# ExactPour Data Processing Addendum (template)

Template, contact us to execute.

This document is a public template. It is not an executed agreement. To execute a Data Processing Addendum, email legal@exactpour.com with your legal entity name, billing email, and any requested edits.

The version accepted at signup lives at https://exactpour.com/legal/data-processing-agreement. This template is for enterprise procurement and countersignature.

Last reviewed against the ExactPour codebase on 13 October 2026.

## 1. Parties and roles

This Data Processing Addendum ("DPA") is between ExactPour LLC ("Processor" or "ExactPour") and the customer identified in an executed copy ("Controller" or "Customer"). It applies when ExactPour processes Personal Data on Customer's behalf in connection with the ExactPour service.

Customer is the Controller (or a processor acting for a Controller). ExactPour is the Processor.

## 2. Scope

- Subject matter: inventory management, analytics, POS reconciliation, and related AI-assisted features.
- Duration: the subscription term, plus the retention and deletion windows in the Terms of Service.
- Nature and purpose: hosting, storage, processing, and analysis of Customer Data to deliver, secure, and maintain the service.
- Types of Personal Data: authorized-user name, email, and role; IP and device data; and any Personal Data Customer chooses to put in notes, recipes, or uploaded documents.
- Data subjects: Customer's authorized users and any other people whose data Customer enters.

## 3. Processor obligations

ExactPour will:

1. process Personal Data only on Customer's documented instructions, including the Terms of Service, this DPA, and Customer's use of the product;
2. keep people who handle Personal Data under a confidentiality obligation;
3. maintain the technical and organizational measures in Section 6;
4. use subprocessors only as described in Section 5;
5. help Customer respond to data-subject requests where reasonably possible;
6. delete or return Personal Data at the end of the service, subject to legal holds and backup cycles;
7. make information reasonably available so Customer can review these commitments.

ExactPour does not use Customer Data to train foundation models. A model provider is not allowed to train on Customer Data unless the customer authorizes that feature in writing.

## 4. Customer instructions

Customer's instructions are the Agreement, this DPA, and configuration of the service (including which POS integrations to connect and which users to invite). Customer is responsible for the lawfulness of Personal Data it submits.

## 5. Subprocessors

Customer authorizes ExactPour to engage the subprocessors listed at https://exactpour.com/subprocessors (and in the tables below). ExactPour remains responsible to Customer for their performance.

POS providers (Toast, Square, Clover, GoTab) are data sources the customer chooses to connect. They receive and send menu, sales, and location data only for connected locations.

The current list, verified against this codebase:

### Infrastructure

| Provider | Legal entity | Purpose | Data | Region |
| --- | --- | --- | --- | --- |
| Supabase | Supabase, Inc. | Postgres database, Auth, Storage, and Edge Functions | Account profiles, inventory and operational data, auth tokens, uploaded invoices | United States (hosted on AWS) |
| Netlify | Netlify, Inc. | Hosting and CDN for exactpour.com | Visitor IP addresses, request logs, and pages requested | United States |
| Stripe | Stripe, Inc. | Checkout, subscriptions, and the customer billing portal | Billing email, Stripe customer and subscription IDs. Card numbers stay at Stripe. | United States / global |

### Email and messaging

| Provider | Legal entity | Purpose | Data | Region |
| --- | --- | --- | --- | --- |
| Resend | Resend, Inc. | Transactional email (password reset, invites, report delivery) | Recipient email address and message content | United States |
| Loops | Loops.so | Lifecycle email events from Edge Functions | Account email, plan, and product events (POS connected, first count) | United States |
| FormSubmit | FormSubmit | Lead and support form delivery | Name, email, venue, and message body | United States |

### AI features

| Provider | Legal entity | Purpose | Data | Region |
| --- | --- | --- | --- | --- |
| Anthropic | Anthropic, PBC | Invoice extraction, insights, and assistant replies | Prompts and files the customer submits to an AI feature | United States |
| Mistral AI | Mistral AI | Optional invoice OCR layout prepass used with Anthropic | Uploaded invoice PDFs or images and derived OCR text | EU / United States |

### POS data sources (customer-connected)

| Provider | Legal entity | Purpose | Data | Region |
| --- | --- | --- | --- | --- |
| Toast | Toast, Inc. | POS menu, sales, and location sync when the customer connects Toast | Menus, sales tickets, and location identifiers | United States |
| Square | Block, Inc. | POS menu, sales, and location sync when the customer connects Square | Menus, sales tickets, and location identifiers | United States |
| Clover | Clover Network, LLC | POS menu, sales, and location sync when the customer connects Clover | Menus, sales tickets, and location identifiers | United States |
| GoTab | GoTab, Inc. | POS menu, sales, and location sync when the customer connects GoTab | Menus, sales tickets, and location identifiers | United States |

### Optional operations tooling

| Provider | Legal entity | Purpose | Data | Region |
| --- | --- | --- | --- | --- |
| Go-UPC | Go-UPC | Barcode and UPC product lookup | Scanned barcodes and product lookup queries | United States |
| Google Analytics | Google LLC | Marketing-site analytics when a measurement ID is configured | Device and usage data, IP address (anonymized where configured) | United States / global |
| Meta | Meta Platforms, Inc. | Marketing-site ads measurement when a pixel ID is configured and consented | Page events and limited conversion data | United States |
| Calendly | Calendly, LLC | Demo scheduling | Name, email, and booked time | United States |
| Sentry | Functional Software, Inc. | Crash reporting on the Expo client | Crash diagnostics and device data | United States |
| PostHog | PostHog, Inc. | Product analytics on the Expo client | Product usage events | United States / EU |

OpenAI is not a subprocessor. No Edge Function in this repository calls OpenAI.

## 6. Security measures

Measures in place today, verified against the repository:

- Tenant isolation with Postgres Row Level Security and FORCE RLS, scoped by current_account_id().
- Encryption in transit (HTTPS and HSTS on exactpour.com; TLS to Supabase).
- Encryption at rest provided by Supabase on AWS-hosted Postgres.
- Role-based access: OWNER, MANAGER, STAFF on the tenant; MASTER_ADMIN for platform staff, resolved from the profiles table.
- Gitleaks secret scanning and fail-closed npm audit gates in CI.
- Stripe Checkout for cards. ExactPour does not store card numbers.
- Automated database backups provided by Supabase.
- Vulnerability reports: security@exactpour.com.

## 7. International transfers

Personal Data may be processed in the United States and other countries where the subprocessors above operate. Where a transfer mechanism is required, the parties will rely on Standard Contractual Clauses or another approved mechanism.

## 8. Breach notice

ExactPour will notify Customer without undue delay after confirming a Personal Data Breach that affects Customer's Personal Data, and will share information reasonably available to help Customer meet its own notice duties.

## 9. Return and deletion

After the subscription ends, ExactPour will delete or return Personal Data on request within the export window described in the Terms of Service, except where law requires retention or data remains in routine backups until those backups expire.

## 10. Audits

ExactPour will provide information reasonably needed to review this DPA. Customer may request additional review no more than once per calendar year, on reasonable notice, under confidentiality, and without disrupting operations. SOC 2 is planned. This template does not claim a completed audit.

## 11. Liability

Liability under this DPA follows the limitations in the Terms of Service.

## 12. Execution

This template has no legal effect until both parties sign a copy (or ExactPour confirms acceptance in writing). Email legal@exactpour.com to execute.

ExactPour LLC
United States
legal@exactpour.com
security@exactpour.com