This Data Processing Agreement (“DPA”) supplements the Terms of Service and governs our processing of Customer Data on behalf of the pool service companies that use DeweyIQ (“Controllers”).
Parties
Processor: Coastal Bay Digital LLC (d/b/a DeweyIQ).
Controller: The organization that signs up for DeweyIQ.
Processing details
- Subject matter: Provision of pool service management software.
- Duration: For the term of the Controller's subscription, plus a reasonable export window.
- Categories of data subjects: Controller's end customers, staff, and leads.
- Types of data: Contact info, service history, chemistry, photos, payment metadata (card numbers never touched — see Stripe DPA), and — where the Controller has enabled it — technician location data (see below).
- Technician location data: DeweyIQ processes the device location of the Controller's technicians while they are working a route, in order to show live truck positions, detect arrival at and departure from a stop, and send customers arrival notifications. This live position is transient and is not retained.
Separately, the Controller may enable a setting that causes DeweyIQ to store a sampled location history (approximately one position every ten seconds, with reading accuracy, speed, and heading, while a technician has the current day's route open in the app). That setting is off by default and is enabled only by the Controller. Where it is enabled, DeweyIQ processes that data solely on the Controller's instructions and for the purposes of the Service, retains it for a fixed 90 days, and then deletes it automatically. The retention period is set by the Service and is not extendable by the Controller. DeweyIQ displays an in-app notice to affected technicians whenever the setting is on.
The Controller is the employer of the affected technicians and is responsible for determining the lawfulness of enabling this processing, including any employee notice, consent, or bargaining obligations that apply to it under federal, state, or local law. The in-app notice DeweyIQ provides is a technical measure and does not constitute legal advice or discharge the Controller's own obligations.
Subprocessors
- Supabase — authentication, database, and storage.
- Stripe — subscription billing for your DeweyIQ plan. Note that Stripe also acts outside this list: if you connect payments, you hold your own Stripe account and Stripe processes your customers' payment data on your behalf under your own agreements with Stripe, not as our subprocessor. See the Terms.
- Telnyx — SMS delivery.
- Resend — transactional email.
- Vercel — hosting and edge network.
- Anthropic — AI-powered features (photo diagnosis, smart reports).
- Mapbox / OpenRouteService — routing and map services.
Security measures
We maintain commercially reasonable technical and organizational measures including encryption in transit (TLS 1.2+) and at rest (AES-256), least-privilege access controls, audit logging of administrative activity, and regular dependency and vulnerability review. Access to production systems is limited to authorized personnel and requires multi-factor authentication.
Breach notification
We will notify Controllers without undue delay (and within 72 hours when applicable) of any confirmed breach affecting Customer Data.
International transfer
Customer Data is processed in the United States. DeweyIQ currently serves U.S.-based customers only; if that changes, this DPA will be updated with the appropriate cross-border transfer mechanisms (Standard Contractual Clauses, UK IDTA, or the EU-U.S. Data Privacy Framework, as applicable).
Assignment
Either party may assign this DPA, in whole, to a successor entity in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of the assets to which this DPA relates, on notice to the other party. The successor will be bound by the obligations of this DPA and will continue to process Customer Data in accordance with its terms. Except as stated in this section, neither party may assign this DPA without the other party's prior written consent.
Term & termination
This DPA terminates with the Controller's subscription. On termination we will delete or return Customer Data in accordance with the Terms.