Data Processing Addendum

1. Details of the processing

• Subject matter & duration. Processing of Client Personal Data for as long as you keep the relevant estimate in your account, until you delete it or your account.
• Nature & purpose. Storing, organizing, displaying, and exporting the estimates you build, and generating share links — solely to provide the Service to you.
• Types of personal data. Whatever you choose to enter into an estimate — typically a Client’s name, company, address, and contact details. Estimatery does not require or request any special-category (sensitive) data; you should not enter it.
• Categories of data subjects. Your Clients and any other individuals whose details you include in an estimate.

2. Our obligations as processor

Estimatery will:

• Process on your instructions. Process Client Personal Data only to provide the Service and as otherwise instructed by you through the Service, except where law requires otherwise (in which case we’ll tell you unless legally prohibited). We do not sell it or use it for advertising.
• No selling, sharing, or secondary use. We will not sell or “share” Client Personal Data (as those terms are defined under California law), will not retain, use, or disclose it for any purpose other than providing the Service (or as otherwise permitted by applicable law), and will not combine it with personal information from other sources except as needed to provide the Service. For clarity: we never use your Clients’ contact details for our own marketing.
• Confidentiality. Ensure that people authorized to process the data are bound by confidentiality.
• Security. Implement appropriate technical and organizational measures (GDPR Art. 32) proportionate to the risk — including hashed, single-use sign-in tokens; signed httpOnly session cookies; account-scoped access to your saved data; and the privacy-wall projection that keeps internal-only fields out of client-facing outputs. See the Security section of our Privacy Policy.

3. Subprocessors

You authorize Estimatery to engage subprocessors to provide the Service. Each is bound by data-protection obligations no less protective than this DPA, and Estimatery remains responsible for their performance. Our current subprocessors are the service providers listed in the “Who we share information with” section of the Privacy Policy — currently Neon (database hosting), Resend (email), Upstash (rate limiting), Vercel (application hosting), Cloudflare (DNS/email routing), and LemonSqueezy (payments, for purchases only). We’ll update that list, noting the date of the change, at least 15 days before a new subprocessor begins processing Client Personal Data; if you reasonably object to a new one on data-protection grounds, email hello@estimatery.com and we’ll work with you or you may stop using the affected feature.

4. Data-subject requests & assistance

Because you control the estimates, you can fulfill most of your Clients’ requests yourself — you can view, edit, export (Download JSON / PDF / Excel / CSV), and delete the estimates that contain their data directly in the app. Where you need our help to respond to a data-subject request, or to meet your obligations for security, breach notification, or a data-protection impact assessment, we will provide reasonable assistance taking into account the nature of the processing and the information available to us. Email hello@estimatery.com.

5. Personal data breaches

If Estimatery becomes aware of a personal data breach affecting Client Personal Data, we will notify you without undue delay after becoming aware — and in any case within 72 hours — and provide the information reasonably available to us to help you meet your own notification obligations. Notice to you does not acknowledge fault.

6. Return & deletion

You may delete an estimate (and the Client Personal Data in it) at any time in the app. On termination of your account, the estimates and their Client Personal Data are deleted with the account — self-serve via Settings → Delete account (or by email from your account address); the account is disabled immediately and its data is permanently erased within 30 days. We may retain data where required by law, held only for that purpose. Data you exported or shared before deletion is outside our control.

7. Audits & information

On reasonable written request (no more than once a year, unless required by a supervisory authority or after a breach), we will make available the information reasonably necessary to demonstrate compliance with this DPA. Given the scale of the Service, this is ordinarily satisfied by responses to a reasonable questionnaire and any security documentation we maintain, rather than on-site inspection.

8. International transfers

Estimatery and its subprocessors are located in the United States and may process Client Personal Data there and elsewhere. For transfers of data protected by the GDPR/UK GDPR out of the EEA/UK, we and our subprocessors rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable), the EU-U.S. Data Privacy Framework where the subprocessor is certified, or another lawful transfer mechanism. To the extent those clauses are required for our processing on your behalf, they are incorporated into this DPA by reference; email hello@estimatery.com for details.

9. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms of Service. This DPA does not expand either party’s aggregate liability beyond what those Terms provide, except where applicable data-protection law does not permit such a limit.

10. Contact

Questions about this DPA, or to put a signed copy in place for your records: hello@estimatery.com. Governing law: California, USA, as set out in the Terms of Service.