Data processing
Data Processing Addendum
A public template you can review and download. It is not signed until we execute a copy with you.
Template, contact us to execute.
How this template is used
Self-serve accounts accept the in-product Data Processing Agreement at signup. This page is the enterprise template: same subject matter, written for legal review and countersignature.
ExactPour LLC is the processor. You are the controller for the personal data your team enters (user names, emails, roles, and anything you put in notes, recipes, or invoice uploads).
To execute, send your legal entity name, billing email, and any requested edits to legal@exactpour.com. Security questions can go to security@exactpour.com.
What the template covers
- Roles: you instruct, we process.
- Security measures that exist in the product: RLS and FORCE RLS, TLS and HSTS, Supabase encryption at rest, role checks from the profiles table, CI secret and dependency gates, Stripe for cards, and Supabase backups.
- Subprocessors actually used in this codebase, including Resend, Loops, and Anthropic. OpenAI is not used.
- POS providers as customer-directed data sources: Toast, Square, Clover, and GoTab.
- Return, deletion, and breach notice commitments.
- SOC 2 is planned. No other certification is claimed.
Subprocessors
The same list lives on /subprocessors. Each row was checked against the repository before publication.
Infrastructure
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Postgres database, Auth, Storage, and Edge Functions | United States (hosted on AWS) |
| Netlify | Hosting and CDN for exactpour.com | United States |
| Stripe | Checkout, subscriptions, and the customer billing portal | United States / global |
Email and messaging
| Provider | Purpose | Region |
|---|---|---|
| Resend | Transactional email (password reset, invites, report delivery) | United States |
| Loops | Lifecycle email events from Edge Functions | United States |
| FormSubmit | Lead and support form delivery | United States |
AI features
| Provider | Purpose | Region |
|---|---|---|
| Anthropic | Invoice extraction, insights, and assistant replies | United States |
| Mistral AI | Optional invoice OCR layout prepass used with Anthropic | EU / United States |
POS data sources (customer-connected)
| Provider | Purpose | Region |
|---|---|---|
| Toast | POS menu, sales, and location sync when the customer connects Toast | United States |
| Square | POS menu, sales, and location sync when the customer connects Square | United States |
| Clover | POS menu, sales, and location sync when the customer connects Clover | United States |
| GoTab | POS menu, sales, and location sync when the customer connects GoTab | United States |
Optional operations tooling
| Provider | Purpose | Region |
|---|---|---|
| Go-UPC | Barcode and UPC product lookup | United States |
| Google Analytics | Marketing-site analytics when a measurement ID is configured | United States / global |
| Meta | Marketing-site ads measurement when a pixel ID is configured and consented | United States |
| Calendly | Demo scheduling | United States |
| Sentry | Crash reporting on the Expo client | United States |
| PostHog | Product analytics on the Expo client | United States / EU |
Talk with ExactPour
Need a signed DPA?
Download the Markdown template, then email legal@exactpour.com with your legal entity name. We will send an executable copy.