Right HandThis Data Processing Addendum ("DPA") is part of the Right Hand Terms of Service (the "Terms") between Revive Flow LLC, doing business as Right Hand ("Right Hand," "we"), and the subscribing business ("Subscriber," "you"). You accept it when you accept the Terms. Words defined in the Terms mean the same here.
In plain English: your clients' and employees' data belongs to you. We handle it only to run Right Hand for you. We keep it secure, use only vetted subprocessors, tell you fast if something goes wrong, help you answer privacy requests, and delete it when you leave.
1. Roles
1.1 For personal information in Your Data ("Subscriber Personal Data"), you are the controller (or "business") and Right Hand is your processor (or "service provider" or "contractor") under applicable US state privacy laws. These laws include the California Consumer Privacy Act as amended (CCPA), and the Virginia, Colorado, Connecticut, Texas, Oregon, Florida, and similar state laws (together, "Privacy Laws").
1.2 For account, billing, security, and usage data about your Users, Right Hand acts as an independent controller under its Privacy Policy.
2. What we process, and why
| Item | Detail |
|---|---|
| Subject matter | Providing the Service under the Terms |
| Duration | The subscription, plus the export and deletion periods in Section 9 |
| Nature and purpose | Hosting, storing, organizing, and displaying the data. Sending and receiving calls, texts, and emails. Recording and transcribing calls. AI processing to answer, summarize, draft, and book. Payment records. Syncing integrations you connect. Support. Security |
| People | Your clients, leads, and callers. Your employees, crew, and subcontractors. Your Users |
| Data types | Contact details and service addresses. Property notes and photos. Quotes, jobs, invoices, and payment records (no full card numbers). Call recordings, transcripts, and summaries. Text messages and emails. Employee time records, clock-in location, and vehicle or phone GPS location while working. HR paperwork, including signatures, new-hire forms, injury reports, and write-ups. Receipts |
| Sensitive data | Precise geolocation of employees. Injury and health details in HR paperwork, if you store them. Account log-ins. Process these only as the features you turn on require |
3. Our commitments as processor
We will:
a) Process only on your documented instructions. The Terms, your settings, and your use of the Service are your instructions. We will tell you if we believe an instruction breaks Privacy Laws.
b) Not sell or share Subscriber Personal Data, as those words are used in the CCPA.
c) Not retain, use, or disclose it for any purpose other than providing the Service, or outside our direct business relationship with you. The only exceptions are what Privacy Laws allow, such as security, fixing errors, and legal compliance.
d) Not combine it with personal data from other sources or other customers, except as Privacy Laws allow to provide the Service.
e) Not use it to train general-purpose AI models. We will use AI providers only under terms that do not permit them to train their models on Subscriber Personal Data.
f) Make sure people who process it are bound to confidentiality.
g) Comply with Privacy Laws as they apply to processors, give the same level of privacy protection they require, and tell you if we can no longer meet our obligations. If we do, you may take reasonable steps to stop unauthorized processing.
h) Let you take reasonable steps to make sure we process data as these terms require. That includes the information in Section 8.
i) Create de-identified or aggregated data only in a way that can't reasonably be linked back to a person or to you. We will publicly commit not to re-identify it, and require any recipient to commit to the same.
4. Your commitments
You confirm and agree that:
- you have a lawful basis, and have given every notice and obtained every consent needed, for us to process Subscriber Personal Data as the Service does. That includes recording and transcribing calls, AI participation in calls, texting, email, and employee time and location tracking (Terms, Section 6).
- your instructions comply with the law.
- you will not send us data the Terms forbid, such as Social Security numbers, full card or bank numbers, or medical records outside features built for them.
- you are responsible for answering people's privacy requests about Subscriber Personal Data.
5. Subprocessors
5.1 You authorize us to use the subprocessors on our Subprocessors page. We have a written contract with each one that protects Subscriber Personal Data at least as well as this DPA. We remain responsible for their work.
5.2 We will tell you about any new subprocessor at least 15 days before it starts processing Subscriber Personal Data. We do that by updating the page and emailing account owners who subscribe to updates (owners are subscribed by default).
5.3 You may object on reasonable data-protection grounds within that period by emailing privacy@righthandcrm.com. If we can't address the objection, you may cancel the affected part of the Service and get a prorated refund of prepaid fees for it.
5.4 Third-Party Services you connect (for example, your QuickBooks, Google, Meta, Zapier, GPS provider, or your own Stripe account) are not our subprocessors. They are your own vendors, and you direct those transfers.
6. Security
6.1 We maintain reasonable administrative, technical, and physical safeguards appropriate to the risk. These include:
- Encryption: in transit (TLS 1.2+) and at rest (through our hosting and database providers).
- Company separation: database rules, so one subscriber can never read another's data.
- Least-privilege access: for our staff, with multi-factor authentication and access logging.
- Password hashing: salted hashes, plus sign-in rate limits and lockout.
- Backups and recovery: regular backups and tested restore procedures.
- Vendor review: a review of each vendor's security before we use them.
- Incident response: a written incident response process.
6.2 We may improve these measures over time, but we will not materially reduce the overall protection.
7. Security incidents
7.1 If we confirm a breach of security that leads to unauthorized access to, or loss, change, or disclosure of, Subscriber Personal Data in our systems or our subprocessors' systems (a "Security Incident"), we will notify you without undue delay, and where feasible within 72 hours of confirming it.
7.2 We will tell you, as the information becomes available:
- what happened
- the data and people likely affected
- the likely consequences
- what we have done and will do
- a contact person
7.3 We will reasonably help you meet your own legal notice duties to individuals, regulators, and others. Unless the law requires it, we will not notify your clients or employees directly without talking to you first.
7.4 Our notice is not an admission of fault.
8. Help with requests, assessments, and audits
8.1 Privacy requests. The Service lets you find, export, correct, and delete people's data. If you need more help with a person's request, we will provide reasonable assistance. If we receive a request directly, we will send it to you and not answer it ourselves, unless the law requires otherwise.
8.2 Assessments. We will give you information you reasonably need for a data protection assessment the law requires.
8.3 Audits. Once a year, on 30 days' written notice, we will answer a reasonable written security questionnaire. We will also share summaries of our subprocessors' independent audit reports (such as SOC 2) that we are allowed to share. An on-site audit happens only if the law requires it, or after a Security Incident. It must be at your cost, under confidentiality, at a mutually agreed time, and must not disrupt the Service.
8.4 Government requests. If a government or law-enforcement agency asks us for Subscriber Personal Data, we will try to redirect it to you, require valid legal process, challenge requests that are overbroad or improper, and tell you promptly before we disclose, unless the law or a court order forbids it or there is an emergency involving danger of death or serious injury. See Security, Section 11.
9. Return and deletion
When your subscription ends:
- you have 30 days to export Subscriber Personal Data with the Service's export tools
- after that, we delete it from the live Service within 60 days
- backups expire within 35 days after that
We may keep data the law requires us to keep, such as billing records and text opt-out records. While we keep it, we protect it under this DPA and use it for no other purpose. You can ask in writing for earlier deletion.
10. Location of processing
We process and store Subscriber Personal Data in the United States. If a subprocessor processes any of it outside the US, we will make sure appropriate contractual protections are in place.
11. Liability and priority
11.1 Each party's liability under this DPA is subject to the limits in the Terms. Your indemnity obligations under the Terms are not affected.
11.2 If this DPA conflicts with the Terms about Subscriber Personal Data, this DPA controls.
11.3 This DPA ends when we no longer hold any Subscriber Personal Data.
12. Health information
The Service is not designed for protected health information under HIPAA. We are not your business associate. Don't use the Service to store protected health information. Injury reports for workers' compensation are handled as employment records under the Terms, not as HIPAA records.
Contact
Privacy: privacy@righthandcrm.com · Revive Flow LLC, doing business as Right Hand, ADDRESS