Data Processing Addendum
Last updated 20 June 2026
This document is a practical first draft and REQUIRES LEGAL REVIEW. Replace every bracketed placeholder and confirm the content with a qualified adviser before relying on it.
This Data Processing Addendum ("DPA") describes how [Registered business name] processes personal information on your behalf when you use ServiceFollow. It supplements our Terms of Service. For customers subject to the GDPR or similar regimes, this DPA records the parties' respective roles.
1. Roles
For lead and customer data you submit, you are the data controller (or APP entity) and we act as your processor, processing that data only on your documented instructions to provide the service.
2. Scope and purpose of processing
- Subject matter: provision of the lead-response and follow-up service.
- Duration: for the term of your subscription plus any retention period.
- Categories of data: contact details and enquiry content of your leads and customers.
- Data subjects: your prospective and existing customers, and your staff users.
3. Sub-processors
You authorise us to engage the following sub-processors:
- Supabase — Authentication and primary database hosting (Your configured Supabase region).
- Stripe — Payment, billing and subscription processing (Global (Australia supported)).
- Anthropic (Claude) — AI generation of draft replies and itineraries (United States).
- Resend — Transactional and follow-up email delivery (United States).
- Vercel — Application hosting, edge delivery and analytics (Global edge network).
We will give reasonable notice of new sub-processors and remain responsible for their performance.
4. Security
We implement appropriate technical and organisational measures including encryption in transit, access controls, and tenant isolation via row-level security. See our Security Policy.
5. International transfers
Some sub-processors are located outside Australia (including the United States). We take reasonable steps to ensure an appropriate level of protection for any cross-border disclosure.
6. Assistance and breach notification
We will provide reasonable assistance with data-subject requests and will notify you without undue delay after becoming aware of a personal data breach affecting your data.
7. Return and deletion
On termination, we will delete or return your personal data within a reasonable period, except where retention is required by law. [REQUIRES LEGAL REVIEW: align with your retention schedule.]