This Data Processing Agreement ("DPA") is part of the Terms of Service between TradeProof ("we") and the customer ("you"). It applies when we process personal information on your behalf while providing the Service. To keep a signed copy, print this page (Save as PDF).
1. Roles
You decide what information about your company, team and subcontractors goes into TradeProof and why (you are the controller, or "business"). We process it only to provide the Service to you (we are the processor, or "service provider").
2. What we process
- Your team: names, email addresses, login and activity records.
- Your subcontractors: business and contact names, email addresses, phone numbers, certificates of insurance and W-9 forms (including taxpayer identification numbers).
- Your subcontractors' insurance agents, when you or they add them.
3. Our commitments
- We process the information only on your instructions, as set by how you use the Service.
- We do not sell it or use it for advertising.
- People with access are bound by confidentiality.
- We apply the security measures described on our Security page, including encryption, private storage, access controls and two-step verification.
- We help you answer requests from people exercising their privacy rights; most can be handled directly in the app (edit, export, delete).
- We notify you without undue delay after becoming aware of a breach affecting your data.
4. Subprocessors
We use these providers to run the Service. We will update this list before adding new ones.
- Lovable Cloud (built on Supabase) — Hosting, database, file storage, logins
- AI model provider (through Lovable Cloud's AI gateway) — Reading uploaded certificates and W-9s
- Resend — Sending emails (requests, reminders, notices)
- Paddle — Payments, invoices and sales tax (Merchant of Record)
5. International transfers
Our providers may process information in the United States and other countries. Where the law requires it, transfers rely on appropriate safeguards such as standard contractual clauses.
6. Deletion and return
You can export all your data at any time. When you delete your account, all your data is permanently deleted after a 30-day grace period, except records the law requires us or Paddle to keep (for example billing records).
7. Audits
We answer reasonable security questions in writing — see the pre-filled questionnaire in our procurement kit — and provide further information on request at support@usetradeproof.com.