Data Processing Agreement

This DPA applies where your company (the "Controller") uses GarageDoorNet (the "Processor") to process personal information about your customers and team. It forms part of our Terms of Service.

Roles

You control the customer data you enter (names, contact details, addresses, job and payment records). We process it only to provide the Service, on your instructions, and never for our own marketing.

Security measures

• Encryption in transit (TLS) and at rest (AES-256).
• Row-level security enforcing strict per-company data isolation.
• Role-based access control within your company (admin / sales / technician).
• Hashed credentials; platform-level administrative access is limited to named staff, and changes to invoices and payments are recorded in a database-enforced audit log.

Subprocessors

We use the following subprocessors to deliver the Service:

• Supabase (database, authentication, storage; hosted in AWS Canada Central, Montréal).
• Stripe (payment processing).
• Resend (transactional email delivery).
• Sentry (error monitoring).
• Google (Gemini API; the AI assistant, price-sheet import and photo opening detection. Customer names, contact details, addresses, house photos and supplier price sheets can be part of what is sent. Processing location not fixed by Google).
• OpenStreetMap Nominatim and OSRM (address geocoding and driving routes for the schedule map; called from your browser with the job address and city only, never a customer name).

Google Maps is not a subprocessor. When you ask for directions the app opens a Google Maps link in a new tab. The address reaches Google only when you open that link, and no Google Maps script runs inside the app.

We will notify account owners by email before adding a subprocessor that processes customer personal information.

Data residency & transfers

Primary data storage is in Canada. Some subprocessors (payment, email, error monitoring and Google's Gemini API) may process data outside Canada under their own compliance programs, and Google does not fix a processing location for the Gemini API. If you operate outside Canada and need specific transfer terms (e.g., EU SCCs), contact us.

Breach notification

If we become aware of a breach of security affecting your customer data, we will notify your account owner without undue delay and share what we know, what we're doing, and what we recommend you do.

Deletion & return

On termination, you may export your data for 30 days, after which we delete it from production systems. Deletion requests during the term are honoured as described in the Privacy Policy.

To request a signed copy of this DPA for your records: hello@garagedoornet.ca