Data Processing Addendum

Terms have the meanings given by applicable law, including the CCPA and CPRA and, where applicable, the GDPR and UK GDPR.

The customer is the Controller and business. SmarterPaws is the Processor and service provider, processing personal data only to provide the Service and only on documented instructions. SmarterPaws will flag instructions that appear unlawful.

• No selling or sharing of personal information.
• No retention, use, or disclosure outside performing the Service or as otherwise permitted by the CCPA.
• No use outside the direct business relationship with the customer.
• No combining personal information with other sources except as permitted.

SmarterPaws certifies that it understands and will comply with these restrictions.

• Subject matter: providing the Service.
• Duration: the term of the Agreement plus the retention period.
• Purpose: hosting, processing, and transmitting customer data.
• Data subjects: applicants, adopters, fosters, donors, references, and the customer's staff.
• Personal data: names, emails, phone numbers, addresses, application answers, household and housing information, reference and landlord responses, message content, e-signatures, and donation records.

Customers should not submit special-category data beyond what the Service is designed to handle.

SmarterPaws ensures that personnel authorized to process personal data are bound by confidentiality obligations.

Row-level tenant isolation, encryption in transit, hashed credentials, role-scoped access, server-side authorization, and logging. These measures are reviewed over time.

• Supabase and the hosting provider: database, authentication, storage, and hosting.
• Stripe: billing and donations.
• Twilio: SMS.
• Resend or the then-current email provider: email.
• An AI model provider accessed through the AI gateway: application scoring.

SmarterPaws imposes similar data-protection obligations on sub-processors and remains responsible for their performance. SmarterPaws gives reasonable notice of new sub-processors and offers a good-faith objection process.

SmarterPaws provides reasonable assistance through product features and tools, and refers requests it receives directly to the customer.

SmarterPaws notifies the customer without undue delay, with the information reasonably available at the time and the steps taken to mitigate the incident.

The customer has an export window of [30] days after termination. After that window, SmarterPaws deletes or returns customer data within a reasonable period, except where law requires retention, and backups are purged on the ordinary cycle.

On reasonable request, and no more than once a year unless required by an authority or following a breach, SmarterPaws provides information to demonstrate compliance, subject to confidentiality.

Where GDPR or UK GDPR data is transferred without an adequacy decision, the parties use an appropriate transfer mechanism, such as the applicable Standard Contractual Clauses.

This Addendum is governed by the same law as the Agreement. The Agreement otherwise remains in effect. If any provision is unenforceable, the rest remains in force.