Data Processing Agreement

This agreement covers the personal data of your clients that we process when you use Patron. You decide what to collect and why, so you are the data controller (and, for the CCPA, the “business”). We process it only to run the service for you and on your instructions, so we are the processor (the CCPA “service provider”).

Your use of Patron in line with the Terms and the Privacy Policy is your documented instruction to us. We won't process your clients' data for our own purposes, and we never sell it or your clients.

Categories of data: your clients' contact and identity details (name, email address, Instagram or WhatsApp handle), the messages they send you through a booking page or by email, the reference links they paste and the photos they attach, appointment and pricing records, and, if you use the waiver, the consent answers, date of birth, and any health details a client chooses to disclose.

Data subjects: the clients and prospective clients who contact your studio or book through it.

We will: process your clients' data only to provide the service and on your instructions; keep it confidential and limit access to staff who need it; and maintain appropriate security (encryption in transit, hashed passwords, access controls, and hosting with an infrastructure provider that maintains an independently validated security program).

We'll help you meet your own obligations (responding to data-subject requests, doing impact assessments, and demonstrating compliance) with information reasonably available to us.

You handle requests from your clients to access, correct, delete, or port their data. It's your relationship and your record. If a client contacts us directly about data we hold for you, we'll route them to you and give you reasonable assistance to respond.

If we become aware of a breach affecting your clients' personal data, we'll notify you without undue delay and share what we know so you can meet any notification duties you have.

We use service providers to run Patron. The ones that touch your clients' data today are Supabase (the database and file storage), Vercel (hosting the app), Resend (the email Patron sends for you, and the client email arriving at your studio's Patron address, which Resend holds for 30 days), Netlify (the marketing site and its sign-up form), and Google (Analytics, and only if you switch it on for your public page). Stripe joins the list when in-app payments go live. Each is bound to protect the data and use it only to provide their service to us.

We'll give you notice before adding or changing a sub-processor, and you may object on reasonable data-protection grounds; if we can't resolve it, you may stop using the affected feature.

[To be finalized with counsel: a signed annex naming each provider's role and processing location.]

Patron and its providers may process data in other countries. Where required, we use an appropriate transfer safeguard.

[To be finalized with hosting: the specific mechanism, meaning EU Standard Contractual Clauses and the UK Addendum where applicable.]

You confirm you have a lawful basis to collect your clients' data and to give it to us, and that you've provided any notices and obtained any consents your clients need, especially for the sensitive health details a waiver can collect. How you handle your clients lawfully is on you, not on Patron.

While your account is active, your clients' data stays available to you in Patron. When your account closes, we delete or return it in line with the retention terms in the Privacy Policy, except where the law requires us to keep it.

This DPA is part of the Terms; by using Patron to process your clients' data, you accept it. If it conflicts with the Terms on data protection, this DPA controls. It's governed by the laws of the State of New York, United States, and any disputes will be handled in its courts.

Questions, or need a signed copy for your records? Email support@patron.ink.