Cart Billing App

Cart Billing App/Data Processing Addendum

!Draft — not yet in force

This document is a first-pass draft prepared for review by a licensed attorney. It is not legal advice and should not be relied on. Values shown as highlighted code are placeholders that must be resolved before publication, including the contracting entity, registered address, governing law, and retention periods.

36 values still to set

All of these live in src/lib/legal/config.ts and are read from the environment. Nothing needs editing in the document text.

  • legalEntityName — legal entity name
  • entityType — entity type
  • stateOfIncorporation — state of incorporation
  • registeredAddress — registered address
  • privacyContactEmail — privacy contact email
  • billingContactEmail — billing contact email
  • governingLawState — governing law state
  • arbitrationForum — arbitration forum
  • arbitrationVenue — arbitration venue
  • liabilityLookbackMonths — liability lookback (months)
  • liabilityFloorAmount — liability floor
  • securityDisclosureUrl — disclosure policy URL
  • securityResponseTimeframe — security response timeframe
  • securityOverviewUrl — security overview URL
  • securityIncidentNoticeHours — incident notice window (hours)
  • dpaBreachNoticeHours — DPA breach notice window (hours)
  • slaSummary — SLA summary
  • sccModule — SCC module
  • accountRetentionMonths — account retention (months)
  • authLogRetentionMonths — auth log retention (months)
  • serverLogRetentionDays — server log retention (days)
  • paymentRecordRetentionYears — payment record retention (years)
  • smsConsentRetentionYears — SMS consent retention (years)
  • marketingSuppressionRetentionMonths — email suppression retention (months)
  • terminationExportDays — post-termination export window (days)
  • backupRotationDays — backup rotation (days)
  • smsDailyMessageCap — SMS daily message cap
  • abuseReviewFee — abuse review fee
  • dataCenterRegion — data center region
  • awsSesRegion — AWS region
  • smtpProviderName — SMTP provider name
  • smtpProviderRegion — SMTP provider region
  • stripeRegions — Stripe regions
  • twilioRegions — Twilio regions
  • errorTrackingProvider — error tracking provider
  • errorTrackingRegion — error tracking region

Subprocessor locations still to confirm: Stripe, Twilio, Amazon Web Services (SES), Self-hosted VPS operator, Umami Analytics.

Cart Billing App updates these documents by posting a new version with a new effective date. The version above is what applies to your account.

Data Processing Addendum

Version 2026-09-28 · Effective 2026-09-28

This Data Processing Addendum (the “DPA”) forms part of the Terms of Service between legalEntityName and you. It applies to the extent Cart Billing App processes Personal Data on behalf of you or on behalf of your customers, and governs where the Terms do not.

This DPA does not itself authorize international transfers. Section 9 governs that, and section 4 lists the subprocessors. Signature blocks for a counter-signed agreement are at the end of this document.

1. Scope and roles

You are the controller and Cart Billing App is the processor of Personal Data you submit to the Service, including the personal information of your own customers. legalEntityName is the controller of its own business contact and billing data under the Privacy Policy.

A “business customer” is an individual who is your customer and whose personal information you submit to the Service, for example a route stop on an invoice or a record in your customer portal.

2. Definitions

  • “Personal Data,” “Processing,” “Controller,” “Processor,” “Data Subject,” “Supervisory Authority,” have the meanings given in the GDPR, and their equivalents under the UK GDPR and the CCPA/CPRA.
  • “Applicable Data Protection Law” means GDPR, the UK GDPR, the EU ePrivacy Directive as implemented, the CCPA/CPRA and other state privacy laws, and any successor law applying to the processing.
  • “SCCs” means the EU Commission’s Standard Contractual Clauses, set out in Decision 2021/914, as applicable to a transfer.

3. Instructions, purpose, and processing details

Cart Billing App will process Personal Data only on your documented instructions, including as necessary to provide the Service and to comply with these Terms, and will promptly inform you if, in our opinion, an instruction infringes Applicable Data Protection Law.

The subject matter, nature, purpose, and duration of the processing are:

  • Subject matter. Account, customer, service, invoice, and payment records you submit, and the communications Cart Billing App sends on your behalf.
  • Nature. Collection, storage, organization, retrieval, consultation, use, transmission to subprocessors, aggregation and de-identification, restriction, and erasure.
  • Purpose. Hosting the Cart Billing App Service: rendering the customer portal and hosted pay pages, generating and sending invoices and receipts, processing and reconciling payments, running the automatic billing, late-fee, and reminder jobs you configure, maintaining audit records, and supporting you.
  • Duration. For the term of your account, plus the retention and deletion periods in the Privacy Policy.
  • Categories of data subjects. Your staff and administrators; your business customers; and your own customers who are end users of a Cart Billing App portal or pay page.
  • Categories of personal data. Name, email address, mobile number, postal and service address, account and invoice identifiers, payment status, and — for opted-in SMS recipients — the phone number and consent record. Special categories of data and data on children should not be submitted. If you submit them, you are the controller of that processing and we will not use them for any purpose other than storing and displaying them to you.

4. Subprocessors

You give Cart Billing App general written authorization to use the subprocessors listed in section 6 of the Privacy Policy, which is incorporated into this DPA. Cart Billing App will provide at least 30 days’ notice before adding or replacing a subprocessor by posting an updated Policy and, for account administrators, emailing a summary. If you object on reasonable data protection grounds within that period, we will work with you to resolve it, and you may terminate the affected Service without penalty if no resolution is reached. Our processing remains subject to the obligations in this DPA.

Where a subprocessor acts on your behalf, legalEntityName remains responsible to you for the subprocessor’s performance of its obligations. You may request the identity of any specific subprocessor by email.

5. Security

Taking into account the state of the art, implementation costs, and the nature of the processing, legalEntityName will implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These include, at minimum:

  • TLS for data in transit and encrypted storage of sensitive fields.
  • Tenant-scoped access control and role-based authorization; separation of duties for privileged actions.
  • Audit records for platform administrative actions.
  • Signed and verified integration secrets; keys and credentials stored outside source control.
  • Environment separation between production and non-production, and restricted production access.
  • Backups, restore testing, and documented incident response.
  • Current dependency scanning, and a documented patch process.

We may update these measures as technology and risk change. We will not materially reduce the overall level of protection during the term.

6. Security incident notification

Cart Billing App will notify you without undue delay, and in any event within dpaBreachNoticeHours hours, after becoming aware of a personal data breach affecting your Personal Data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed.

Cart Billing App will not notify a supervisory authority or a data subject on your behalf unless required by law or instructed by you. Where we are required to notify a supervisory authority, we will inform you of the content at the same time unless prohibited. You are responsible for assessing whether a breach is notifiable in your jurisdiction and for notifying your customers.

7. Data subject requests

Taking into account the nature of the processing, Cart Billing App will assist you by appropriate technical and organizational measures to respond to a request to exercise a data subject right. If legalEntityName receives a request directly from a data subject concerning your Personal Data, it will forward the request to you promptly, will not respond substantively except at your instruction or as required by law, and will provide you with the information needed to respond.

Where you respond directly, you may use the portal to search and correct records, and you may export account and customer data in a structured, commonly used format.

8. Audit and inspection

Cart Billing App will make available the information necessary to demonstrate compliance with this DPA, including a security overview. We will respond to one reasonable written audit request per 12 months, on 30 days’ notice, during normal business hours, and will answer a short questionnaire where that suffices. If a report or questionnaire is not sufficient, the parties will cooperate on an audit plan that avoids disrupting operations, and you bear the cost of an on-site audit beyond our standard materials. We will not disclose another customer’s confidential information, and a regulator’s audit right is unaffected by this section.

9. International transfers

Cart Billing App may process Personal Data outside the EEA, UK, or your jurisdiction. Where a transfer is subject to the GDPR or UK GDPR and is not covered by an adequacy decision, the parties incorporate the sccModule by reference, andlegalEntityName as importer will:

  1. Provide the information needed to obtain an effective transfer mechanism and complete any required transfer risk assessment.
  2. Warrant that it has not determined that the laws of the destination country prevent it from complying with its obligations, and that it will notify you if that changes.
  3. Apply the supplementary measures identified in the transfer risk assessment where required.
  4. Make available a copy of the relevant SCCs on request.
The European Commission has adopted SCCs for transfers to importers subject to UK GDPR and to importers in the US, Japan, and Canada. Confirm the correct module and any UK addendum before signature. Separately, confirm whether to rely on the EU-US Data Privacy Framework — see the open placeholder in the Privacy Policy, section 10.

10. Deletion and return

On termination of the Service, or on your written request, legalEntityName will, within terminationExportDays, return or securely delete your Personal Data and delete existing copies, unless applicable law requires storage. We will delete from backups on our standard backupRotationDays rotation. We will confirm completion in writing on request, except where retention is required by law, and will then notify the affected data subjects if that is your instruction and law permits it to come from us. This obligation survives termination.

11. Liability, precedence, and changes

Liability under this DPA is subject to the limitations of liability in section 15 of the Terms of Service. Nothing in this DPA limits a party’s obligations more than the Terms do.

In the event of a conflict about the protection of Personal Data, this DPA prevails over the Terms and over any conflicting statement in an order form, except that a later, more protective written amendment signed by both parties prevails over this DPA.

Cart Billing App may update this DPA to reflect a legal change, a new subprocessor, or a change in the processing described in section 3, on 30 days’ notice. The version and effective date appear in the header of this document.