Data Processing Addendum
This addendum (“DPA”) is part of the Terms of Service between the business that runs a workspace (“you”, the controller) and Programmable, LLC (“we”, the processor). It applies to personal data we process for you in providing the Service (“Customer Personal Data”). If it conflicts with the Terms, this DPA wins for that data.
1. Details of the processing
- Subject matter and purpose: making pages from your requests and templates; sending them to your customers by email or text; collecting replies, bookings, acceptances and files through them; recording payments, refunds and recurring payments made through your Stripe account; reminders, follow-ups and alerts; customer records; exports, webhooks and the services you connect.
- Duration: while you use the Service, then until deletion under section 9.
- Data subjects: your customers and anyone who opens or uses your pages; people you name in requests; your contacts and team.
- Categories of data: names, email addresses, phone numbers, postal addresses, what you put on pages, what people send through them (messages, form answers, booking times, typed names as signatures), payment records (amount, description, status, email; never card details), records of what was sent to whom and when, and agreement to texts and opt-outs. You agree not to collect special categories of data unless the law allows it, nor government identifiers, payment card details or passwords, through the Service.
2. Your instructions
We process Customer Personal Data only on your documented instructions: the Terms, this DPA, and what you set up and do in the Service. That includes sending data to the services you connect (your Stripe account, your storage, your webhooks), which you instruct by connecting them. We will tell you if we think an instruction breaks data protection law, unless the law forbids us to. If the law requires us to process data otherwise, we will tell you first unless it forbids that.
3. Confidentiality
Everyone we allow to process Customer Personal Data is bound by confidentiality, and has access only as far as their work needs. Support access to a workspace is read-only, single-use and lasts at most an hour.
4. Security
We keep appropriate technical and organisational measures, including:
- encryption in transit (TLS) on every connection, and encryption at rest for keys to connected services; access keys stored only as hashes;
- pages rendered in a sandbox on a separate site, without cookies, storage or network access beyond the libraries they load, so a page can't send what a visitor types anywhere except back to you;
- separation between workspaces in every query, with roles inside a workspace;
- rate limits and abuse checks on public pages, forms and keys; signed webhooks; jobs such as PDFs run in isolated containers that can reach only an allowlist of content networks;
- daily backups, encrypted before they leave our servers, kept for 30 days;
- production access limited to the people who run the Service; software kept up to date, and changes reviewed and tested before release.
We may improve these measures over time, but won't reduce the overall protection.
5. Subprocessors
You authorise us to use the subprocessors below. Each is bound by written terms that protect the data at least as well as this DPA, and we remain responsible for them. We will tell workspace owners by email at least 30 days before adding or replacing one. You may object on reasonable data protection grounds within that time; if we can't resolve it, you may close the affected workspace.
| Subprocessor | What it does | Where |
|---|---|---|
| OVHcloud US | Hosting: the servers and database that run the Service, and the isolated machine that makes PDFs | United States (Virginia) |
| Cloudflare, Inc. | Network: delivering and protecting web pages, and receiving requests sent by email | Global network; United States |
| Backblaze, Inc. | Off-site database backups, encrypted before they leave our servers | United States |
| Anthropic, PBC | AI: writing and changing pages from requests, reading the details out of a request, and safety checks on new pages | United States |
| Resend (Plus Five Five, Inc.) | Sending email: sign-in codes, pages sent to customers, receipts, reminders and alerts | United States |
| Twilio Inc. | Texts and calls: receiving requests, replying, and sending pages, reminders and alerts | United States |
Stripe is not our subprocessor for your customers' payments: they are made in your own Stripe account, under your agreement with Stripe. (Stripe bills you for Pro, for which we are the controller.) The services you connect yourself (your storage, your webhooks) are yours, under your own agreements with them. Notifications a workspace member turns on for a phone or browser travel through that device's push service (Apple, Google, Mozilla or Microsoft) encrypted so that only the device can read them.
6. Helping you
- Requests from people: the Service lets you find, export and delete a person's replies, customer record and pages, and honours STOP for texts automatically. If a person writes to us about your workspace, we pass it to you without undue delay and don't answer it ourselves, unless you ask us to.
- Assessments and consultations: we give you the information you reasonably need for data protection impact assessments and consultations with authorities about the Service.
7. Personal data breaches
We will tell you without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting Customer Personal Data, with what we know (what happened, the data and people likely affected, the likely consequences, and what we are doing), and keep you updated. We will help you meet your own duties to notify authorities and people.
8. Transfers
Our servers, database and backups are in the United States, and our subprocessors are listed in section 5. Where you are established in the EU, the EEA, the UK or Switzerland, transfers to us are made under the standard contractual clauses (module two, controller to processor, with the UK addendum where it applies), which we will sign on request and which then form part of this DPA.
9. Deleting or returning data
You can export and delete Customer Personal Data at any time. Closing a workspace deletes its data at once, and it leaves our backups within the following 31 days, unless the law requires us to keep it. Some records are deleted sooner, as the Privacy Policy describes (for example records of pages sent after 90 days, and webhook deliveries after 7 days).
10. Showing we comply
We give you the information reasonably needed to show we meet this DPA, and answer your reasonable written questions about it. If that isn't enough, or an authority requires it, you may have us audited, at most once a year (unless after a breach), with 30 days' notice, during working hours, by an auditor bound by confidentiality, at your cost.
11. US state privacy laws
Where the California Consumer Privacy Act or a similar US state law applies, we act as your service provider (or processor). We will not sell or share Customer Personal Data, nor retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the Service; nor combine it with personal data from elsewhere, except as those laws allow. We will tell you if we can no longer meet these obligations, and you may take reasonable steps to stop unauthorised use.
12. Liability and order
Each side's liability under this DPA is subject to the limits in the Terms, except where the standard contractual clauses or the law don't allow it. If this DPA and signed clauses conflict, the clauses win. This DPA is governed by the same law as the Terms, except where section 8 says otherwise. Questions: [email protected].