Data Processing Addendum

1. Scope and roles

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Gettled ("Gettled") and the business using Gettled ("Customer"). It applies to personal information about the Customer's clients, contacts and team members that Customer puts into Gettled or that Gettled collects for Customer (for example, through quote approvals and the client portal) ("Customer Personal Information").

Customer is responsible for that information and decides why and how it's used. Gettled processes it only on Customer's behalf, as a service provider (and, where those terms apply, a processor or service provider under the CCPA).

2. Gettled's commitments

Gettled will:

• process Customer Personal Information only to provide the Service, as instructed by Customer through its use of Gettled and these Terms, or as the law requires;
• not sell or share it, not use it for its own purposes (including advertising), and not combine it with other data, except as the CCPA and other laws allow for service providers;
• make sure staff and contractors with access are bound by confidentiality;
• keep appropriate security measures in place (Section 4);
• help Customer respond to requests from individuals to access, correct or delete their information;
• tell Customer without undue delay, and within 72 hours where feasible, after becoming aware of a breach affecting Customer Personal Information, with the information Customer reasonably needs;
• delete Customer Personal Information within 30 days after the account ends or on Customer's request, unless the law requires keeping it, and let Customer export its data before then.

3. Customer's commitments

Customer will have a lawful basis and any consent needed to add personal information to Gettled and have Gettled process it, give individuals the notices the law requires, and only instruct Gettled in ways that comply with the law.

4. Security measures

• Logical separation of each customer's data, with access checked on every request (row-level security).
• Encryption in transit (TLS) and at rest.
• Private storage for photos and files, served through short-lived signed links.
• Role-based access within each account (owner, admin, technician) and limited internal access.
• Rate limits on public forms and links, error monitoring, and regular security reviews.
• Backups and recovery procedures, with backups kept for up to one year.

5. Subprocessors

Customer authorizes Gettled to use the following subprocessors. Gettled has contracts with each that protect personal information at least as well as this DPA, and remains responsible for them. Gettled will give at least 30 days' notice of a new subprocessor (by email or on this page); Customer may object on reasonable grounds and, if we can't resolve it, end its subscription.

• Supabase: Database, file storage and sign-in. Location: Canada (AWS, Montréal); support from the US.
• Vercel: Hosting the Gettled app and website. Location: United States and global edge network.
• Stripe: Card and bank payments, Gettled subscriptions. Location: United States, Canada and other countries.
• Resend: Sending emails (quotes, invoices, reminders, receipts, sign-in). Location: United States.
• PostHog: Product analytics (how the app is used). Location: United States.
• Sentry: Error monitoring. Location: United States.
• Google: Sign in with Google (only if you choose it). Location: United States and other countries.

6. Location and transfers

Customer Personal Information is stored primarily in Canada. Some subprocessors process it in the United States and other countries, as listed above. Gettled will protect it with contractual safeguards wherever it's processed.

7. Audits

On reasonable written request, no more than once a year, Gettled will provide information that shows its compliance with this DPA, such as security documentation or its subprocessors' certifications.

8. General

If this DPA conflicts with the Terms on how personal information is handled, this DPA applies. Liability under this DPA is subject to the limits in the Terms, unless the law says otherwise.