Data processing addendum (plain language)

When you are a business user, this DPA applies to personal data in lookup inputs and results.

• Subject matter: validation, enrichment, monitoring of identifiers you submit.
• Duration: the life of your account plus deletion SLA (prototype: immediate on request).
• Nature: storage, matching, caching for 7 days, audit logging for sensitive products.
• Instructions: API calls and dashboard settings, including disabling sensitive products.
• Sub-processors: none for lookups by default. Notification email is sent by Resend when you save addresses in Settings. If you set vendor API keys, those vendors become your sub-processors.
• International transfers: lookup processing stays in the EU by default (processingRegion=EU). Notification email is handed to Resend in the United States.
• Security: hashed API keys, hashed passwords, HMAC webhooks.
• Assistance: export/delete endpoints; you handle data-subject requests for your end users.