Data Processing Addendum

Effective date: October 25, 2026

This addendum is part of the ScanSticker Go Terms of Service between ScanSticker LLC, a Virginia limited liability company ("ScanSticker", "we"), and the business that uses ScanSticker Go (the "Company", "you"). It covers the personal data of the Company's customers that ScanSticker handles to run the service for the Company.

1. Definitions

1.1 "Customer" means a business or person the Company serves, including parent and child customers.

1.2 "Customer Personal Data" means personal data about the Company's Customers, their contacts, and anyone who sends a request through a ScanSticker sticker (or a customer page, once offered), that is put into ScanSticker Go and that ScanSticker handles for the Company.

1.3 "Subprocessor" means a company ScanSticker uses that handles Customer Personal Data to help run the service.

1.4 "Security Incident" means a breach of security that leads to the accidental or unlawful loss, change, disclosure of, or access to, Customer Personal Data.

1.5 "Data Protection Laws" means the United States federal and state laws on personal data that apply to this processing. ScanSticker Go is offered in the United States only.

2. Roles and instructions

2.1 The Company decides why and how its Customers' personal data is used. ScanSticker handles Customer Personal Data only on the Company's behalf and on its instructions.

2.2 The Company's instructions are this addendum, the Terms of Service, and the choices the Company makes in the app: its settings, the team members it invites, which emails are on, which manuals it shares with the library, and what it enters. Other instructions need written agreement.

2.3 ScanSticker will tell the Company if it believes an instruction breaks a Data Protection Law, and may decline to follow it.

2.4 The Company is responsible for having the right to collect the data it enters, giving its Customers any privacy notice the law requires of it, keeping contact details accurate so that emails and private links reach the right people, removing Customer details from any manual before sharing it with the library, and not entering data the service does not need (Social Security numbers, health information, full card or bank account numbers, passwords).

2.5 ScanSticker handles some data for its own purposes, outside this addendum: the Company's account and subscription records, team members' sign-in details, records of ScanSticker's 0.5% fee on in-app payments, security records, and the shared manual library, the parts library and the list of makes (Manual Library and Copyright Policy). The ScanSticker Go Privacy Policy covers that data.

3. Scope of processing

3.1 Duration. While the Company uses ScanSticker Go, and for the periods in section 9.

3.2 People whose data is involved: contacts at the Company's Customers, including parent and child Customers and households where the Company serves homes; people who send a request from a sticker, who may not be a contact on file; and team members named on jobs and history.

3.3 Kinds of data:

1. names, business names, email addresses, phone numbers, service site and billing addresses;
2. service requests: the description (and a photo, if the request form later takes one), the requester's name and email or phone number, the time and the source;
3. equipment at Customers' sites, its location, specs, parts, photos of the unit and its nameplate, service history, work summaries and internal notes;
4. estimate approvals, once offered, given only on the Customer's own device: the agreement to sign electronically, the typed "Approved by" name, the date and time, the method, the exact version approved and the contact the link went to;
5. invoices and payments: lines, tax, totals, status, method, and, if saved cards are offered, a saved card's brand, last four digits and expiry;
6. tax exemption certificates, attached documents, and a customer's signature on completed work where the Company requires one;
7. email delivery records and, once customer pages are offered, the history of each customer page link;
8. network addresses, held briefly to limit abuse of the public request form.

3.4 Purposes. ScanSticker uses Customer Personal Data only to: receive and route service requests; keep Customer, site and equipment records; schedule jobs and keep service history; issue invoices and take payments through the Company's Stripe account, and, as those features are offered, send estimates, record approvals and take deposits; send the Company's transactional emails to its Customers; show each Customer its private customer page once that is offered; push records to the Company's QuickBooks Online company if that connection is offered and the Company connects it; give support the Company asks for; keep the service secure and working; and meet legal duties.

3.5 ScanSticker will not sell Customer Personal Data or share it for advertising, send marketing to the Company's Customers, show one Company's Customer records to another, use Customer Personal Data to train artificial intelligence models or let a Subprocessor do so, or disclose it except as this addendum allows or the law requires.

3.6 The libraries. Manuals the Company shares with the library, and part numbers and descriptions it adds to units, are shared with other Companies under section 9 of the Terms of Service. They are not meant to contain Customer Personal Data: the library keeps only the file, its type, make and models, and the parts library keeps only the part number, description, make and model, never prices, costs, quantities, the Company's name, customers, sites, serial numbers or notes. If a shared manual is found to contain Customer Personal Data, ScanSticker removes it from the library.

3.7 Parts pages are read on the iPhone with Apple's text recognition, and that photo is not sent to ScanSticker or anyone else for reading. Nameplates are read the same way unless ScanSticker has switched on reading by its server: then the app sends the nameplate photo to ScanSticker, which sends only that image to Anthropic's Claude API, never the Company's name, the Customer, the site or anything typed, and the app reads on the iPhone if that reading is off or fails. The only AI service used is Anthropic's Claude API, for that nameplate reading, for automated checks of manuals shared with the library, and for finding links to manufacturers' manual pages (section 4.1); each is switched off until ScanSticker turns it on. The checks receive the shared manual file, its type, make and models; the file should contain no Customer Personal Data but may if a Company uploads one with customer details, and finding customer details is one purpose of the checks. The finder receives only make, model and sometimes the equipment type.

3.8 Card and bank numbers are entered on Stripe's payment fields and never reach ScanSticker's servers.

4. Subprocessors

4.1 The Company authorizes ScanSticker to use these Subprocessors:

4.2 Location. ScanSticker's database is in a United States region (eastern United States), and its file storage is in Cloudflare's Eastern North America region. Other Subprocessors may process data in other countries under their own terms.

4.3 The Company's own accounts. The Company opens its own new Stripe account through ScanSticker Go and is the merchant, and a QuickBooks company, if the Company connects one, belongs to the Company. Data in those accounts is also governed by the Company's own agreements with Stripe and Intuit, and ScanSticker cannot delete it.

4.4 ScanSticker has written terms with each Subprocessor that require it to protect Customer Personal Data and use it only to provide its service, and stays responsible for each Subprocessor as the law requires.

4.5 Changes. ScanSticker will give at least 30 days' notice before adding or replacing a Subprocessor, by email to the owner and in the Privacy Policy. The Company may object on reasonable data protection grounds. If ScanSticker cannot resolve the objection, the Company may end its subscription, and ScanSticker refunds the unused part of a month already paid.

5. Confidentiality and people

5.1 Only ScanSticker staff and contractors who need access get it, after signing an intellectual property and confidentiality agreement. Access is per person, at the lowest level the task needs, and removed the day the work ends.

5.2 ScanSticker's staff console shows a Company's account details, never its Customers, sites, equipment, jobs, requests or invoices, and has no way to open them. ScanSticker staff look at a Company's records only to give support the Company asks for, to keep the service secure and working, or when the law requires.

6. Security measures

1. Tenant isolation: every record belongs to one Company, checked by the server on every read and write.
2. Roles: technicians see only their own jobs; only the owner and admins will be able to charge a saved card, if saved cards are offered.
3. Public pages (and the customer page, once offered) receive only customer-safe fields, left out of the server's response rather than hidden; never internal notes, costs, part numbers or manuals.
4. Emailed links are long and random, expire (customer page links, once offered, after 90 days), and can be switched off.
5. Card and bank numbers are handled by Stripe only.
6. Encryption in transit (HTTPS) and at rest by the database and file storage providers.
7. Two-step verification on every ScanSticker provider account; no shared logins.
8. Important changes record who and when. Money records are corrected only by a void, reversal or refund with a reason.
9. Rate limits on the public request form.
10. Backups through the database provider's point-in-time restore history.
11. A written security incident plan, kept up to date.
12. An optional Face ID lock when the app is reopened, an owner setting, off by default. Face ID runs on the iPhone, and ScanSticker receives no face data.

The Company keeps its team's phones locked, removes team members who leave, and, once customer pages are offered, sends their links only to contacts on file.

7. Security incidents

7.1 ScanSticker will notify the Company without unreasonable delay, and no later than 72 hours after ScanSticker confirms a Security Incident affecting the Company's Customer Personal Data, by email to the owner.

7.2 The notice says, as far as known, what happened, which data and how many Customers are affected, what ScanSticker has done, and whom to contact. Updates follow.

7.3 The Company decides whether to notify its Customers and any authority, unless the law places that duty on ScanSticker, and ScanSticker gives the information the Company reasonably needs. ScanSticker will not contact the Company's Customers about an incident unless the Company agrees or the law requires it.

7.4 Failed attempts that expose nothing, such as blocked sign-in attempts, need no notice. A notice is not an admission of fault.

8. Help with requests from the Company's Customers

8.1 The Company can view and correct its records. Once the app offers them, it can also export its records, archive a Customer and delete an archived Customer (section 9.2).

8.2 If a person contacts ScanSticker about Customer Personal Data, ScanSticker will pass the request to the Company within 10 business days and tell the person. ScanSticker will not answer for the Company unless asked or required by law.

8.3 ScanSticker gives other reasonable help the Company needs to answer requests or complete a risk assessment the law requires, at no charge for help the app does not already provide, unless the request is unusual in size.

8.4 Limit. Invoices, payments, signed estimate approvals and the exemption certificates that support exempt invoices are not deleted when a Customer is deleted. They stay as locked records. Each invoice carries what it needs to stand alone, such as names, addresses, lines, tax and the work summary, and each approval keeps the approved estimate, the approver's name, the time and the method. A deletion request cannot remove them while they must be kept.

9. Deletion and return

9.1 Export. Export is not available in the app yet. Once it is, the owner and admins can export the Company's records at any time, and the owner is emailed each time. When the free trial ends without a subscription, or a subscription payment still fails after a grace period of 14 days, the app becomes read-only (with export, once offered); requests still arrive, and customers can still pay through links already sent.

9.2 Archived and deleted Customers. Archiving and deleting Customers are not offered in the app yet; once they are, they work as follows. A Customer cannot be archived while it has an open job, an unpaid invoice, a pending bank payment or active child Customers. An archived Customer is read-only and is never deleted automatically, whether or not the Company is paying; the owner or an admin can restore it at any time. While it is archived, its customer page links end and its stickers show a neutral "not in use" page. Only an archived Customer can be deleted, by the owner or an admin, after a warning and a typed confirmation; it is then held for 30 days, during which it can be restored. The 30 days pause while the Company's account is read-only and resume when it pays again. After the 30 days, its record, sites, equipment, photos, notes, jobs, requests, estimates and documents are deleted, except its invoices, payments, signed estimate approvals and the exemption certificates that support exempt invoices (section 9.4). Its stickers then become Voided. Sticker codes are never reused.

9.3 Lapse and deletion of the Company. A read-only Company, whether its trial ended or its subscription lapsed, does not start deletion. Nothing is deleted for nonpayment: ScanSticker keeps the Company's records, read-only, so that a Company that subscribes finds all its data as it left it, until it subscribes or the owner deletes the Company. The app does not yet let the owner delete the Company. The owner may ask for the Company to be closed and its records deleted at any time, including while it is read-only, by emailing support@scansticker.com. ScanSticker then deletes Customer Personal Data from the live system, and it leaves the database provider's restore history within 35 days as that history expires, except the records kept under 9.4.

9.4 Records kept. Invoices, payments, signed estimate approvals and the exemption certificates that support exempt invoices are kept as locked records and are not deleted automatically. Kept records are used only for that purpose and stay protected under this addendum.

9.5 Data in the Company's own Stripe account, and in its QuickBooks company if connected, stays there.

9.6 Manuals and part data shared with the libraries stay there under the Terms of Service, section 9.4, after the Company deletes its own copies or leaves. A shared manual found to contain personal data is removed.

10. Audits within reason

10.1 Once a year, on written request, ScanSticker will answer a reasonable written security questionnaire and share summaries of its providers' security reports where those providers allow it.

10.2 Where a Data Protection Law requires more, or after a Security Incident, the parties will agree in writing on scope, at least 30 days' notice, confidentiality and business hours. Each party bears its own costs of an audit. An audit never reaches another Company's data or a provider's facilities.

10.3 ScanSticker holds no independent security certification.

11. Other terms

11.1 If this addendum and the Terms of Service conflict on Customer Personal Data, this addendum controls.

11.2 The limits of liability in section 17 of the Terms of Service apply to this addendum.

11.3 This addendum is governed by the laws of the Commonwealth of Virginia, and disputes about it are resolved as section 21 of the Terms of Service provides (arbitration, with its exceptions).

11.4 ScanSticker may update this addendum when a law changes, with 30 days' notice to the owner.

11.5 Contact: support@scansticker.com, ScanSticker LLC, 1657 Chenier Arch, Apt 104, Virginia Beach, VA 23451.