Data Processing Agreement

Version 1.1. In effect from 10 September 2026. Changes from 1.0: Resend added to Annex III; Annex II sign-in measure updated.

1. When this applies, and who it is between

This agreement is between Appa Technologies Pty Ltd (ABN 71 654 768 984) of 4 Greenwood Place, Freshwater NSW 2096, Australia, trading as MakerBay, and the business that holds a MakerBay account.

It forms part of our Terms of Service and applies automatically from the moment you use MakerBay to hold information about your own customers. You do not need to sign anything for it to be in force. If your procurement process needs a countersigned copy, email support@makerbay.app and we will sign one.

Where this agreement and the Terms of Service disagree, this agreement wins on anything about personal data. Where the transfer clauses in Schedule A or B disagree with either, those win. That order matters and is not negotiable, because the transfer clauses are a standard form we are not permitted to vary.

2. Which of us is responsible for what

Data protection law splits responsibility between the party who decides what happens to personal data (the controller) and the party who handles it on their instructions (the processor). For your own customers’ details:

• You are the controller. You decided to record that person, you know why you hold them, and their relationship is with you.
• We are the processor. We store and handle that information to run the service you asked for, and for nothing else.

This is the reverse of your own account details — your name, your email, your billing — where we are the controller. Those are covered by our Privacy Policy, not this agreement.

If you are using MakerBay on behalf of somebody else, for example as a subcontractor to a property manager or under a franchise, then you are a processor too and we are your sub-processor. Tell us and we will put the right version of the transfer clauses in place; the wrong one is not a formality.

3. We act on your instructions

We process your customers’ personal data only on your documented instructions. Those instructions are this agreement, the Terms of Service, and your use of the features in the product. We will not use that data for our own purposes, sell it, share it for advertising, or use it to train any AI model.

If Australian law ever requires us to process it some other way, we will tell you before we do, unless that same law forbids us from telling you.

If we think an instruction from you would break data protection law, we will tell you. We are not your lawyer and this is not legal advice; it just means we will not quietly do something we think is wrong.

4. Who can see it

Everyone who can access your customers’ data is bound by a written confidentiality obligation, and access is limited to what the job needs.

In plain terms: MakerBay is a one-person company. The people with access are the founder and any contractor engaged to help, each under a signed confidentiality undertaking. Staff access to a workspace is recorded in an audit log the staff console cannot rewrite. We would rather tell you that than describe an access-management programme we do not have.

5. How we protect it

We keep appropriate technical and organisational measures in place, taking account of what the data is and what could go wrong. Annex II lists them, split honestly into what is in place today and what is planned with a date. We would rather you saw the second list than found it later.

6. Sub-processors

You give us general permission to use sub-processors. The current list is Annex III and is published at makerbay.app/subprocessors.

• We give you at least 30 days’ notice by email before adding or replacing one.
• You may object on reasonable data protection grounds. We will try to resolve it.
• If we cannot, you may stop using the affected part of the service and we will refund the unused part of what you have paid. No exit fee, no notice period.

We remain responsible to you for what our sub-processors do with your data, and each of them is under written terms at least as protective as these.

7. Helping you answer your customers

When one of your customers asks to see their data, correct it, or have it deleted, that request is yours to answer — you are the controller. The product is built so you can do it yourself: you can export a contact’s record, and erasing a contact removes their history, quotes, bookings, enquiries and reviews, telling you plainly what it kept and why.

Where the product cannot do what you need, we will help. Ask us in writing and we will acknowledge within 3 business days and give you substantive help within 10 business days. We do not charge for this at any reasonable volume.

If one of your customers contacts us directly, we will not answer for you. We will tell them to contact you, and tell you that they tried.

8. If there is a breach

We will tell you without undue delay, and within 48 hours of confirming a personal data breach affecting your data.

“Confirming” means established, not first suspected. We would rather spend two hours finding out whether something is real than start your clock on a false alarm. We will tell you:

• what happened and what kind of data was involved;
• roughly how many people and records are affected;
• what we think the consequences are;
• what we have done about it and what we suggest you do.

If we do not have all of that yet, we will send what we have and follow up rather than waiting until the picture is complete.

We chose 48 hours rather than the 24 you may see in other agreements because 48 is a number we can hit on a bad weekend, and a commitment we would miss is worse than an honest one. We will also give you reasonable help with data protection impact assessments and any regulator consultation, taking account of what we actually know.

9. Deleting or returning your data

You can export your data at any time while your account is open. When the account closes:

• Ask us to delete, and we delete within 30 days.
• If you do not ask, we delete after 90 days, so a change of mind is possible.

Four things survive that, and each for a reason we will stand behind:

• Invoices and payment records, for seven years, because Australian tax law requires it.
• Do-not-email records. If someone asked to stop receiving email, deleting that record would mean emailing them again. It is kept for their benefit, not ours.
• The staff audit log, which records which staff member accessed which workspace. It is deliberately unerasable, because a security log you can delete is not a security log.
• Backups. Our database keeps a rolling recovery window of about 35 days and it cannot be edited to remove one customer. Backups are encrypted, access-controlled, and stay covered by this agreement until they expire on their own.

10. Showing you we are doing this

We will give you the information you reasonably need to check we are meeting this agreement, and answer a security questionnaire once in any 12 months.

If that is genuinely not enough, you may audit us: on 30 days’ written notice, once in any 12 months, during business hours, under an NDA, at your cost, without access to any other customer’s data. You may also audit after a breach affecting you, or where a regulator requires it, without waiting for the annual window.

We are not SOC 2 or ISO 27001 certified. Amazon Web Services, who host everything, hold both, and we will point you at their current reports. We would rather say this plainly than let a page of security bullet points imply a certification we do not have.

11. Sending data outside your country

Your data is stored on Amazon Web Services in the United States, and accessed by us from Australia. Both facts matter, and there are two separate journeys to cover:

• From you to us. This is the one that needs clauses between you and us. Schedule A is the European Commission’s standard contractual clauses, and Schedule B is the UK addendum to them.
• From us to our sub-processors. Covered by the standard contractual clauses in our own agreements with Amazon Web Services and Stripe.

A vendor telling you their cloud provider’s clauses cover both is telling you something that is not true. Our own privacy policy said it until August 2026, and we corrected it.

We have assessed the laws of the United States and Australia against these transfers. Ask and we will send you that assessment. Its short version: the data is low-volume and low-sensitivity, we have never received a government access request, and we will tell you if we do unless we are legally forbidden.

12. Australia

As an Australian company we handle personal information in line with the Australian Privacy Principles, whether or not the small business exemption applies to us. Schedule C covers the specifics, including the Notifiable Data Breaches scheme, which runs on a different clock from the European rules and which we track separately.

13. Liability, changes and law

• The liability limits in section 10 of the Terms of Service apply here too, except where the transfer clauses in Schedules A and B say otherwise. Those clauses give your customers rights directly against us that cannot be capped, and we are not trying to cap them.
• We will post a new version here with a new date, and email you at least 30 days before a material change.
• This agreement is governed by the law of New South Wales, Australia. The clauses in Schedule A are governed by Irish law and Schedule B by the law of England and Wales, because those clauses require it. We cannot change that and neither can you.
• We review this agreement at least once a year.

Annex I — What is actually processed

Exporter: you, the business holding the MakerBay account, acting as controller.

Importer: Appa Technologies Pty Ltd, acting as processor, in Australia, storing data in the United States.

People whose data is involved: your customers and enquirers, and any staff you invite.

What we hold about them:

• Name, email address, phone number, and a service address where there is a job at one.
• What they asked for, what you quoted, what they were invoiced, and what they paid.
• Appointments and their history.
• Messages between you and them, including conversations with the assistant on your page.
• Whether an email reached them, bounced, or was reported as spam.
• Where missed-call rescue is switched on: call recordings, kept 30 days, and transcripts, kept 90 days.

Sensitive information. The service is not designed for health, biometric or other special category data, and you should not use it to collect any. We recognise that a job note reasonably says “wheelchair access, use the side ramp”, and that this is health data arriving in a free-text box. Anything of that kind you enter is processed under the same protections as everything else. We would rather write that down than pretend a plumber never writes it.

How often: continuously, for as long as your account is open.

Why: to provide the booking, quoting, invoicing, messaging and review features you have switched on.

How long: as set out in clause 9.

Annex II — Security measures

In place today.

• Encrypted in transit (TLS) and at rest, across databases and file storage.
• Every stored record is scoped to one workspace, enforced in a single shared data layer with automated tests covering it.
• Point-in-time recovery on customer data, and tables configured so that tearing down our infrastructure cannot delete your data.
• No passwords are held for customer accounts. Sign-in is by a one-time emailed code or a device-bound passkey with user verification required. Accounts created before September 2026 may retain a password in Amazon Cognito, never seen or stored by us.
• The staff console runs on a separate identity system from the customer app, so a customer login cannot become a staff login even if something else goes wrong.
• Staff status is checked live on every request, so removing someone takes effect in about a minute rather than whenever their session expires.
• An append-only staff audit log. The service that writes it has permission to add rows and no permission to change them.
• Rate limiting on public endpoints, and per-business caps on outbound email.
• Assistant conversation data expires automatically after 90 days; call recordings after 30.
• Application logs are kept 12 months and then deleted.
• No third-party analytics, advertising trackers or cookies anywhere, including on the pages your customers see. Fonts are served from our own servers rather than Google’s.
• AI inference runs inside our own cloud account. No customer content trains any model.

Planned, with dates. Not in place today.

• Role-based limits on staff access — by 31 October 2026. Staff roles are recorded and audited but not yet enforced per action, so any staff member can currently reach any workspace. With one person that is a smaller risk than it sounds, but it is not the same as least privilege and we will not describe it as such.
• Infrastructure-level access logging and threat detection — by 31 October 2026.
• An alert on unusual staff access volume — by 31 October 2026.
• A written, tested incident response runbook — by 30 November 2026.
• Independent penetration testing. Not scheduled. We will commission one before we reach 250 paying businesses, and say so here when we do.

Annex III — Sub-processors

On AI: the assistant uses a Claude model from Anthropic, run inside our own Amazon Web Services account through Amazon Bedrock. Anthropic does not receive your data and is not a sub-processor. We name them here because the honest answer to “whose model is it?” is more useful than silence.

Schedule A — EU standard contractual clauses

Where you are established in the European Economic Area, or your processing is otherwise subject to the EU GDPR, the European Commission’s standard contractual clauses of 4 June 2021 (Decision 2021/914) are incorporated into this agreement, using Module Two, controller to processor, with:

• Clause 7, the docking clause, included.
• Clause 9, sub-processors: Option 2, general written authorisation, with a 30-day notice period, matching clause 6 above.
• Clause 11, the optional independent dispute resolution paragraph: not included.
• Clause 17, governing law: the law of Ireland.
• Clause 18(b), forum: the courts of Ireland.
• Annex I, II and III of those clauses are Annexes I, II and III of this agreement.

Where you act as a processor for someone else, Module Three applies instead of Module Two. Tell us and we will execute it.

Schedule B — UK transfers

Where you are established in the United Kingdom, or your processing is subject to the UK GDPR, the Information Commissioner’s International Data Transfer Addendum (version B1.0, in force 21 March 2022) is incorporated, attached to the clauses in Schedule A, with:

• Table 1: the parties named in clause 1 and Annex I.
• Table 2: the clauses in Schedule A, Module Two.
• Table 3: Annexes I, II and III of this agreement.
• Table 4: neither party may end the addendum under section 19.

For UK transfers the addendum substitutes UK law, the UK courts, and the Information Commissioner’s Office in place of the Irish equivalents in Schedule A.

Schedule C — Australia

• We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth), whether or not the small business exemption applies to us. We do not intend to rely on that exemption.
• For Australian Privacy Principle 8, the overseas recipients are those in Annex III, in the United States and Ireland, and we accept accountability for their handling under section 16C.
• Under the Notifiable Data Breaches scheme we will assess a suspected eligible breach within 30 days and notify the Office of the Australian Information Commissioner and affected individuals where serious harm is likely. This runs alongside, not instead of, the 48-hour notice to you in clause 8, and we track both clocks.
• No decision producing a legal or similarly significant effect on any individual is made by automated means. The assistant answers questions and takes booking details; a person decides about the work.
• Complaints may be made to us at support@makerbay.app, and to the Office of the Australian Information Commissioner.

Contact

Data protection questions, requests and notices: support@makerbay.app, or Appa Technologies Pty Ltd, 4 Greenwood Place, Freshwater NSW 2096, Australia.