Data Processing Addendum
Effective Date: October 6, 2026 Version: 1.1
This Data Processing Addendum ("DPA") forms part of the Terms of Service between the customer ("Customer") and DFY Hub ("DFY Hub", "we"). It lasts as long as the Terms and survives for the deletion period in Section 10.
1. Definitions and scope
"Customer Personal Data" means personal information that DFY Hub processes on the Customer's behalf through the Service: customer and contact records imported from or created in connected platforms (such as Jobber and GoHighLevel), and AI Secretary data about the Customer's callers, correspondents, and approved texters (caller numbers, call transcripts and summaries, recordings on plans that include them, and email content). This DPA applies whenever DFY Hub processes Customer Personal Data.
2. Roles
The Customer is the controller of Customer Personal Data, and DFY Hub is its processor (a "service provider" under the California Consumer Privacy Act, "CCPA"). DFY Hub's own account, billing, and website data about the Customer is outside this DPA and is governed by our Privacy Policy.
3. Instructions
DFY Hub processes Customer Personal Data only to provide the Service and on the Customer's documented instructions. The Terms, the Customer's configuration of the Service, and the actions the Customer authorizes are its instructions. DFY Hub will tell the Customer if it believes an instruction violates applicable law.
4. Service-provider restrictions
DFY Hub will not: sell or share Customer Personal Data; retain, use, or disclose it for any purpose other than providing the Service; use it outside the direct business relationship with the Customer; or combine it with personal information from other sources, except as the Service requires to perform for the Customer. Customer Personal Data is not used to train generalized AI models. DFY Hub will comply with the CCPA and provide the same level of privacy protection the CCPA requires of the Customer. It will notify the Customer if it can no longer meet these obligations. The Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data.
5. Confidentiality
Persons authorized to process Customer Personal Data are bound by confidentiality obligations.
6. Security
DFY Hub maintains the security measures described in Section 7 of our Privacy Policy, as updated from time to time, including row-level security on every tenant-scoped database table and TLS encryption in transit.
7. Sub-processors
The Customer authorizes the sub-processors listed in Annex 1. DFY Hub will give at least 30 days' notice of a new or replacement sub-processor by email or in-app notification. The Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service without penalty. DFY Hub imposes data-protection terms on each sub-processor that are no less protective than this DPA, and remains responsible for its sub-processors.
8. Assistance with requests
DFY Hub will help the Customer respond to requests from individuals (access, deletion, correction) about Customer Personal Data. It will delete specified data on the Customer's verified instruction within 45 days.
9. Security incidents
DFY Hub will notify the Customer without undue delay, and in any event within 72 hours, after confirming a security incident affecting Customer Personal Data. The notice will describe the incident and the steps taken, as far as then known.
10. Return and deletion
Before deletion, the Customer may request an export of its data in JSON format. Within 45 days after the Service ends, DFY Hub will delete Customer Personal Data, including AI Secretary recordings held by its voice provider. The exception is data that the law requires DFY Hub to keep, which it will continue to protect under this DPA.
11. Audits
On reasonable written request, no more than once a year, DFY Hub will provide the information needed to demonstrate compliance with this DPA.
12. Location
DFY Hub stores Customer Personal Data in the United States. Logo images that Customer uploads to brand its reports are stored with Cloudflare R2 in its Eastern North America region, which may include Canada, and can be viewed by anyone with the image's link. Some sub-processors route traffic through global edge networks, as noted in Annex 1. The Service is offered only to businesses located in the United States (Terms, Section 1).
13. Precedence and governing law
If this DPA and the Terms conflict about Customer Personal Data, this DPA controls. Texas law governs, as provided in the Terms.
Annex 1 — Sub-processors
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Render | Application and background-job hosting | All Service data in processing | United States |
| Neon | Primary database | All stored Service data | United States (AWS us-east-2, Ohio) |
| Hetzner Online | Application hosting (API and background worker), job queue, logs, self-hosted page-view analytics | Service data in processing; queued jobs; access and application logs; page-view analytics | United States (Ashburn, Virginia) |
| Vercel | Website and application front end | Requests and session tokens | United States; global edge network |
| Cloudflare | DNS, content delivery, SEO MCP server, storage of uploaded logo images | Requests; SEO tool inputs; logo images Customer uploads (viewable by anyone with the link) | United States; global edge network; logo storage in Cloudflare's Eastern North America region |
| Anthropic | AI features; AI Secretary calls and summaries | Content sent to AI features; AI Secretary call transcripts and summaries | United States |
| Stripe | Payments | Billing contact and transaction data | United States |
| Resend | Transactional email | Recipient address and email content | United States |
| Telnyx | Phone numbers, text messages, AI Secretary phone line | Phone numbers, message content, call audio in transit | United States |
| Vapi | AI Secretary call handling; recording storage on plans that include it | Call audio, transcripts, caller numbers | United States |
| Deepgram | Speech-to-text for the AI Secretary | Call audio | United States |
| PlayHT | AI Secretary voice | Text the Secretary speaks | United States |
| Langfuse | AI request monitoring | Prompts and outputs of AI features; request metadata | United States |
| Sentry | Error monitoring | Error reports with request metadata; bodies, headers and cookies stripped | United States |