Data Processing Addendum

The terms under which Squarepaste processes your clients’ personal data when you use the Squarepaste app. It forms part of our Terms of Service and applies automatically – there is nothing to sign.

Updated 10.27.26

1. Scope

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Squarepaste (“we” or the “Processor”) and the designer or business that holds an App account (“you” or the “Controller”). It applies when we process personal data on your behalf in the App and that processing is subject to the EU or UK General Data Protection Regulation, the Swiss Federal Act on Data Protection, or a U.S. state privacy law (together, “Data Protection Laws”). If this DPA conflicts with the Terms, this DPA controls.

2. Details of the Processing

Subject matter and purpose: providing the App – private client chat, tasks, file sharing, time tracking, and payment requests on the websites you connect.
Duration: for as long as your account is active, plus the deletion periods below.
Data subjects: your clients and their team members, and your own team members, who use the App.
Personal data: names, email addresses, messages, files, photos, voice notes, task and time records, payment request details, and technical data needed to deliver the chat (such as browser type).
Special categories: none are required. You agree not to use the App to collect special-category data (such as health information) about your clients.

3. Our Obligations

We will:

Process personal data only on your documented instructions, which are your use of the App and the Terms, unless the law requires otherwise, in which case we will tell you first unless the law forbids it.
Ensure that anyone authorized to access personal data is bound by confidentiality.
Maintain the security measures in section 6 of this DPA.
Help you respond to requests from people exercising their privacy rights, taking into account the nature of the processing. Most requests can be handled directly in the App; for anything else, email us.
Help you meet your obligations on security, breach notification, and data protection impact assessments, as reasonably required.
Make available the information needed to show compliance with this DPA, and allow for reasonable audits, which we may satisfy by providing written answers and documentation. On-site audits require 30 days’ notice and are limited to once a year.
Not sell your clients’ personal data, share it for cross-context behavioral advertising, or use it for any purpose other than providing the App.

4. Subprocessors

You authorize us to use the following subprocessors. We impose data protection terms on each that are at least as protective as this DPA, and we remain responsible for their performance.

Cloudflare, Inc. – hosting and running the App and chat widget (global).
Supabase, Inc. – database, file storage, and authentication (United States).
Stripe, Inc. – subscription billing and client payments (United States).
Resend, Inc. – email notifications (United States).

We will announce any new subprocessor on this page at least 14 days before it begins processing your data. You may object by email within that period; if we cannot reasonably address the objection, you may close your account and we will refund any prepaid fees for the unused period.

5. Personal Data Breaches

We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting your data. We will tell you what happened, the data and people likely affected, and the steps we are taking, and we will update you as we learn more.

6. Security Measures

Encryption in transit (HTTPS/TLS) everywhere, and chat messages encrypted at rest with a separate key for each website.
Access controls so each project’s data is visible only to its authorized members.
Least-privilege access for our staff, with access limited to support and maintenance.
Server-side validation of every request and authentication on every API route.
Reputable infrastructure providers with their own certified security programs.

7. International Transfers

Personal data is processed in the United States. Where Data Protection Laws require it, transfers from the EEA, UK, or Switzerland are made under the European Commission’s Standard Contractual Clauses (Module 2, controller to processor), together with the UK Addendum and Swiss amendments as applicable, which are incorporated into this DPA by reference, or under the EU-U.S. Data Privacy Framework where a recipient is certified.

8. Deletion and Return

You can delete your data in the App at any time, and we will send you a copy of it on request. Messages are deleted automatically after 180 days. When you delete your account, its data is kept for 30 days so you can restore it and then permanently deleted, unless the law requires us to keep it.

9. Your Obligations

You are responsible for having a lawful basis to share your clients’ personal data with us and for giving them any notices required by law, for example by mentioning Squarepaste in your own privacy policy.

10. Contact

Questions, objections, or audit requests: email [email protected] or write to Squarepaste, 4015 Travis Dr., Ste 211, Nashville, TN 37211.