Data Processing Addendum
Last updated: August 4, 2026
1. Roles and scope
This Data Processing Addendum ("DPA") is part of the SupplySmart Terms of Servicebetween Onwardlabs LLC ("SupplySmart", "we") and each distributor with a SupplySmart account ("you"). It applies to the personal information you and your customers enter into your workspace — such as store contacts, order history, invoices, and balances ("Customer Data"). For Customer Data, you are the controller and we are your processor: we handle it only to run the service for you. If you would like a countersigned copy of this DPA for your records, email hello@supplysmart.app.
2. Our processing instructions
We process Customer Data only to provide, secure, support, and improve the service as described in the Terms and the Privacy Policy, or as you otherwise instruct us through your use of the service (for example, sending an invoice email to a customer you selected). We do not sell Customer Data, use it for advertising, or use it for any purpose of our own beyond operating the service.
3. Confidentiality and access
Access to Customer Data within SupplySmart is limited to the people who operate and support the service, only as needed to do so, and under confidentiality obligations. Other tenants can never access your workspace; isolation is enforced at the database level as described on the Security page.
4. Security measures
We maintain technical and organizational measures appropriate to the data we handle, including per-tenant isolation enforced by database row security, encryption of data in transit and at rest, payment card and bank details held by Stripe rather than on our systems, daily automated database backups, error and security monitoring, and abuse rate limiting. The current measures are described on the Security page, which we keep up to date as the platform evolves.
5. Subprocessors
You authorize the subprocessors listed in the Privacy Policy (currently Stripe, Supabase, Vercel, Resend, Sentry, and Cloudflare), each engaged only to provide its service to us and bound by data protection obligations. We will announce material changes to the subprocessor list by email or in the dashboard at least 14 days before the change takes effect; if you object on reasonable data protection grounds and we cannot resolve the objection, you may close your account under the Terms.
6. Breach notification
If we become aware of a breach of security leading to unauthorized access to or disclosure of your Customer Data, we will notify you without undue delay and in any event within 72 hours of becoming aware, with the information we then have about what happened, what data was affected, and what we are doing about it — followed by updates as we learn more.
7. Assistance and requests from your customers
Requests from your customers about their information are yours to answer as controller; most can be handled directly with the tools in your dashboard (viewing, correcting, exporting, or deleting their records). If a request needs something the dashboard cannot do, we will provide reasonable assistance. If a customer contacts us directly about data in your workspace, we will refer them to you.
8. Audits and information
We will make available the information reasonably necessary to demonstrate the practices described in this DPA — starting with the Security page — and will answer reasonable written security questionnaires from you no more than once per year, except following a breach affecting your data.
9. Deletion and return
You can export your Customer Data at any time while your account is active. After account closure, we will delete Customer Data on your request, except records we must keep by law, and deleted data ages out of routine backups as described in the Privacy Policy.
10. Term and liability
This DPA applies for as long as we process Customer Data for you and is subject to the limitations of liability in the Terms of Service. If this DPA conflicts with the Terms regarding the processing of Customer Data, this DPA controls.