Baseline text pending counsel review
Data processing agreement
Last updated 14 September 2026 · version 2026-09-14
This agreement (“DPA”) forms part of the terms of service between the business using CrownVouch (“Controller”) and the operator (“Processor”). It applies whenever the Processor handles personal data of the Controller's customers. An owner accepts it for the business from Settings → Privacy and data; the version and time are recorded.
1. Parties and definitions
- Operator
- Operator legal name not configured
- Contact
- [email protected]
- Postal address
- Operator postal address not configured
“Data protection law” means the United States federal and state privacy and breach-notification laws that apply to the processing under this DPA, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). “Personal data”, “processing”, “data subject”, “controller”, “processor” and “personal data breach” have the meanings given in those laws. The Controller warrants it is the controller of the customer data it provides, or is authorised by the controller to instruct the Processor.
2. Subject matter, duration and nature (Annex 1)
| Item | Description |
|---|---|
| Subject matter | Sending review-request and reminder email to the Controller's customers after completed transactions, hosting the feedback pages, and recording feedback and follow-up issues in the CrownVouch application. |
| Duration | The term of the terms of service plus the 30-day wind-down and 30-day deletion grace period, or until earlier deletion on the Controller's instruction. |
| Nature and purpose | Storage, transmission by email, display to the Controller's team, creation of follow-up tasks, anonymisation and deletion. |
| Categories of data subjects | Customers of the Controller who completed a transaction; the Controller's own staff who use the application. |
| Categories of personal data | Name, email address, transaction reference and completion time, email delivery state, rating and free-text feedback, optional contact details a customer adds, hashed IP and browser identifiers on feedback pages. |
| Special categories | None intended. The Controller must not instruct processing of special-category data and the feedback form asks for none. |
3. Processor obligations
- Process personal data only on the Controller's documented instructions, which are the terms of service, this DPA, the settings and actions the Controller chooses in the application, and the API calls and webhook events it sends; and tell the Controller if an instruction appears to infringe data protection law.
- Ensure that people authorised to process the data are bound by confidentiality.
- Implement the technical and organisational measures in Annex 2 and keep them under review.
- Engage subprocessors only under section 5.
- Assist the Controller with data-subject requests (section 6), security, breach notification, and data protection impact assessments, taking into account the nature of the processing and the information available.
- Delete or return the personal data at the end of the service (section 8).
- Make available the information needed to demonstrate compliance and allow audits (section 9).
- Not sell the personal data, not share it for cross-context behavioural advertising, not retain, use or disclose it outside the direct business relationship with the Controller or for any purpose other than the services, and not combine it with data from other sources, except as permitted by the CCPA for service providers. The Processor will notify the Controller if it can no longer meet these obligations.
4. Controller obligations
- Provide personal data only where it has a lawful basis to do so and, where local law requires it, the consent of the customer to receive review-request email.
- Give accurate sender details (business name, reply-to address, postal address) for the email footer.
- Use the application's tools to honour customer rights, and respond to customers who contact it directly.
- Keep its own account credentials, API keys and webhook secrets confidential and remove team members who leave.
5. Subprocessors (Annex 3)
The Controller gives general authorisation to the subprocessors listed at /subprocessors and reproduced below. The Processor will give account owners at least 14 days' notice by email before adding or replacing a subprocessor; the Controller may object on reasonable data-protection grounds, and if the objection cannot be resolved the Controller may end the service without penalty for the remaining period. The Processor remains responsible for its subprocessors and imposes data protection obligations on them that are no less protective than this DPA.
| Subprocessor | Purpose and data |
|---|---|
| PostgreSQL database and application hosting — Region chosen by the operator at deployment (single region; see /subprocessors for the current value) | Operator-managed infrastructure. All application data described in the privacy notice |
| Resend, Inc. — United States | Transactional email delivery. Recipient address, sender identity, subject, message body and delivery events for review requests, reminders, sign-in and notification email |
| Polar Software Inc. — United States | Billing, subscriptions and payments (merchant of record). Business billing contact, subscription status and payment method on Polar's hosted pages; card details never reach CrownVouch |
| Twilio Inc. — United States | Text-message delivery for businesses that add the SMS add-on. Recipient mobile number, message body and delivery status for review requests and reminders; inbound STOP/HELP replies |
| Postmark (ActiveCampaign, LLC) — United States | Inbound email processing for forwarded invoices. Forwarded invoice emails: sender, subject, message id and the customer address they contain |
| Google LLC — United States / global | Optional sign-in (OAuth) and Business Profile reviews sync when a business connects its profile. Google account identifier, email address and verification state on sign-in; for a connected Business Profile, the business's own public reviews and an offline access token |
6. Data subject requests
The application lets an owner look up, export and erase an individual customer's data (Settings → Privacy and data) and export all business data. Erasure anonymises the customer and their written feedback and keeps only a suppression hash so the customer is not contacted again. If a data subject contacts the Processor directly, the Processor will not respond on the merits except to refer them to the Controller, and will pass the request to the Controller within five business days.
7. Personal data breach
The Processor will notify the Controller without undue delay and in any case within 48 hours after confirming a personal data breach affecting the Controller's data, by email to the account owners, with the information available at the time (nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken or proposed), and will update it as more is known. The Processor keeps a record of breaches and its response.
8. Deletion and return
The Controller may export its data at any time. When the service ends, the Controller keeps read and export access for 30 days; after a further 30 days the business and all its personal data are deleted, except suppression hashes required to honour opt-outs and records the Processor must keep by law. Backups, where the operator maintains them, expire under their own rotation schedule and are never restored to reinstate deleted data.
9. Audit and information
On request no more than once a year (or after a breach), the Processor will provide the information reasonably needed to demonstrate compliance with this DPA, including the current security description and subprocessor list, and will allow an audit by the Controller or an independent auditor bound by confidentiality, at the Controller's cost, on 30 days' notice, during business hours, without disrupting other customers.
10. Technical and organisational measures (Annex 2)
| Area | Measure |
|---|---|
| Tenant isolation | PostgreSQL row-level security on every tenant table, compound tenant foreign keys, triggers that block tenant reassignment, and automated cross-tenant tests. |
| Encryption | TLS in transit; secrets, feedback tokens and webhook diagnostics encrypted at rest with versioned AES-256-GCM keys; passwords hashed with scrypt; session, API-key and unsubscribe tokens stored only as hashes. |
| Access control | Owner and manager roles enforced server-side; operator access limited to an allowlist and audited; no shared service credentials in browser code. |
| Authentication | Verified email before tenant access, single-use 30-minute sign-in links, optional Google sign-in with PKCE, rate-limited sign-in and reset, sessions revocable per device. |
| Integrity of inbound data | Every webhook is verified over raw bytes with timestamped HMAC signatures; duplicate events are idempotent; malformed and oversized bodies are rejected. |
| Minimisation and retention | Only the fields listed in the privacy notice are stored; the retention schedule is enforced daily by the worker; erased customers are anonymised rather than kept. |
| Logging | Structured logs redact customer email addresses and tokens; audit log for member, integration, export, deletion and billing changes; no session replay on customer pages. |
| Browser hardening | Content-Security-Policy, HSTS, frame denial, nosniff, referrer policy; customer pages are no-store, noindex and no-referrer; only strictly necessary cookies. |
| Availability | Durable job queue with retries and dead-letter review; idempotent sends; operator alerts for failed events; database backups are the operator's deployment responsibility (see runbook). |
| Incident response | Documented breach procedure with customer notification without undue delay and within 48 hours of confirming a personal-data breach affecting their data (doc 11 §7). |
11. Liability and precedence
Each party's liability under this DPA is subject to the limits in the terms of service, except where data protection law does not allow it. If this DPA conflicts with the terms of service, this DPA prevails for the processing of personal data. This DPA is governed by the same law as the terms of service.