Data Processing Addendum
Effective [DATE OF LAUNCH] · Draft prepared 2026-10-25 for legal review
This Data Processing Addendum ("DPA") forms part of the agreement between Carmotive LLC, a Michigan limited liability company doing business as Opensign ("Opensign", "Processor"), and the business that uses Opensign ("Business", "Controller") (the "Agreement"). It applies to personal data that Opensign processes on the Business's behalf ("Business Personal Data").
1. Roles and scope
The Business is the controller of Business Personal Data and Opensign is its processor. Opensign processes Business Personal Data only to provide, secure and support the service described in the Agreement, and only on the Business's documented instructions, which are the Agreement, this DPA and the Business's use and configuration of the service.
2. Details of processing (Annex 1)
- Data subjects: the Business's customers and prospects, its staff and contractors, and its suppliers' contacts.
- Categories: contact details; order, booking, quote, invoice and payment records (payment card and bank numbers stay with the payment processor); messages, call records and recordings where the Business turns them on; vehicle and unit records (VIN, stock number, title details); service and work orders, photos and inspections; reviews; staff account and sign-in records; for rentals, leases and tenant records.
- Special categories: none are required by the service. A Business in a regulated field (for example health care) must not put such data into Opensign unless a separate agreement covers it. [CONFIRM: HIPAA / BAA position for healthcare tenants.]
- Duration: the term of the Agreement plus the return and deletion period in section 9.
3. Confidentiality
Everyone at Opensign who can access Business Personal Data is bound by confidentiality, and access is limited to what each role needs.
4. Security (Annex 3)
- Hosting on Cloudflare's network; encryption in transit (TLS) and Cloudflare-managed encryption at rest.
- Logical separation of each Business's data; every query is scoped to one Business.
- Role-based staff access; Google sign-in with a second factor (authenticator) for administrator access to the platform.
- Audit logs of changes to records and settings.
- Scheduled backups to a separate storage provider, encrypted, with restore testing. [CONFIRM backup encryption + frequency wording]
- Abuse and fraud controls on public forms (rate limits, bot checks).
5. Sub-processors (Annex 2)
The Business authorises the sub-processors below. Opensign will give at least 30 days' notice of a new sub-processor by email; the Business may object on reasonable data-protection grounds, and if no solution is found may end the affected service. Opensign stays responsible for its sub-processors.
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, compute, databases and file storage | United States / global edge |
| Resend (Plus Five Five, Inc.) | Transactional email delivery | United States |
| Twilio Inc. | Text messaging and phone numbers | United States |
| Helcim Inc. | Card and bank payments, pay links | Canada / United States |
| Google LLC | Sign-in, calendar, maps and business lookup, Google listings and feeds the Business turns on | United States |
| Meta Platforms, Inc. | Facebook and Instagram listings and messages the Business connects; ad measurement | United States |
| Anthropic, PBC | AI drafting of replies, estimates and listings (where enabled) | United States |
| Backblaze, Inc. | Encrypted backups | United States |
| [CONFIRM] Quo (OpenPhone) / others per tenant | Calls and texts where the Business uses them | United States |
6. Assistance
Opensign will help the Business answer data-subject requests (access, correction, deletion, portability), through the service's export and delete tools and, where needed, by request to [email protected], and will reasonably assist with security, breach notification and data-protection assessments.
7. Personal data breach
Opensign will notify the Business without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting Business Personal Data, with the information reasonably available, and will update it as more is known.
8. Audits
On reasonable request, and no more than once a year unless a breach or a regulator requires it, Opensign will make available the information needed to show compliance with this DPA, including written answers to security questionnaires.
9. Return and deletion
When the Agreement ends, the Business can export its data for 30 days. After that Opensign deletes Business Personal Data from the live service within 30 days and from backups as they expire (within 90 days), except where the law requires Opensign to keep it. [CONFIRM periods]
10. International transfers
Business Personal Data is processed in the United States. Where data of individuals outside the United States is involved, the parties will rely on an appropriate transfer mechanism. [CONFIRM if serving non-US customers]
11. Order of precedence
If this DPA and the Agreement conflict on the processing of Business Personal Data, this DPA wins.
Carmotive LLC (Opensign), 4675 E Grand River Ave, Howell, MI 48843 · [email protected]