Data Processing Addendum (DPA)
Effective Date: October 2026 • Governing GDPR Article 28, UK Data Protection Act, and Canadian PIPEDA Schedule 1.
1. Scope & Applicability
This Data Processing Addendum (“DPA”) supplements the ShadeCraft Terms of Service and applies to all business users, window covering dealers, and independent contractors (“Customer” or “Controller”) whose processing of customer data is subject to applicable global data protection laws. ShadeCraft Technologies Inc. acts as the “Processor” or “Service Provider.”
2. Authorized Sub-processor Registry
ShadeCraft maintains strict vendor diligence. All sub-processors are legally bound by data protection obligations at least as restrictive as this DPA.
Supabase Inc.
United States (AWS us-east-1)Database, User Authentication & Object Storage
Data Processed: Contractor account profiles, encrypted project estimate calculations, custom fabric swatches, and interior room photos.
Transfer Safeguard: EU Standard Contractual Clauses (SCCs) & Data Privacy Framework (DPF)
Vercel Inc.
Global Edge Network / United StatesCloud Application Hosting & Edge Routing
Data Processed: HTTP request metadata, transient application logs, and encrypted session cookies.
Transfer Safeguard: EU Standard Contractual Clauses (SCCs) & Data Privacy Framework (DPF)
Stripe Inc.
United States, Canada & European UnionPayment Processing, Tax Calculations & Invoicing Vault
Data Processed: Billing names, company addresses, credit card tokens (PCI-DSS Level 1), transaction histories, and tax identifiers.
Transfer Safeguard: Binding Corporate Rules (BCRs) & EU Standard Contractual Clauses
Google LLC (Google Cloud / Gemini)
United StatesGenerative Vision AI Inference
Data Processed: Transient window photos and shade texture prompts for render generation. Data is processed in real time and NEVER used to train foundation models.
Transfer Safeguard: EU Standard Contractual Clauses (SCCs) & Enterprise Cloud Privacy Terms
Resend Inc.
United StatesTransactional Email & Statutory Receipt Dispatch
Data Processed: Recipient email addresses, contractor names, and transactional receipt copy.
Transfer Safeguard: EU Standard Contractual Clauses (SCCs) & DPF
Cloudflare Inc.
Global Anycast EdgeWeb Application Firewall (WAF), DDoS Mitigation & SSL Encryption
Data Processed: Transient IP addresses, network packet headers, and bot mitigation signals.
Transfer Safeguard: EU Standard Contractual Clauses (SCCs) & DPF
3. Data Subject Rights & Assistance
ShadeCraft provides automated in-app tools enabling contractors to fulfill data subject requests directly, including 1-click structured data portability (GDPR Art. 20) and permanent account erasure with cryptographic verification (GDPR Art. 17).
Statutory Privacy & DPO Inquiries
Privacy Compliance Officer • ShadeCraft Technologies Inc. • Toronto, ON, Canada
Email: privacy@shadecraft.app