Data processing addendum

Effective October 12, 2026.

This addendum forms part of the Allpage terms between Allpage, the operator of allpage.site, and the business using its services. It applies when Allpage processes personal information on the business's behalf. Contact: hello@allpage.site.

1. Roles and scope

The business determines why and how it uses its customer data and acts as controller or business under applicable privacy law. Allpage acts as processor or service provider when providing the business's configured services. Each party will meet the obligations that apply to its role.

Allpage separately determines the purposes of processing for its own accounts, billing, security, directory and AI product improvement, as described in the privacy notice. Those uses are not described as processing solely on the business's instructions. This distinction does not authorize a use prohibited by applicable law or remove a requirement to obtain consent.

2. Processing details

The subject matter is operating the business's websites, customer records, booking, commerce, messaging and related services. Processing includes collecting, organizing, storing, retrieving, transmitting, exporting, restricting and deleting information. It lasts while Allpage provides the services and for permitted retention afterward.

People concerned include the business's customers, prospective customers, website visitors, team members and dependents booked by a customer. Information can include:

• Names, contact details, addresses, birthdays, customer identifiers and consent records.
• Bookings, attendance, orders, agreements, payment references, amounts, tax information, refunds, gift cards and store credit.
• Messages, form answers, signatures, uploaded records, client photos, gallery activity, notes, tags and custom fields.
• Dependent names, birthdates, notes and pickup contacts, supplied by a parent or authorized caregiver.
• Team sessions, pay rules and calculated pay statements.
• Website page and referral information, form steps and daily visitor hashes.
• Health information collected through designated sensitive fields, subject to section 4.

Full card details entered in Stripe's payment forms go to Stripe. The business must minimize the information it collects and not use Allpage for information requiring a HIPAA business associate agreement.

3. Instructions and obligations

The business instructs Allpage through its authorized users, settings, approved assistant actions, connected apps, API requests and this agreement. It must have a lawful basis for the information and instructions it supplies, provide required notices and obtain required consent. Allpage will tell the business if it believes an instruction violates applicable data protection law and may pause that instruction while it is resolved.

For information processed on the business's behalf, Allpage will:

• Use it only to provide the agreed services, follow lawful documented instructions, or meet a legal requirement. Where legally permitted, we will notify the business of a conflicting legal requirement.
• Not sell it, share it for cross-context behavioral advertising, use it to advertise another business, or retain, use or disclose it outside the direct business relationship except as permitted by law. We will not combine it with other customers' data for a prohibited purpose.
• Limit access to authorized people with confidentiality obligations and a need to perform their work.
• Maintain reasonable technical and organizational safeguards described in section 7.
• Help the business respond to requests for access, correction, export, restriction and deletion, and with assessments or regulatory inquiries reasonably related to our processing.
• Notify the business if we can no longer meet these obligations and allow reasonable steps to stop and remedy unauthorized use.

AI improvement is a separate use. Capture is on by default and can include prompts, replies, tool inputs and results from the business's assistants. Allpage uses captured records for its own evaluation, improvement and model training as explained in the privacy notice. Owners can turn it off in Settings, Your assistant, which stops new capture and requests deletion of retained captures. The business must turn it off where it lacks authority for that use. Neither this addendum nor an owner's setting substitutes for legally required consent from an individual. Marked sensitive health fields are excluded from model context; health-related businesses' records are excluded from training exports by default.

4. Consumer health data

When the business uses designated health fields, Allpage processes those answers only to provide the requested intake and recordkeeping services, on the business's instructions. Allpage does not sell those answers or use them for advertising or its own model training. Access and disclosure are limited to authorized business users and the service providers needed to host, store and protect them.

Designated health forms require a consent statement, and submissions record consent. The business must make that statement accurate, collect only what it needs, and publish the consumer health data policy available through its website. Marked sensitive fields are excluded from AI context, analytics and ordinary event and webhook payloads. The business is responsible for identifying fields correctly and ensuring its free-text content does not bypass these controls.

Allpage will help the business carry out requests to access, withdraw consent for, or delete health data, including instructing relevant subprocessors where required. An automated record removal does not establish that every historical copy or attachment has been erased; requests involving those records should also be sent to Allpage for review.

Allpage does not offer a HIPAA business associate agreement. The business must not use these features for protected health information when such an agreement is required. Health intake features do not represent HIPAA certification or a legal compliance guarantee.

5. Retention, return and deletion

The business can export customer records without an export fee. It can remove a customer through its authorized tools; customers can also request deletion of their Allpage account. These operations clear or anonymize designated records, but historical records, files or records held under an exception may require further review. Allpage will assist with a verified request covering that remaining information.

Closing a business, cancelling a plan and deleting data are different actions. Closing does not purge business data. After a business closes and its payments wind down, an owner can delete it, and Allpage purges its data 30 days later. The purge deletes personal data and content, and keeps ledger, sales and tax records for 7 years and other consent records for 3 years, with customers anonymized, then deletes those too. Consent given with a sale stays as long as that sale's records. Allpage also keeps a de-identified record of the deleted business for audit, security and analytics: ids, kinds, dates, plan, amounts, AI usage and activity logs, with names, contact details, typed words and message bodies removed. It has no set end date. The business's name stays in it for the year its web address is held, then goes. On termination or a verified deletion request, Allpage will help return or delete information on the business's instructions. We aim to complete the request within 45 days, subject to any shorter legal deadline, and will explain any permitted extension or retained records. We will not promise an export or deletion is complete while known relevant records remain outside the stated exceptions.

While a business is open, its financial, consent, action, event and security audit histories have no automatic expiry. They are reviewed against legal obligations, disputes, fraud prevention and evidence of permission when deletion is requested. Other standard periods are:

• Personal-data access logs: 24 months, removed by monthly partition.
• Raw website analytics: 13 months, removed by monthly partition; daily totals remain.
• Operation timing and completed background jobs: 30 days; failed jobs: 90 days.
• Captured AI conversations: up to three years, with earlier deletion requested by the business's opt-out or an identified customer's deletion.
• Original wording of unfulfilled website requests: 90 days, then a summary of the missing capability remains.

Other operational and customer records remain while needed for the service or a permitted purpose. Backups can retain earlier copies during their recovery window. Media backup versions expire after 30 days; database recovery history follows the configured provider window. Copies kept only for recovery are restricted from ordinary use. If a backup is restored, applicable deletion requests must be reapplied before the restored data returns to ordinary use.

6. Service providers and connected services

The business authorizes the infrastructure and feature providers below as needed to deliver the services it uses. Allpage will engage subprocessors under written data-protection obligations appropriate to their processing and remains responsible for its obligations under this addendum. Not every provider receives every business's data.

Infrastructure and managed features

• Cloudflare: hosting, delivery, media and training-record storage, queues, email services, AI Gateway and Workers AI.
• Neon: PostgreSQL hosting and database recovery history.
• Anthropic: AI inference for enabled assistant and generation tasks.
• Amazon Web Services: email delivery through SES when configured.
• Twilio: business texting and related messaging services when enabled.
• Telnyx: alternative texting provider when configured.
• Geocodio: address geocoding when configured.

Services connected or chosen by the business or account holder

• Stripe: customer payment processing on the business's account, Allpage subscription billing and tax calculations.
• Google: sign-in, calendar, business profiles and location or address services according to the connection or feature used.
• Microsoft: connected Outlook mailbox access.
• Meta: connected Instagram, Messenger, WhatsApp and social publishing features.
• Shippo: shipping rates and labels through the business's account.
• Square: reading connected customer and loyalty information.
• Intuit QuickBooks and Xero: accounting journals sent to the connected books.
• doola: formation services ordered through the partner.

These connected services may act as independent controllers under their own agreements, especially for payments, identity checks, account security and regulated services. This list does not characterize all of their activities as Allpage subprocessors. Outside AI apps and integrations chosen by the business are also governed by the permissions and agreements the business gives them.

Allpage will give at least 30 days' notice by email or in-app notice before a new subprocessor begins processing existing business customer data. The business may object on reasonable data-protection grounds by contacting us during that period. We will work to address the concern, offer a reasonable alternative where available, or allow the business to end the affected service with a proportionate refund of unused prepaid fees. A provider newly selected by the business may start when the business enables that feature. If an urgent security or continuity need prevents advance notice of a replacement, we will notify the business as soon as reasonably possible and provide the same opportunity to object.

7. Security and incidents

Allpage uses encrypted connections, business-scoped database access, role-based permissions, protected integration credentials, signed or verified provider webhooks, and access logs. Sensitive actions use stronger sign-in checks. Routine staff support access is time-limited, read-only and audited. Authorized infrastructure and security work may require other privileged access. These controls reduce risk; they do not guarantee that an incident cannot occur.

Allpage will notify the business without undue delay after becoming aware of a personal-data breach affecting data processed for it. Our target is within 48 hours of awareness, even if the investigation is incomplete, and we will meet any shorter period legally required. We will share available information about the affected data, likely consequences, mitigation and a contact for follow-up, and provide updates as facts develop. Notification is not an admission of fault. The business remains responsible for notices it must provide to individuals or authorities; Allpage will reasonably assist.

8. Demonstrating compliance and transfers

On reasonable request, Allpage will provide information needed to demonstrate compliance with this addendum, including relevant security documentation and answers to a reasonable questionnaire. If that is insufficient, the parties will arrange a proportionate confidential audit by the business or an independent auditor, generally with 30 days' notice and no more than once a year. Those limits do not prevent a regulator's required review or a necessary review after a material incident. Reviews must protect other businesses' data, security and privileged information. Ordinary documentation is provided without charge; unusual audit costs must be agreed in advance.

Allpage is designed for US businesses and uses providers that may process information internationally. This addendum does not claim a data residency guarantee, certification under a transfer framework or execution of standard contractual clauses. Where a transfer requires an additional legal safeguard, the parties must put that safeguard in place before making the transfer. The business should contact Allpage before using it for processing that requires such arrangements.