WebMade
Version dpa-2026-10-18
Data Processing Addendum
1. Who does what
"You" are the business that uses WebMade. "WebMade" is WebMade, the provider of your website, booking, ordering, front-desk, messaging, reviews, rewards, marketing and bookkeeping services. For the personal data of your customers, staff and leads that WebMade handles to provide those services ("Client Personal Data"), you decide why and how it is used, and WebMade processes it on your behalf. Under state privacy laws you are the "controller" or "business", and WebMade is your "processor" or "service provider".
2. What WebMade processes
| What | Examples |
|---|---|
| People | Your customers, leads and website visitors; your owners, managers and staff. |
| Data | Names, phone numbers, email and street addresses; bookings, orders, payments and refunds as your Square account reports them; messages, call recordings and transcripts from your front desk; feedback, review clicks, rewards points and tips; text and email consent and opt-outs; job photos you add; bookkeeping records if you turn WEBY Bookkeeping on. |
| Purpose | Only to provide the services you signed up for, to keep them secure, and as the law requires. |
| How long | While you use WebMade, then as section 9 says. |
Payment card numbers stay with Square. WebMade never receives or stores them.
3. Only on your instructions
WebMade processes Client Personal Data only on your documented instructions. Your use and settings of the services, these terms and your requests to WebMade are your instructions. WebMade will tell you if it believes an instruction breaks the law, and does not have to follow it. WebMade does not:
- sell or share Client Personal Data, or use it for targeted advertising across other businesses;
- use it for any purpose other than providing the services to you, or outside its direct business relationship with you;
- combine it with personal data from other clients or other sources, except as the law allows a service provider to do;
- use it, anonymized or not, to train or otherwise improve any AI model or system.
4. Your responsibilities
You confirm that you have the right to give WebMade the Client Personal Data, that you have given any notice and obtained any consent the law requires (including prior express written consent before WebMade sends marketing or review-request texts for you), and that your instructions comply with the law.
5. Confidentiality
Everyone at WebMade who can access Client Personal Data is bound by a duty of confidentiality and accesses it only as needed to provide the services.
6. Security
WebMade uses reasonable administrative, technical and physical safeguards suited to the data, including encryption in transit, access limited by role, separate storage for each client's records where the services allow, logged changes, and daily backups of your website.
7. Subprocessors
You authorize WebMade to use these subprocessors, each under a written contract with data protection obligations at least as protective as this addendum:
| Subprocessor | What it does |
|---|---|
| Supabase | Database and file storage |
| Vercel | Hosting, and the AI Gateway that routes AI requests |
| Anthropic | AI model for WEBY's answers, through the AI Gateway |
| Twilio | Text messages and phone numbers |
| Vapi | Voice for the WEBY Front Desk phone line |
| Resend | Email delivery |
| Square | Your payments, bookings and catalog, in your own Square account |
| Plaid | Read-only bank connections, only if you turn on WEBY Bookkeeping and connect a bank |
| Your Google Business Profile, Search Console and Analytics, only if you connect them |
WebMade will tell you by email at least 30 days before adding or replacing a subprocessor. If you object on reasonable data protection grounds, tell us within that time; if we can't resolve it, you may cancel the affected service and get a pro-rated refund of fees prepaid for it.
8. Helping you
Taking into account what the services do, WebMade will help you answer requests from people exercising their privacy rights (access, correction, deletion, opt-out and portability), and with data protection assessments where the law requires them. You can export your customers and records from My Business at any time. If someone contacts WebMade directly about Client Personal Data, WebMade will pass the request to you and won't answer it unless you ask or the law requires.
9. Return and deletion
When you stop using a service, or when you ask, WebMade deletes the Client Personal Data for that service within 30 days, unless the law requires WebMade to keep it. Export what you want to keep first, or ask us and we'll send it to you.
10. Security incidents
WebMade will tell you without undue delay, and within 72 hours of confirming it, if a security breach leads to unauthorized access to Client Personal Data. We'll say what happened, what data was affected, what we have done, and what you may need to do, and we'll help you meet any notice duty you have.
11. Showing compliance
On reasonable written request, no more than once a year unless there has been an incident, WebMade will give you the information you need to check that it meets this addendum, such as a written description of its security measures and its subprocessor list.
12. Where the data is
WebMade and its subprocessors process Client Personal Data in the United States.
13. The rest
This addendum is part of the WebMade client terms and lasts as long as WebMade processes Client Personal Data for you. If it conflicts with the client terms about personal data, this addendum wins. The client terms' limits of liability apply to it. Questions: contact@webmade.io.