Data Processing Agreement

1. Parties and Scope

This Data Processing Agreement ("DPA") forms part of the Terms & Conditions between Back To The Grind ("Processor", "we", "us") and the business owner ("Controller", "you") who uses our platform to manage their contracting or fabrication business. This DPA applies to all processing of personal data carried out by us on your behalf under the service.

2. Data We Process

We process the following categories of personal data on your behalf:

• Customer data: Names, email addresses, phone numbers, and addresses of your customers that you enter into the platform.
• Employee data: Names, email addresses, pay rates, and time-tracking data for your team members.
• Business data: Company name, address, financial records, estimates, invoices, and work order details.
• Account data: Your email address, authentication tokens, and app preferences.

3. Purpose of Processing

We process your data solely to provide the platform's business management features — work order tracking, estimating, invoicing, scheduling, marketing, and AI-assisted operations. We do not sell your data or use it for any purpose independent of providing the service to you.

4. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS) and at rest
• Row-level security isolating each account's data from other accounts
• Role-based access controls — only you and your authorized team members can access your data
• Regular automated backups with 24-hour point-in-time recovery
• Secure OAuth-based integrations with third-party services (Google, Facebook, Stripe, Square)

5. Data Retention

We retain your data for as long as your account is active. Upon account deletion, we permanently delete all your business data within 30 days, except where retention is required by law (e.g., tax records). Backups containing deleted data are pruned within 24 hours of the deletion.

6. Your Rights

As the Controller, you have the right to:

• Access, export, or delete all your data at any time through the app's Data Backup and Data Backup features
• Revoke third-party integration access (Google, Facebook, Stripe, Square) at any time through Account Connections
• Receive a copy of your data in a portable format (JSON export)
• Request deletion of your account and all associated data

7. Sub-Processors

We use the following sub-processors to deliver the service:

• Cloud infrastructure: Google Cloud Platform (data hosting, storage, compute)
• Payments: Stripe and Square (payment processing)
• AI services: OpenAI, Google AI, and Anthropic (AI assistant features)
• Email: Google Gmail API (email scanning and sending via your connected account)
• Social media: Meta/Facebook Graph API (social media management via your connected account)

We will notify you at least 30 days in advance of any change to our sub-processors.

8. Data Breach Notification

In the event of a personal data breach, we will notify you without undue delay and no later than 72 hours after becoming aware of the breach. We will provide you with all relevant information to allow you to comply with your own breach notification obligations under applicable law.

9. Compliance with PIPEDA and GDPR

This DPA is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA, Canada) and the General Data Protection Regulation (GDPR, EU). Where any provision conflicts with applicable law, the law prevails.

10. Contact

For any questions about this DPA or your data, contact us through the in-app Support page.