Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between P&L Outdoor Solutions LLC (“we,” “us”), which provides the Foremano service (the “Service”), and the client using the Service (“you,” “Client”). It applies where we process personal data about your own clients and contacts (“Client Personal Data”) on your behalf. By using the Service, you agree to this DPA.

Roles

As between the parties, you are the controller (or processor) of Client Personal Data and we are the processor (or subprocessor). We process Client Personal Data only to provide and support the Service and on your documented instructions — your configuration and use of the Service, together with the Terms and this DPA, are those instructions.

Details of processing

• Subject & purpose — providing the Foremano service (managing clients, jobs, scheduling, estimates, invoices, payments, communications, files/photos, and messaging).
• Duration — for as long as your account is active, plus any period required to return or delete data.
• Data subjects — your clients, contacts, and staff.
• Types of data — names, contact details, addresses, service/job records, notes, photos and files, message content, and payment metadata (full card data is handled by Stripe, not stored by us).

Our obligations

• Process Client Personal Data only on your instructions and as needed to provide the Service, and not for our own unrelated purposes. We do not sell it.
• Ensure personnel authorized to access it are bound by confidentiality.
• Maintain appropriate technical and organizational security measures, including encryption in transit and at rest, tenant isolation so one business cannot access another's data, access controls, and logging.
• Assist you, taking into account the nature of processing, in responding to data-subject requests and in meeting your security and breach obligations.
• Notify you without undue delay after becoming aware of a personal data breach affecting Client Personal Data.
• Make available information reasonably necessary to demonstrate compliance with this DPA.

Your responsibilities

• You are responsible for having a lawful basis and any required consent for the data you put into the Service, including consent to contact your clients by SMS or email.
• You are responsible for the accuracy of your instructions and for using the Service in compliance with applicable law.

Subprocessors

You authorize us to engage the subprocessors below to help provide the Service. We remain responsible for their performance and impose data-protection obligations on them no less protective than this DPA. We will give at least 30 days' notice (by email to your account contact or by updating this page) before adding or replacing a subprocessor that processes Client Personal Data. You may object on reasonable data-protection grounds within that period; if we cannot reasonably accommodate the objection, you may terminate the affected Service.

• Neon — database hosting (United States).
• Netlify — application hosting (United States).
• Cloudflare — file/photo storage, backups, and content delivery.
• Clerk — authentication.
• Stripe — payment processing.
• Twilio — text messaging (where enabled).
• Resend — email delivery.
• Anthropic — AI features (the content sent for a given AI action).
• Sentry — error monitoring.
• Mapbox — maps / geocoding.

Location & transfers

Client Personal Data is primarily hosted in the United States. Where data-protection law requires a transfer mechanism for international transfers, the parties will rely on an appropriate lawful mechanism.

Data-subject requests

The Service provides tools to access, export, correct, and delete data. Where you need our help to respond to a request from one of your clients, contact support@foremano.com and we will assist as reasonably required.

Return & deletion

On termination of your account, we will, on request, delete or return Client Personal Data within a reasonable period, except where retention is required by law. Backups are deleted on our routine cycles.

California (CCPA/CPRA) — service provider

For personal information subject to the California Consumer Privacy Act as amended (CCPA/CPRA), we act as a service provider. We certify that we will not: (a) sell or share personal information (as those terms are defined by the CCPA); (b) retain, use, or disclose it for any purpose other than providing the Service or as the CCPA otherwise permits; or (c) combine it with data from other sources except as the CCPA permits. We understand and will comply with these restrictions.

Government & law-enforcement requests

If we receive a legally binding request from a public authority to disclose Client Personal Data, then unless legally prohibited we will review the request for validity, disclose only the minimum required, challenge requests that are unlawful or overbroad, and notify you so you can seek protective relief.

Aggregated & de-identified data

We may create and use aggregated or de-identified data (that does not identify you, any data subject, or any individual, and cannot reasonably be re-identified) to operate, secure, analyze, and improve the Service, including benchmarks. We will not attempt to re-identify such data.

Liability & precedence

Each party's liability under this DPA is subject to the limitations in the Terms of Service. If there is a conflict between this DPA and the Terms regarding the processing of personal data, this DPA controls.

Changes & contact

We may update this DPA and will revise the “Last updated” date above. For a countersigned copy or with any questions, email support@foremano.com.