the data is deleted within thirty days unless the customer asks for earlier deletion or requests an export. Copies held in backups are destroyed on a rotation cycle of no more than thirty-five days.

10. Audits and evidence of compliance

On the customer's written request, no more than once a year, we provide information about our security measures, complete an information security questionnaire and pass on the cloud platform's available certification documents. This does not include direct access to the infrastructure or to other customers' data.

11. CCPA/CPRA specific terms

With respect to the personal information of California residents, AnyCodeStudio acts as a service provider and hereby certifies that it:

• does not sell personal information and does not share it for cross-context behavioral advertising;
• does not retain, use or disclose personal information for any purpose other than performing the services for the customer, including for any commercial purpose outside the agreement with the customer;
• does not combine the personal information received from the customer with personal information from other sources, except as expressly permitted for a service provider;
• complies with the obligations applicable to a service provider and requires the same of its sub-processors;
• will notify the customer if it determines that it can no longer meet these obligations.

The customer may take reasonable steps to verify that the data is used in accordance with these terms and, on discovering unauthorized use, may require us to stop it and to remediate.

12. Processing location and international transfers

The service runs on Google Cloud Platform; data is processed and stored in data centres in the Asia East (Taiwan) region. The processing entity is located in the Republic of Kazakhstan, and access for support and administration takes place from there. By using the service the customer instructs us to process data in this way; at registration the user separately confirms consent to cross-border transfer. We state the current region on request and update it here if it changes.

13. Term and changes

This document applies for as long as the customer uses the service, and thereafter as to the deletion obligations. We may update it as the service develops; we give at least thirty days' notice of material changes by email. Where this document and the Terms of Service conflict on data processing, this document prevails.

Questions and requests for a signed copy: hello@anycodestudio.com