1. Roles
This Data Processing Addendum ("DPA") forms part of the Terms of Service between the Customer and ObraMate. For personal data that the Customer and its Users put into the Service about clients, leads, employees and other people ("Customer Personal Data"), the Customer is the business / controller and ObraMate is the service provider / processor.
2. Instructions
ObraMate processes Customer Personal Data only to provide, secure and support the Service, according to the Customer's documented instructions (these Terms, this DPA and the Customer's use of the Service's features), and as required by law. ObraMate will not sell or share Customer Personal Data, will not use it for any other commercial purpose, and will not combine it with personal data from other sources except as needed to provide the Service.
3. Types of data and people
Depending on how the Customer uses the Service, Customer Personal Data may include:
- Clients and leads: names, phone numbers, e-mail addresses, property addresses, project details, photos, quotes, invoices and payments.
- Employees and crew: names, contact details, roles, work days and hours, pay rates, payments, deductions and reimbursements, and photos or GPS location attached to job records.
- Users of the workspace: names, e-mail addresses and activity in the app.
4. Confidentiality and staff
ObraMate limits access to Customer Personal Data to personnel who need it to provide or support the Service and who are bound by confidentiality. Platform staff access requires two-factor authentication and is recorded in an audit log. Staff access a workspace for support only when needed to resolve an issue.
5. Security measures
We maintain reasonable technical and organizational measures, including:
- encryption in transit (HTTPS) and hashed passwords;
- logical isolation of each customer's data in the database;
- role-based permissions inside each workspace;
- regular backups and periodic restore tests;
- audit logging of platform staff actions and two-factor authentication for platform staff.
6. Sub-processors
The Customer authorizes the use of the sub-processors listed below. We impose data protection obligations on them that are no less protective than this DPA and remain responsible for their performance. We will update this list and notify workspace administrators at least 30 days before adding a new sub-processor; the Customer may object on reasonable data protection grounds and, if we cannot resolve the objection, terminate the affected service.
- Railway — Application hosting and database (United States)
- S3-compatible object storage — Photos, documents and file storage (United States)
- Resend — Transactional e-mail delivery (United States)
- Stripe — Subscription billing and card payments (United States)
- Google Maps Platform — Address lookup, geocoding and maps (United States)
- OpenAI — Reading receipts and photos you choose to scan (United States)
7. Assistance and requests
Taking into account the nature of the processing, we will help the Customer respond to requests from individuals to access, correct, delete or obtain a copy of their data, mainly through the features of the Service (editing, deleting and exporting records). If we receive such a request directly, we will refer the person to the Customer.
8. Security incidents
We will notify the Customer without undue delay, and in any case within 72 hours after confirming a security incident affecting Customer Personal Data, with the information reasonably available to help the Customer meet its own obligations.
9. Return and deletion
The Customer can export its data while the workspace is active or read-only. After the workspace is closed, we keep Customer Personal Data for up to 90 days to allow restoration on request and then delete it from active systems; backups are overwritten on their normal schedule.
10. Location, audits and precedence
Customer Personal Data is hosted in the United States. On reasonable written request, and no more than once a year, we will provide information needed to show compliance with this DPA. If this DPA conflicts with the Terms of Service regarding personal data, this DPA prevails.
Contact: support@obramate.com.
Questions? Write to support@obramate.com.