Data processing agreement

1. What this agreement covers

This agreement is part of our terms of service. It is between SMPL and the business that subscribes to SMPL ("you"), and it covers the personal information you put into SMPL about other people: your customers and leads (homeowners and clients), the people who chat with Jackie on your website, and your team members.

If anything in this agreement conflicts with the terms of service about that information, this agreement wins.

2. Who is responsible for what

You control the information. You decide what goes into your CRM, why, and how long it stays. You are responsible for having the right to collect it and for getting any consent your customers need.

SMPL processes the information for you. We store and use it only to provide, secure and support the service, and only as this agreement, the terms of service and your instructions allow. We never sell it, and we never use it for our own marketing or to train AI models.

3. Your instructions

Your instructions are how you set up and use SMPL: the settings you choose, the automations you turn on, and any written requests you send us. If we think an instruction breaks the law, we will tell you and may decline to follow it.

We may also handle the information where the law requires it. If that happens, we will tell you first unless the law forbids it.

4. Confidentiality

Only SMPL staff and contractors who need access to support you or run the service can see your information, and each of them is bound by a duty of confidentiality. We look at your account only to provide support you ask for, to keep the service working and secure, or where the law requires it.

5. How we keep it secure

• Information is encrypted in transit and at rest.
• Each company’s data is kept separate from every other company’s, and database rules check which company every request belongs to.
• Staff sign in with two-step verification, and access is limited to the people who need it.
• Databases are backed up daily, and we watch the service for errors and unusual activity.
• Payment card numbers are handled by our payment provider and never stored by SMPL.

We review these measures as the service grows and will not make them weaker during your subscription.

6. Service providers we use

You agree that we can use these service providers (sub-processors) to run SMPL. Each one is bound by a written agreement that protects the information at least as well as this one:

• Supabase: database, file storage and sign-in
• Vercel: website and app hosting
• Anthropic: AI for Jackie and other AI features
• Resend: email delivery
• Twilio: text message delivery, when texting is turned on
• Stripe: card payments and billing
• Mapbox: maps

Some features only run when you connect your own account, and then the information goes to that service under its own terms: Google (Calendar, Gmail, maps and Street View), QuickBooks and Facebook Lead Ads.

We will update this page at least 30 days before adding or replacing a service provider. If you have a reasonable objection about data protection, tell us; if we can’t resolve it, you may cancel and we will refund any time you have paid for and not used.

7. Where the information is stored

Your information is stored and processed in Canada and the United States. When it is handled outside your country, we use providers with protections that meet Canadian privacy law (PIPEDA and Alberta PIPA) and US state privacy laws such as the CCPA. Information held in another country may be accessible to authorities there under local law.

8. If there is a data breach

If we learn that your information has been lost, stolen or accessed without permission, we will tell you without undue delay, and within 72 hours of confirming it. We will explain what happened, what information was involved and what we are doing about it, and help you notify your customers and the authorities where the law requires.

9. Helping with your customers’ requests

If one of your customers asks to see, correct or delete their information, you can usually do it yourself in SMPL. Where you can’t, we will help. If a request comes to us directly, we will pass it to you rather than answer it ourselves, unless the law requires otherwise.

We will also give you reasonable help with privacy assessments and questions from regulators about the service.

10. When the subscription ends

When you cancel, we will give you an export of your information on request. We then delete it from the live service within 90 days, unless the law requires us to keep it. Backups are deleted on their normal schedule, and until then they stay protected by this agreement.

11. Checking that we comply

We will answer reasonable written questions about how we protect your information and share summaries of our security practices and our service providers’ certifications. If a regulator requires it, or after a breach that affects you, you may arrange a reasonable audit with at least 30 days’ notice, during business hours, at your cost, and under a confidentiality agreement.

12. Liability

Each side’s responsibility under this agreement is subject to the limits in the Liability section of our terms of service.

13. Changes and contact

We may update this agreement to reflect changes in the law or the service, and we will give at least 30 days’ notice of important changes. It is governed by the same law as our terms of service.

Questions or requests: josh@smplcontracting.com.