Data Processing Addendum (DPA)

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between you (the “Shop” / “Controller” for Shop Customer Data) and HailShopWare (the “Processor” / service provider).

1. Roles

• Shop Customer Data: names, emails, phones, addresses, VIN fragments, insurance/claim details, documents, signatures, and related CRM/ops records your shop enters or collects through the Platform.
• Your shop is the business that decides why and how Shop Customer Data is collected from end customers. HailShopWare processes Shop Customer Data on your documented instructions to provide the Services.
• For platform account data (owner/team logins, billing), HailShopWare acts as an independent controller as described in the Privacy Policy.

2. Ownership & no sale of identifiable lists

Shop Customer Data remains your shop’s customer relationship data. HailShopWare does not sell or rent identifiable Shop Customer Data to third parties. We do not use Shop Customer Data to market unrelated products to your customers for our own benefit, except as needed to operate the Services you enabled (for example delivering emails you send).

3. Processing instructions

We will process Shop Customer Data only to:

• Host, display, and sync CRM/ops workflows you use
• Store documents and signatures you capture
• Send emails/SMS you initiate (or automated status messages your customers opted into)
• Provide support, security, backups, and abuse prevention
• Comply with law

4. Subprocessors

We use infrastructure vendors (including Firebase/Google Cloud, Resend, and Stripe for billing). See the Privacy Policy for roles. We remain responsible for their processing under this DPA to the extent required by applicable law.

5. Security

We implement reasonable technical and organizational measures appropriate to the nature of the Services (including encryption in transit, access controls, and tenant isolation). No system is perfectly secure; you must also protect staff credentials and device access.

6. Aggregated / de-identified data

HailShopWare may create aggregated or de-identified datasets that cannot reasonably identify a natural person or your specific customers, and may use those for product improvement, benchmarks, and AI/model features. That aggregated data is not Shop Customer Data once de-identified.

7. Your warranties

You warrant that you have a lawful basis and all required consents/notices to collect and instruct us to process Shop Customer Data, including for any email or SMS you send. You will not instruct us to process data unlawfully.

8. Deletion & export

Upon written request after termination, and subject to legal retention needs, we will delete or return Shop Customer Data within a commercially reasonable period, or as required by applicable law. Use in-product export tools where available before canceling.

9. Contact

Privacy / DPA questions: contact.dallasreeldeal@gmail.com.