Login

Apply for account

Login

Apply for account

Effective Date: January 16, 2026

Effective Date: January 16, 2026

Data Processing Addendum (DPA)

This Data Processing Addendum ("DPA") applies to Hypha Dynamics Inc. ("SiteDNA," "Company," or "Processor") processing Customer Personal Information on behalf of the customer entity ("Customer" or "Controller") in connection with SiteDNA’s Services under the SiteDNA Terms of Use (the "Agreement").

This DPA is intended to satisfy requirements applicable to processors and service providers under U.S. state privacy laws (including the California Consumer Privacy Act as amended by the CPRA) and similar laws, where applicable.

This Data Processing Addendum ("DPA") applies to Hypha Dynamics Inc. ("SiteDNA," "Company," or "Processor") processing Customer Personal Information on behalf of the customer entity ("Customer" or "Controller") in connection with SiteDNA’s Services under the SiteDNA Terms of Use (the "Agreement").

This DPA is intended to satisfy requirements applicable to processors and service providers under U.S. state privacy laws (including the California Consumer Privacy Act as amended by the CPRA) and similar laws, where applicable.

1. Definitions

This Privacy Policy applies when you:

  • Visit our website

  • Create an account or use the Service

  • Communicate with us (for example, by email or through online chat)

The Service is intended for business use and is not directed to children. You must be at least 18 years old to create an account and use the Service. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a user under 18, we will take steps to delete that information promptly.

This Privacy Policy applies when you:

  • Visit our website

  • Create an account or use the Service

  • Communicate with us (for example, by email or through online chat)

The Service is intended for business use and is not directed to children. You must be at least 18 years old to create an account and use the Service. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a user under 18, we will take steps to delete that information promptly.

2. Roles of the Parties

The parties agree that:

  • Customer is the Controller of Customer Personal Information.

SiteDNA is the Processor of Customer Personal Information.

The parties agree that:

  • Customer is the Controller of Customer Personal Information.

SiteDNA is the Processor of Customer Personal Information.

3. Processing Details and Customer Instructions

3.1 Subject Matter and Purpose

Processor will process Customer Personal Information to provide, maintain, secure, support, and improve the Services, including:

  • Account provisioning and authentication

  • Hosting Customer Content and operational data

  • Customer support (including chat support tools)

  • Product analytics and service performance

  • Security monitoring and fraud prevention

3.2 Duration

Processing will continue for the term of the Agreement and any period thereafter as necessary to comply with legal obligations and permitted retention.

3.3 Customer Instructions

This DPA and the Agreement constitute Customer’s documented instructions. Customer may provide additional written instructions that are consistent with the Agreement and this DPA.

Customer will not instruct Processor to process Customer Personal Information in a way that violates Data Protection Laws.

3.1 Subject Matter and Purpose

Processor will process Customer Personal Information to provide, maintain, secure, support, and improve the Services, including:

  • Account provisioning and authentication

  • Hosting Customer Content and operational data

  • Customer support (including chat support tools)

  • Product analytics and service performance

  • Security monitoring and fraud prevention

3.2 Duration

Processing will continue for the term of the Agreement and any period thereafter as necessary to comply with legal obligations and permitted retention.

3.3 Customer Instructions

This DPA and the Agreement constitute Customer’s documented instructions. Customer may provide additional written instructions that are consistent with the Agreement and this DPA.

Customer will not instruct Processor to process Customer Personal Information in a way that violates Data Protection Laws.

4. Processor Obligations

Processor will:

  • Process Customer Personal Information only for the purposes described in this DPA and the Agreement

  • Implement and maintain appropriate technical and organizational measures to protect Customer Personal Information

  • Ensure Personnel with access to Customer Personal Information are bound by confidentiality obligations

  • Notify Customer if Processor reasonably believes Customer’s instructions violate applicable Data Protection Laws

4.1 Service Provider Restrictions (U.S. State Privacy Laws)

To the extent applicable under Data Protection Laws, Processor will not:

  • Sell Customer Personal Information

  • Share Customer Personal Information for cross-context behavioral advertising

  • Retain, use, or disclose Customer Personal Information for any purpose other than providing the Services and other permitted business purposes described in this DPA and the Agreement

  • Retain, use, or disclose Customer Personal Information outside of the direct business relationship between the parties

  • Combine Customer Personal Information received from Customer with personal information received from other sources, except as permitted by Data Protection Laws (for example, to prevent fraud or ensure security)

  • Re-identify de-identified or aggregated data

Processor may use Customer Personal Information in aggregated or de-identified form to the extent permitted by the Agreement and Data Protection Laws and will not attempt to re-identify such data.

Processor will:

  • Process Customer Personal Information only for the purposes described in this DPA and the Agreement

  • Implement and maintain appropriate technical and organizational measures to protect Customer Personal Information

  • Ensure Personnel with access to Customer Personal Information are bound by confidentiality obligations

  • Notify Customer if Processor reasonably believes Customer’s instructions violate applicable Data Protection Laws

4.1 Service Provider Restrictions (U.S. State Privacy Laws)

To the extent applicable under Data Protection Laws, Processor will not:

  • Sell Customer Personal Information

  • Share Customer Personal Information for cross-context behavioral advertising

  • Retain, use, or disclose Customer Personal Information for any purpose other than providing the Services and other permitted business purposes described in this DPA and the Agreement

  • Retain, use, or disclose Customer Personal Information outside of the direct business relationship between the parties

  • Combine Customer Personal Information received from Customer with personal information received from other sources, except as permitted by Data Protection Laws (for example, to prevent fraud or ensure security)

  • Re-identify de-identified or aggregated data

Processor may use Customer Personal Information in aggregated or de-identified form to the extent permitted by the Agreement and Data Protection Laws and will not attempt to re-identify such data.

5. Data Subject Requests

5.1 Handling of Requests

If Processor receives a Data Subject Request relating to Customer Personal Information:

  • Processor will notify Customer without undue delay, unless legally prohibited.

  • Processor will not respond substantively to the Data Subject except to direct the Data Subject to Customer, unless required by law.

5.2 Assistance

If Customer cannot fulfill a Data Subject Request using features or controls available in the Services, Processor will provide reasonable assistance upon written request, to the extent required by Data Protection Laws.

5.1 Handling of Requests

If Processor receives a Data Subject Request relating to Customer Personal Information:

  • Processor will notify Customer without undue delay, unless legally prohibited.

  • Processor will not respond substantively to the Data Subject except to direct the Data Subject to Customer, unless required by law.

5.2 Assistance

If Customer cannot fulfill a Data Subject Request using features or controls available in the Services, Processor will provide reasonable assistance upon written request, to the extent required by Data Protection Laws.

6. Subprocessors

6.1 Authorization

Customer provides a general authorization for Processor to engage Subprocessors.

6.2 Notice and Objections

Processor may update the list in Appendix C at least 10 days in advance of the Subprocessor Processing Customer Personal Information. If Customer has a good-faith basis to object to a new Subprocessor, Customer may provide a written objection within the notice period. The parties will work in good faith to resolve the objection.

6.3 Flow-Down Terms

Processor will enter into a written agreement with Subprocessors requiring them to protect Customer Personal Information in a manner consistent with this DPA.

6.1 Authorization

Customer provides a general authorization for Processor to engage Subprocessors.

6.2 Notice and Objections

Processor may update the list in Appendix C at least 10 days in advance of the Subprocessor Processing Customer Personal Information. If Customer has a good-faith basis to object to a new Subprocessor, Customer may provide a written objection within the notice period. The parties will work in good faith to resolve the objection.

6.3 Flow-Down Terms

Processor will enter into a written agreement with Subprocessors requiring them to protect Customer Personal Information in a manner consistent with this DPA.

7. Security and Security Incidents

7.1 Security Measures

Processor will maintain appropriate technical and organizational measures designed to protect Customer Personal Information against Security Incidents. A high-level summary is provided in Appendix B.

7.2 Security Incident Notice

Processor will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident and provide reasonable information available at the time, including the nature of the incident and steps taken or planned to mitigate it. Processor will provide additional information as it becomes available. This notification obligation does not apply to incidents caused by Customer or its authorized users.

7.1 Security Measures

Processor will maintain appropriate technical and organizational measures designed to protect Customer Personal Information against Security Incidents. A high-level summary is provided in Appendix B.

7.2 Security Incident Notice

Processor will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident and provide reasonable information available at the time, including the nature of the incident and steps taken or planned to mitigate it. Processor will provide additional information as it becomes available. This notification obligation does not apply to incidents caused by Customer or its authorized users.

8. Audits and Assessments

Upon written request, Processor will:

  • Provide reasonable responses to Customer’s security questionnaire no more than once per year, and

  • Provide available security documentation reasonably necessary for Customer’s compliance reviews, subject to confidentiality obligations.

Upon request, Processor will provide information about its security certifications and independent assessments, if any.

Upon written request, Processor will:

  • Provide reasonable responses to Customer’s security questionnaire no more than once per year, and

  • Provide available security documentation reasonably necessary for Customer’s compliance reviews, subject to confidentiality obligations.

Upon request, Processor will provide information about its security certifications and independent assessments, if any.

9. Deletion and Return of Customer Personal Information

Within 30 days after expiration or termination of the Agreement, Customer may request in writing that Processor delete Customer Personal Information processed on behalf of Customer.

Upon request, Processor will confirm deletion in writing. Processor may retain information as required to comply with legal obligations or as otherwise permitted under Data Protection Laws.

If Customer does not request deletion within 30 days after termination, Processor will delete Customer Personal Information in accordance with its standard data retention practices as described in the Privacy Policy, except as required by law or permitted under Data Protection Laws.

Within 30 days after expiration or termination of the Agreement, Customer may request in writing that Processor delete Customer Personal Information processed on behalf of Customer.

Upon request, Processor will confirm deletion in writing. Processor may retain information as required to comply with legal obligations or as otherwise permitted under Data Protection Laws.

If Customer does not request deletion within 30 days after termination, Processor will delete Customer Personal Information in accordance with its standard data retention practices as described in the Privacy Policy, except as required by law or permitted under Data Protection Laws.

10. International Transfers

The parties acknowledge that Customer Personal Information may be processed in the United States.

If Customer requires transfer mechanisms for personal data originating from the EEA, UK, or Switzerland (for example, Standard Contractual Clauses), the parties may enter into an addendum or incorporate appropriate transfer terms upon request.

The parties acknowledge that Customer Personal Information may be processed in the United States.

If Customer requires transfer mechanisms for personal data originating from the EEA, UK, or Switzerland (for example, Standard Contractual Clauses), the parties may enter into an addendum or incorporate appropriate transfer terms upon request.

11. Liability

Each party’s liability arising out of or related to this DPA is subject to the limitation of liability provisions in the Agreement.

Each party’s liability arising out of or related to this DPA is subject to the limitation of liability provisions in the Agreement.

12. Term; Order of Precedence

This DPA is effective as of the Effective Date of the Agreement and continues until the Agreement terminates.

If there is a conflict between this DPA and the Agreement regarding processing of Customer Personal Information, this DPA controls.

Appendix A: Description of Processing

  • Categories of Data Subjects: Customer authorized users; Customer’s end customers/clients and contacts to the extent included in Customer Content.

  • Categories of Personal Information: Contact and account identifiers; subscription and billing metadata (excluding full card data); in-product content and operational data (including photos and related metadata); usage and device information; IP-based approximate location; support communications.

  • Sensitive Data: Customer agrees not to submit sensitive personal information (such as health information, financial account numbers, government identifiers, or information revealing racial or ethnic origin, religious beliefs, or sexual orientation) unless expressly permitted under the Agreement and required for the Services. If Customer submits sensitive personal information, Customer is solely responsible for ensuring such submission complies with applicable Data Protection Laws. If precise geolocation is enabled, location data may be processed.

  • Frequency: Continuous during the term of the Agreement.

  • Purpose: Providing, maintaining, supporting, securing, and improving the Services.

Appendix B: High-Level Security Measures

Processor maintains a security program designed to protect Customer Personal Information, which may include:

  • Access controls and least-privilege permissions

  • Encryption in transit (TLS) and encryption at rest

  • Logging and monitoring for suspicious activity

  • Backup and recovery practices

  • Vendor due diligence and contractual protections with Subprocessors

  • Incident response procedures

Processor may update security measures over time, provided that updates do not materially reduce overall protections.

Appendix C: Subprocessors

Processor’s Subprocessors may include:

  • Amazon Web Services (AWS) – Hosting and cloud infrastructure – United States

  • Stripe – Payment processing – United States

  • Intercom – Customer support chat and messaging – United States

  • Mixpanel – Product analytics – United States

HubSpot – CRM and marketing communications – United States

This DPA is effective as of the Effective Date of the Agreement and continues until the Agreement terminates.

If there is a conflict between this DPA and the Agreement regarding processing of Customer Personal Information, this DPA controls.

Appendix A: Description of Processing

  • Categories of Data Subjects: Customer authorized users; Customer’s end customers/clients and contacts to the extent included in Customer Content.

  • Categories of Personal Information: Contact and account identifiers; subscription and billing metadata (excluding full card data); in-product content and operational data (including photos and related metadata); usage and device information; IP-based approximate location; support communications.

  • Sensitive Data: Customer agrees not to submit sensitive personal information (such as health information, financial account numbers, government identifiers, or information revealing racial or ethnic origin, religious beliefs, or sexual orientation) unless expressly permitted under the Agreement and required for the Services. If Customer submits sensitive personal information, Customer is solely responsible for ensuring such submission complies with applicable Data Protection Laws. If precise geolocation is enabled, location data may be processed.

  • Frequency: Continuous during the term of the Agreement.

  • Purpose: Providing, maintaining, supporting, securing, and improving the Services.

Appendix B: High-Level Security Measures

Processor maintains a security program designed to protect Customer Personal Information, which may include:

  • Access controls and least-privilege permissions

  • Encryption in transit (TLS) and encryption at rest

  • Logging and monitoring for suspicious activity

  • Backup and recovery practices

  • Vendor due diligence and contractual protections with Subprocessors

  • Incident response procedures

Processor may update security measures over time, provided that updates do not materially reduce overall protections.

Appendix C: Subprocessors

Processor’s Subprocessors may include:

  • Amazon Web Services (AWS) – Hosting and cloud infrastructure – United States

  • Stripe – Payment processing – United States

  • Intercom – Customer support chat and messaging – United States

  • Mixpanel – Product analytics – United States

HubSpot – CRM and marketing communications – United States

Manage more properties. Close more enhancements. Stress less.

Apply for account

Manage more properties. Close more enhancements. Stress less.

Apply for account

Manage more properties. Close more enhancements. Stress less.

Apply for account