Data Processing Agreement: summary
This page summarizes the Data Processing Agreement (DPA) between FendPulse LLC and businesses that install FendPulse. It is a summary, not the agreement itself. The full DPA is available on request at [email protected].
1. Roles
- You (the business that installs FendPulse) are the controller of the data in your Stripe account.
- FendPulse LLC processes the data FendPulse reads from your Stripe account as your processor, only to provide the Service.
- Stripe (including Link) is an independent controller of the data you enter at checkout, as described in our Privacy Policy (section 6.1).
2. What we process and why
- Purpose: detect risky changes on your Stripe account, send alerts, show alert history, provide support and keep the Service secure.
- Data: Stripe account and object IDs, the changed fields of risky events, alert settings and the alert email addresses you give us. The full list is in Privacy Policy section 3.
- Not processed: card numbers, bank account numbers, your customers' personal details, or full copies of Stripe objects.
- Instructions: we process data only on your documented instructions, which are these terms and the settings you choose in the app.
3. Confidentiality and security
- Everyone who processes the data for us is bound by confidentiality.
- We use encryption in transit, access controls, least-privilege read-only permissions and verified Stripe signatures. FendPulse never changes your Stripe account.
4. Subprocessors
- Our current subprocessors are listed at fendpulse.com/subprocessors.
- We give at least 30 days' notice on that page and in its RSS feed before a new subprocessor starts processing your data. If you object, tell us; you can cancel before the change takes effect.
5. Security incidents
If we become aware of a security incident that affects your data, we email the account owner without undue delay and no later than 72 hours after we become aware of it, with what we know, what we are doing and what you can do.
6. Helping you with requests
We help you answer requests from individuals and supervisory authorities about the data we process for you. Send them to [email protected]. We reply within 24 hours.
7. International transfers
Data is hosted in the United States (Supabase region us-east-1). Transfers from the EU, the UK or Switzerland rely on the European Commission's Standard Contractual Clauses (with the UK Addendum) or another lawful mechanism.
8. Deletion
When you uninstall FendPulse, we stop reading your account immediately and delete the data we process for you within 30 days, then email the account owner to confirm. We keep only billing records the law requires and the hashed records described in Privacy Policy section 3.
9. Information and audits
On request, we give you the information you reasonably need to show that these commitments are met.
10. Contact
FendPulse LLC (crafted by RESILIENCE: Agentic Solutions LLC) · 400 N Tampa St, Tampa, FL 33602, USA · [email protected]. We reply within 24 hours.