Data Processing Addendum
How ServiceArc handles personal data on behalf of your business.
Last updated: October 21, 2026Version 2026-10-21
1. Parties and scope
This Addendum is between the customer accepting the Terms of Service (“Customer”) and William Humble, operating ServiceArc in Virginia, USA (“ServiceArc”).
It forms part of the Terms when accepted. It applies to personal data ServiceArc processes for Customer through connected records and product features.
We call that information “Customer Personal Data.” Account administration and ServiceArc’s own support records are addressed in the Privacy Policy.
Customer determines why Customer Personal Data is processed. ServiceArc processes it on Customer’s behalf.
Where Customer acts for another controller, Customer confirms it has authority to appoint ServiceArc as a further processor.
2. Processing details
The purpose is to provide ServiceArc’s connected business-data, customer-list, scheduling, and booking features, including support and security.
Processing includes retrieving, storing, organizing, displaying, updating, returning, and deleting records. It lasts during service provision and the return or deletion process.
People covered include Customer’s customers, prospects, staff, contractors, and contacts whose information appears in connected records.
Data includes identifiers, contact details, service addresses and coordinates, notes, tags, job history, schedules, staff assignments, prices, balances, and saved work.
Original API responses can contain additional fields. Customer must limit connected information to what is necessary and authorized.
The service is not intended for regulated health records, full payment-card details, government identification numbers, or unrelated sensitive information.
3. Customer instructions
The agreement, account settings, connected integrations, confirmed actions, and verified support requests document Customer’s instructions.
ServiceArc will process Customer Personal Data only on those instructions, unless applicable law requires otherwise.
If legally permitted, ServiceArc will notify Customer before processing required by law outside those instructions.
ServiceArc will notify Customer if an instruction appears to violate applicable data protection law and may pause that processing while the parties resolve it.
Customer is responsible for required notices, permissions, lawful grounds, and the accuracy and legality of its instructions.
ServiceArc will not sell Customer Personal Data, use it for advertising, or use it to train AI models.
4. Confidentiality and security
ServiceArc will limit access to people who need it for authorized work and are subject to confidentiality duties.
ServiceArc will maintain reasonable technical and organizational safeguards appropriate to the data and processing risks.
These include authenticated access, controls that limit access to account data, protected API credential storage, and encrypted network connections where supported.
Customer remains responsible for its credentials, authorized users, source-system permissions, and secure instructions. No safeguard eliminates every risk.
5. Service providers
Customer authorizes ServiceArc to use providers for the processing described below and their supporting providers where needed.
ServiceArc will require relevant providers to protect Customer Personal Data through contractual duties appropriate to their processing.
ServiceArc remains responsible for its processing obligations when it uses a subprocessor.
ServiceArc will give advance notice of new or replacement subprocessors that handle Customer Personal Data, allowing reasonable time for a data-protection objection.
The parties will try to resolve a reasonable objection. If they cannot, Customer may end the affected service before the provider starts processing its data.
Housecall Pro is Customer’s separately chosen source system. Customer’s agreement with Housecall Pro governs that provider.
- Supabase: database hosting, authentication, protected credentials, and backend processing of connected records.
- Vercel: application hosting, delivery of requested pages and data, and technical logs.
- Resend: account email delivery, including recipient addresses, confirmation and recovery messages, and delivery records.
- Stripe: subscription billing and payments, including billing contacts, company identifiers, payment information, and associated technical records.
- Google (Gmail): support correspondence, including Customer Personal Data that Customer chooses to include in a request.
- CARTO: map resources; browser requests disclose IP addresses and the geographic tiles required for the displayed area.
6. Requests and assistance
ServiceArc will help Customer respond to data access, correction, export, restriction, and deletion requests, taking account of the processing and available information.
If ServiceArc receives a request about Customer-controlled data, it will refer the request to Customer unless law requires another response.
ServiceArc will provide reasonable assistance with required security assessments, impact assessments, and regulator consultations related to its processing.
Customer should send instructions from an authorized contact. ServiceArc may verify authority before disclosing or changing data.
7. Personal data incidents
ServiceArc will notify Customer without undue delay after becoming aware of a breach affecting Customer Personal Data, subject to applicable law.
The notice will share available information about the incident, likely effects, response measures, and a contact for follow-up.
Information may arrive in stages as the investigation develops. ServiceArc will take reasonable steps to contain the incident and cooperate with Customer.
Customer determines its required notices to individuals or authorities, unless law assigns that duty to ServiceArc.
8. Data return and deletion
On termination or a verified instruction, ServiceArc will return or delete Customer Personal Data at Customer’s choice, unless law requires retention.
Requests are handled manually. Customer should request any export before deletion and identify the account and records covered.
ServiceArc will confirm the scope and timing and complete the request without undue delay, subject to applicable legal deadlines.
Deletion covers active imported records, related drafts and saved work, and connection credentials when the connection or account is closed.
Residual backup data remains protected until normal backup expiry. If restored, applicable deletion instructions must be reapplied before ordinary use.
Legally required retained data will be isolated from ordinary use and deleted when retention is no longer required.
Revoking Housecall Pro access alone does not request deletion. ServiceArc deletion does not remove source records held by Housecall Pro.
9. Verification and international processing
ServiceArc will provide information reasonably needed to demonstrate compliance with this Addendum.
Where applicable law requires an audit, the parties will arrange reasonable scope, notice, confidentiality, and safeguards for other customers’ information.
Processing may occur in the United States and other countries where the providers operate.
Where law requires a transfer mechanism, the parties must arrange it before the restricted transfer. This Addendum does not itself include standard contractual clauses.
10. Priority and contact
This Addendum controls conflicts with the Terms about Customer Personal Data. Other Terms, including permitted liability limits, continue to apply.
Nothing here reduces an individual’s rights or either party’s duties under applicable law.
Contact William Humble at whumble95@gmail.com for processing instructions, provider questions, or data requests.