Data Processing Agreement

If you read nothing else: we only ever touch your customers' data to run PaidLane for you. We never use it for our own purposes, never sell it, and never market to your customers. We use five named suppliers to run the service and we tell you before that list changes. If we are ever breached we tell you within 48 hours so you can tell whoever you need to. When you leave, we delete it.

Subject matter and purpose.We process your customers' personal information solely to provide PaidLane to you: storing your records, producing quotes and invoices, delivering them to the people you send them to, sending payment reminders you have configured, and keeping the service secure and available.

Duration. For as long as your account exists, and then as set out in §8.

Types of personal information: names, email addresses, telephone numbers and postal addresses of your customers; the contents of the quotes, invoices, jobs, payments and notes you create about them; the name typed and the IP address recorded when one of them accepts or declines a quote; and any reason they give for declining.

Categories of data subject: your customers, and any individual whose details you enter into the service.

No special category data. PaidLane is not designed for and must not be used to record health information, biometrics, or any other special personal information under POPIA section 26 or GDPR article 9.

We process your customers' personal information only on your documented instructions. Your use of the product is that instruction — every quote you send, every reminder schedule you set — together with anything you ask us in writing. We do not process it for any purpose of our own.

Where we count how the product is used to decide what to build next, we do so on youraccount data as controller, and on aggregate counts — never on your customers' records. That is described in §4 of the Privacy Policy.

If the law requires us to process it otherwise, we will tell you before doing so unless that law forbids us from telling you. If we think one of your instructions breaches data protection law, we will tell you.

Everyone with access is bound by a duty of confidentiality that survives the end of their engagement.

You give us general authorisation to engage the sub-processors below. Each is bound by a written agreement imposing data protection obligations no less protective than these.

• Supabase, Inc. — database, authentication and file storage. United States (AWS us-east-1, Northern Virginia).
• Vercel, Inc. — application hosting and delivery. United States, with static assets served from a global edge network.
• Resend (Plus Five Five, Inc.) — delivery of the emails you send: quotes, invoices, reminders. United States.
• Functional Software, Inc. (Sentry)— server error reports. United States. Configured to strip request headers, cookies, request bodies and IP addresses, so error reports do not carry your customers' details.

Lemon Squeezy is not a sub-processor.They take your subscription payment as Merchant of Record and are an independent controller of the payment data you give them. They never receive your customers' data.

We will give you at least 30 days' notice by emailbefore adding or replacing a sub-processor. If you reasonably object on data protection grounds within that period, tell us and we will either find another way or, if we cannot, you may terminate and we will refund the unused part of what you have paid. We remain liable to you for our sub-processors' acts and omissions as if they were our own.

We implement appropriate technical and organisational measures under GDPR article 32 and POPIA section 19. The concrete ones, rather than the usual adjectives:

• Tenant isolation enforced in the database. Every table carries row-level security keyed to the signed-in account, deny-by-default, so one business cannot read another's records even if the application has a bug.
• Encryption in transit (TLS) and at rest.
• Authentication by magic link or Google, with no passwords for us to lose.
• Access to production data restricted to the people who operate the service, over accounts protected by multi-factor authentication.
• Error reports stripped of headers, cookies, bodies and IP addresses before they leave the server.
• Automated backups, held on a rolling cycle and fully replaced within 30 days.

One deliberate exception you should know about as controller: a business logo uploaded to PaidLane is served from a public, unguessable web address, because it has to render in PDFs and emails your customers open without an account.

If one of your customers asks you for a copy of their data, or asks you to correct or delete it, that is your request to answer — you are their controller. The product is built so that you usually can: every record is visible and editable in the app, and the CSV export on the More screen produces a copy in a portable format at any time, including after a subscription has lapsed.

Where you cannot do it yourself, write to hello@paidlane.app and we will help, at no charge, taking into account the nature of the processing and the information available to us.

If one of your customers contacts us directly, we will not answer on your behalf. We will tell them to contact you and pass the request on to you promptly.

If we become aware of a personal data breach affecting your customers' data, we will notify you without undue delay and in any event within 48 hours of becoming aware of it, by email to the address on your account.

The notification will describe what happened, the categories and approximate number of records affected, the likely consequences, and what we are doing about it — enough for you to make your own notification to a regulator, which under the GDPR you have 72 hours to do. Where we do not have all of it at once, we will send what we have and follow up rather than wait.

We will also give you reasonable help with any data protection impact assessment or prior consultation under GDPR articles 35 and 36.

Our sub-processors are in the United States, and we operate from South Africa. Where your customers' data is transferred out of the EEA or the UK, it is made under the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

Those clauses are incorporated into this agreement. Where you are established in the EEA or the UK and we receive your customers' data, Module Two (controller to processor) applies between you and us, with you as data exporter and us as data importer; where you are outside it, Module Three (processor to processor) applies as appropriate. The details required by their annexes are the ones set out in §2, §4 and §5 of this document, the governing law and forum are those in our Terms, and the optional docking clause applies.

Where POPIA applies, transfers are made under section 72(1)(a): each recipient is bound by a written agreement upholding principles substantially similar to POPIA's conditions for lawful processing and restricting onward transfer on the same terms.

When your account ends, you can export everything as spreadsheets for as long as the account exists — that is a permanent commitment in §6 of the Terms and it applies whether or not you are still paying.

When you ask us to delete the account, we delete your customers' personal information from the live service within 30 days, and it leaves our backups within a further 30 days as those are replaced. We keep nothing except our own records of what you paid us, which South African tax law requires us to hold and which contain no customer data.

On request we will give you the information you reasonably need to show that we are meeting these obligations — including our own suppliers' current security documentation and certifications, which is the practical form an audit takes for a service of this size.

If your own regulator requires more, tell us what and we will work out how to give it to you, at your cost where it is more than routine and always without disrupting other customers or exposing their data.

This agreement is part of the Terms of Service, and the liability provisions in §9 of those Terms apply to it. Where this document and the Terms conflict on the processing of your customers' personal information, this document wins. It does not affect the Privacy Policy, which covers your own account data, where we are the controller rather than your processor.

If we change this agreement we will give you at least 30 days' notice by email, on the same terms as a change to the Terms.