Data Processing Agreement

This DPA applies where EcommDataHub Inc. processes personal data on your behalf under GDPR or similar laws, and supplements the Terms of Service.\n\n## Scope and roles\nFor account and billing data we act as controller. For request parameters you send through the API that contain personal data, you are the controller and we act as processor, handling it only to execute and log the request.\n\n\n## Subprocessors\nWe use a small set of subprocessors for hosting, email delivery and payment processing, each bound by contract. The current list is available on request from [email protected]; we give 30 days notice before adding one.\n\n\n## Security measures\nEncryption in transit and at rest, hashed access keys, role-restricted internal access, and 90-day log retention. We notify you of a personal data breach without undue delay after becoming aware of it.\n\n\n## Deletion and return\nOn account closure we delete personal data within 30 days, except records required for tax and accounting. Request logs age out on the standard 90-day schedule.