Data Processing Addendum
This addendum ("DPA") forms part of the agreement between Liftori and its business customer ("Customer") and applies whenever Liftori processes personal data on Customer's behalf. If a signed DPA exists between Customer and Liftori, the signed version controls.
1. Roles
Customer decides what personal data is placed in the Services and why. Liftori processes that data only to provide the Services, on Customer's documented instructions, including the agreement and Customer's use and configuration of the Services.
2. Scope of processing
| Item | Detail |
|---|---|
| Subject matter | Hosting and operating Customer's software, such as CRM, scheduling, field service, portals, billing and messaging |
| Duration | The term of the agreement, plus the return and deletion period below |
| Data subjects | Customer's staff, customers, prospects and contacts, and others whose data Customer enters |
| Types of data | Names, contact details, addresses, job and service records, photos, signatures, messages, invoices and payment status. Liftori does not ask Customer to provide card numbers, government ID numbers or health information. |
| Location | United States |
3. Liftori's commitments
- Process the data only on Customer's instructions, and tell Customer if an instruction appears to break the law.
- Limit access to personnel who need it to provide the Services, and require them to keep it confidential.
- Keep appropriate technical and organizational security measures in place (section 7).
- Not sell Customer's data or use it for any purpose other than providing, securing and supporting the Services.
- Help Customer respond to requests from individuals exercising their privacy rights, taking into account the nature of the processing.
- Give Customer the information reasonably needed to show compliance with this DPA.
4. Subprocessors
Customer authorizes Liftori to use the subprocessors listed below. Liftori requires each to protect the data to a standard at least as protective as this DPA and remains responsible for their work. Liftori will notify Customer before adding or replacing a subprocessor that will process Customer's data, giving Customer the chance to object on reasonable grounds.
| Subprocessor | Purpose |
|---|---|
| Supabase, Inc. (Amazon Web Services, US) | Database, authentication, file storage, server functions |
| Vercel, Inc. | Application hosting |
| Resend | Email delivery |
| LiveKit | In-app video calls, when used |
| Stripe, Inc. | Payments, when enabled |
| Google LLC | Maps and address lookup, when used |
| Anthropic, PBC | Optional AI assistant, when enabled |
| Intuit Inc. | QuickBooks accounting sync, when Customer connects it |
5. Security incidents
If Liftori confirms a breach of security that leads to unauthorized access to, or loss or disclosure of, Customer's personal data, Liftori will notify Customer without undue delay, and in any case within 72 hours of confirming it. The notice will describe what happened, the data involved, the steps taken, and a contact for more information. Liftori will cooperate with Customer's response and any notices Customer must give.
6. Return and deletion
At any time on request, and at the end of the agreement, Liftori will provide an export of Customer's data in a standard format (CSV and a complete PostgreSQL export). Within 30 days after the agreement ends, Liftori will delete Customer's data from its live systems; copies in backups are overwritten on the normal backup schedule. Liftori may keep data only where the law requires, and keeps it protected under this DPA.
7. Security measures
- A dedicated database and file storage for each customer.
- Access rules enforced inside the database for every user role, tested before release.
- Encryption in transit (TLS 1.2 or higher) and at rest (AES-256).
- Secrets held server-side only; private source code; automated secret scanning before release.
- Expiring, revocable access links; staff added only by Customer administrators.
- Automated daily backups.
- Incident response and responsible disclosure, as described on the Security page.
8. Reviews
Liftori will answer Customer's reasonable security questionnaires and provide its hosting providers' independent audit reports where available. Customer may conduct its own security testing of its environment with prior written agreement on scope and timing.
9. General
This DPA is governed by the same law as the agreement. Liability under this DPA is subject to the limitations in the agreement. If this DPA conflicts with the agreement on the processing of personal data, this DPA controls.
Contact
ryan@liftori.ai ยท Security: security@liftori.ai