Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms & Conditions between you and Back To The Grind and applies whenever we process personal information on your behalf through the Service.

• You are the Controller (in PIPEDA terms, the organization with control of the personal information, and in Quebec the person carrying on an enterprise who has control of it): you decide whose information is held in your account, why, and how long it is kept. That includes your customers, contacts, suppliers, employees and the visitors who use your kiosk.
• We are your Processor (and a service provider under the CCPA/CPRA): we process that information only to provide the Service to you, on your instructions and as described here.
• You are also our customer for your own account information, which we handle as described in the Privacy Policy.

Where the Terms & Conditions, the Privacy Policy and this DPA conflict on a data-protection matter, this DPA prevails.

• Personal information means information about an identifiable individual, including the categories listed in section 3.
• Processing covers anything done with that information — collecting it, storing it, reading it, using it, sending it, disclosing it or deleting it.
• Sub-processor means a third-party service we use to help deliver the Service (listed in section 7).
• Data subject means the individual the personal information is about — your customer, contact, employee or kiosk visitor.
• Applicable data protection law means the privacy law that governs your use of the Service — for example PIPEDA (Canada), Quebec's private-sector privacy law as amended by Law 25 where you or the individuals concerned are in Quebec, the GDPR (EU/UK), or a state privacy law such as the CCPA/CPRA (California). The Terms & Conditions are governed by the law of Ontario, and this DPA follows the same governing law.

• Customer and contact records: names, company names, email addresses, phone numbers, billing and job-site addresses, communication history, inquiry and job notes, and any contact details you import from files or connected email.
• Transaction and business records: estimates, quotes, work orders, invoices, payments recorded against them, purchase orders, supplier details, and the documents attached to them — which may include the names and details of your customers' personnel.
• Communications content: email bodies, headers and attachments synced from the mailbox you connect; SMS messages; social media messages and comments; and the drafts, summaries and classifications generated from them.
• Workforce information: employee and contractor names, contact details, roles, usernames, permissions, pay rates, hours worked, time-off records, crew assignments, and payroll documentation such as pay stubs, T4s and ROEs — including any tax identifiers (for example a SIN) you choose to record.
• Location information: the device location captured when a team member uses job check-in, associated with the worker and the job.
• Audio, video, screen and transcript content: calls and meetings recorded or uploaded for transcription, working sessions recorded with the session recorder (screen, system sound and microphone), and kiosk visit recordings where you have enabled them — plus the transcripts derived from each.
• Kiosk interaction records: visitor interactions at your kiosk (questions, scans, sales, staff requests, optional first name and contact detail) and, if enabled, recorded requests.
• Images and media: photos and files uploaded to the account or gathered from your own website and connected social accounts, including images that may show identifiable people.
• Safety and incident records: incident reports and inspections, which may include details about individuals involved and about health or injuries.
• Account, login and usage data: your account email, authentication data, connected integration tokens, and product usage events.

We do not ask you to put special categories of data (such as health, biometric or government identifier data) into the Service beyond what a business legitimately needs — typically the tax identifiers in payroll records and the injury details in a safety report. Where you do, you are responsible for having the lawful basis and the additional protections the law requires.

We process personal information in your account only to provide the Service you have subscribed to and as instructed by you — through your use of the features, your settings, and the requests you make to the AI assistants. That includes: storing and organising your records; calculating and generating documents; scheduling work; sending the messages you ask us to send; syncing and scanning the integrations you connect; running the automations you enable; publishing the content you publish; generating AI output you request; backing up your data; and providing support at your request.

We will not:

• sell or rent personal information, or share it for advertising or cross-context behavioural advertising;
• use your content to train AI models, or permit the model providers to do so for our requests;
• use personal information in your account for our own marketing or for any purpose independent of providing the Service to you;
• retain it beyond the periods in section 12, or disclose it except as described here, in the Privacy Policy, or as the law requires.

We may create aggregated or de-identified statistics that cannot reasonably identify any individual or your customers — for example counts of feature usage, error rates and performance metrics — to operate, secure and improve the Service. We will not attempt to re-identify that information.

We will tell you if, in our opinion, an instruction from you breaches applicable data protection law, and we may stop processing that instruction until we have resolved it with you. We process data outside your instructions only where required by law, and where we are permitted to we will tell you first.

• Lawful basis: you have a lawful basis for the personal information you put in the Service and for each purpose you use it for.
• Notices: you have given the individuals the notices your law requires — including your privacy policy on your website and shop page, any workplace privacy notice for employees, and any notice required for monitoring, location tracking or recording.
• Consent for recording and capture: where you enable kiosk visit recording, call or meeting recording, or screen recording, you have informed the people captured and obtained the consent the law requires — including, where applicable, from every participant.
• Kiosk notice: the privacy notice shown on your kiosk is accurate and complete for your jurisdiction, and the kiosk is placed so that visitors can see it.
• Employees: you have the authority to hold the workforce information you record, you have provided it to employees as your law requires, and you do not use the location, time-tracking or recording features where monitoring is restricted.
• Messaging: you hold the consents required for the email, SMS and social messages your business sends, and you honour opt-outs promptly.
• Accuracy and minimisation: you keep the information accurate and limited to what you need — including in the free-text fields, uploaded files, and photos where identifiable people may appear.
• Individuals' rights: you handle requests from your customers and employees, using our tools and asking us for help when you need it (section 10).
• Regulated work: where the output concerns work that requires a licence, seal or permit — professional engineering, electrical, gas, building, accounting, tax — you hold the licence the work requires, and the qualified person reviews, signs and seals it. The platform does not practise a regulated profession for you.
• Payments and card data: you keep payment card details out of the Service entirely — never in a note, document, message or record — and you meet the payment-card industry requirements that apply to the way you accept cards.
• Consent records and messages: you keep the proof of consent anti-spam law requires for the email, text and social messages your business sends, and you honour opt-outs. The Service does not obtain or verify consent for you.
• Records you must keep: employment records Ontario's Employment Standards Act requires for three years after an employee leaves, and payroll records the Canada Revenue Agency expects for six years, are your legal obligation — export them before you delete records, cancel or delete your account.
• Public-facing duties: accessibility (in Ontario, the AODA, including your kiosk and your public pages), consumer-protection law for sales you make to consumers, and your advertising and review claims are yours.
• Your own security: you protect your account, control who you invite, grant only the permissions each person needs, and remove access promptly when people leave. Enable two-factor authentication where available.

• Process personal information only on your documented instructions and as described in this DPA, and comply with applicable data protection law in doing so.
• Keep the information confidential: our personnel and contractors are bound by confidentiality obligations and access it only as needed to provide, secure and support the Service.
• Maintain the technical and organizational security measures described in section 8.
• Engage sub-processors only as described in section 7, and remain responsible to you for their performance of the obligations in this DPA as it applies to the information they handle.
• Assist you, as far as reasonably possible and taking into account the nature of the processing, with your obligations to answer data-subject requests, and with your security, breach-notification and data-protection-impact-assessment duties.
• Notify you of a confirmed personal data breach affecting your data as set out in section 11.
• Delete or return personal information at the end of the relationship, as set out in section 12, and give you the information reasonably needed to demonstrate our compliance with this DPA (section 13).
• Tell you if we believe an instruction breaches applicable data protection law.

We use the following categories of sub-processor. Which ones apply to your account depends on the features and integrations you have enabled:

• Platform and hosting: the Base44 platform (application hosting, database, authentication, and private file storage for uploads and recordings) and the cloud infrastructure providers it runs on.
• Google: the Google APIs you connect (Gmail, Google Calendar, Google Drive, Google Sheets); Google's AI models where an AI feature uses them; and Google's media generation models where image or video generation is used.
• OpenAI: language, vision, speech and image models used by AI features you enable.
• Anthropic: Claude models used by AI features you enable.
• xAI: language and speech models used by AI features you enable.
• Groq: speech synthesis used where a spoken reply is generated with that engine.
• Stripe: subscription billing and the card payments your customers make to you.
• Square: card-present and payment-link payments your customers make to you, and the paired card reader.
• Meta Platforms (Facebook and Instagram): social messaging and publishing through the accounts you connect.
• Twilio: text (SMS) messaging when you connect a messaging number.
• Email delivery: your own connected Gmail account, and the platform's transactional email service used for notifications and invitations.

We will give you at least 30 days' notice before adding a new sub-processor category, or before replacing one with a materially different service, so you have the opportunity to object. If you object on reasonable data-protection grounds and we cannot resolve it, you may stop using the affected feature or cancel your subscription. We impose data-protection obligations on our sub-processors that are consistent with this DPA.

We maintain the following measures to protect the personal information in your account:

• Account isolation: Row-Level Security and ownership-based scoping, so each account can only reach its own records, and per-user roles and permissions inside an account.
• Encryption in transit: all access to the Service and to provider APIs is over TLS.
• Private files: recordings, uploads and documents are held in private storage and served only through short-lived, expiring links rather than public URLs.
• Per-user integration tokens: connected services (email, calendar, social, payments) are authorized per user and scoped to that person; tokens are not shared between accounts.
• Authentication controls: platform-managed authentication, password reset and verification flows, optional two-factor authentication, and separate scoped credentials for team members.
• Access control: least-privilege access for our own personnel and contractors, bound by confidentiality.
• Resilience: automated hourly snapshots retained for approximately 24 hours for point-in-time recovery, plus scheduled backups you can configure and exports you can take at any time.
• Monitoring: error and activity logging used to detect faults, abuse and security issues.

No set of measures is perfect, and we do not guarantee that a breach will never occur. Our liability for a security failure is governed by the limitations in the Terms & Conditions, except where the law does not allow it to be limited.

Our providers process and store data in Canada, the United States and other countries where they operate, and sub-processors may access it from those locations to deliver their service. Where personal information is transferred out of the EU/UK, we rely on the appropriate safeguards those providers put in place, such as the European Commission's standard contractual clauses, and we will provide information about the safeguards available on request. Where PIPEDA applies, you acknowledge that information may be accessible to authorities in the jurisdictions where it is processed.

Requests come to you, because you control the information. We provide the in-app tools to find, export, correct and delete records, and we will assist you with a request if you ask — including helping you locate information across entities, and deleting it. If we receive a request directly from one of your customers or employees, we will refer it to you without undue delay and will tell you what we received, unless the law requires us to respond ourselves (for example, a request about your own account information, which we will handle as your service provider to you).

If a person asks us for the explanation and human review that Quebec's Law 25 gives them where a decision about them was made solely by automated processing, we will refer the request to you and help you answer it — including identifying what the account's automation decided. The decision, and the duty to explain it and to have it reviewed, are yours as the controller.

If we become aware of a confirmed personal data breach affecting personal information we process for you, we will notify you without undue delay and no later than 72 hours after we become aware of it. Our notice will describe, to the extent then known: what happened, when it happened, the categories and approximate volume of information and individuals affected, the likely consequences, the measures we have taken or propose to take to address it and mitigate harm, and what you can do. We will keep you informed as our investigation develops, and we will cooperate with you and with any regulator as reasonably required so that you can meet your own notification duties — including the Commission d'accès à l'information, where the breach could cause serious injury to a person in Quebec. Notification is not an acknowledgement of fault or liability.

We retain personal information while your account is active, as described in the Privacy Policy. Hourly snapshots are kept approximately 24 hours, and scheduled backups are kept on the cycle you configure. You can delete individual records at any time, and recordings and transcripts stay until you delete them.

When your account is deleted or your subscription ends, we delete or de-identify the personal information in your account within 30 days, except where we are required or permitted by law to keep it — for example tax, accounting, billing, security and dispute records — or where it remains in backups until those backups are pruned on their normal cycle. We can provide an export of your data before deletion; your own exports are always available from the app while your account is active. If you ask, we will confirm deletion in writing.

We will make available the information reasonably necessary to demonstrate our compliance with this DPA — including this document, the Privacy Policy, our security measures, and answers to a reasonable security and privacy questionnaire. Where your law or a regulator requires a more formal audit, we will work with you on scope, timing and confidentiality, and on the alternatives available (such as relying on provider certifications and reports) before any on-site visit.

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms & Conditions, except where applicable law does not allow them. You are responsible for the lawfulness of the personal information you put in the Service, for the instructions you give, and for the consents and notices described in section 5; you agree to indemnify us for claims arising from those, as set out in the Terms & Conditions.

This DPA takes effect when you accept the agreements during onboarding and continues for as long as we process personal information on your behalf. It survives termination for as long as we hold information under section 12. Where this DPA conflicts with the Terms & Conditions or the Privacy Policy on a data-protection matter, this DPA prevails. Where it conflicts with a mandatory requirement of applicable data protection law, the law prevails. This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada applicable in it, in line with the Terms & Conditions.

Nothing in this DPA makes us your insurer or your professional-liability cover. The insurance you carry for your own business — general liability, errors and omissions / professional liability, and cyber — is yours, and the liability cap in the Terms & Conditions is the limit of what you can recover from us.

Where the CCPA/CPRA applies, we act as your service provider. We will not sell or share personal information, retain, use or disclose it for any purpose other than the business purposes described in this DPA and the Terms & Conditions, or combine it with information from other sources except as permitted. We certify that we understand and will comply with these restrictions. You are responsible for providing the required notice at collection and for honouring consumer requests in respect of the information you control.

Questions about this DPA, requests for the information in section 13, or notices under it can be sent through the in-app Support page or to backtothegrind.dev@gmail.com.