JobRev Data Processing Addendum
Effective date: October 18, 2026
Last updated: October 18, 2026
This Data Processing Addendum ("DPA") is part of the JobRev Terms of Service ("Terms") between JobRev LLC, an Arizona limited liability company ("JobRev"), and the Shop that has accepted the Terms ("Shop" or "you"). It applies whenever JobRev processes Personal Information contained in Customer Data on your behalf. Capitalized terms not defined here have the meanings given in the Terms. If this DPA conflicts with the Terms on the processing of Personal Information, this DPA controls.
1. Definitions
- "Data Protection Laws" means all U.S. federal and state laws that apply to the processing of Personal Information under the Terms. These include the California Consumer Privacy Act as amended ("CCPA") and its regulations, other state comprehensive privacy laws, and state data breach and data security laws, in each case to the extent they apply.
- "Personal Information" means information in Customer Data that identifies, relates to, or could reasonably be linked to an identified or identifiable individual or household, and is protected as "personal information," "personal data," or a similar term under Data Protection Laws.
- "Security Incident" means a breach of security that leads to the unauthorized acquisition of, or access to, Personal Information in systems controlled by JobRev or its Subprocessors.
- "Subprocessor" means a third party JobRev engages to process Personal Information on its behalf.
- "Controller," "processor," "business," "service provider," "contractor," "sell," "share," and "consumer" have the meanings given in the applicable Data Protection Laws.
2. Roles
You are the controller (or "business") of Personal Information in Customer Data. JobRev is your processor (or "service provider" / "contractor"). Each party will comply with the obligations that Data Protection Laws impose on it in that role.
3. Details of processing
| Item | Description |
|---|---|
| Subject matter and business purpose | Providing the Service to you under the Terms. That covers job and customer management, scheduling, estimates, invoices, e-signatures, photo and file storage, address geocoding and maps, sending your texts and emails, payment processing through your Stripe account, optional QuickBooks Online sync, support, and security. |
| Nature of processing | Collection, storage, organization, retrieval, display, transmission, synchronization, export, and deletion. |
| Duration | The term of the Terms plus the Export Window, then until deletion as described in Section 11. |
| Categories of individuals | Your End Customers and prospective customers, and other individuals whose information you choose to submit. |
| Categories of Personal Information | Names, phone numbers, email addresses, service addresses and map coordinates, job details and notes, job photos and files, estimates, invoices, payment status (not full card numbers), e-signatures and signing records, message content and delivery records, and SMS consent and opt-out records. |
| Sensitive information | None intended. Under the Terms, you may not submit Social Security numbers, driver's license numbers, full card numbers, financial account credentials, health information, or biometric data. |
4. Your obligations
You:
- are responsible for the lawfulness of the Personal Information you submit and of your instructions;
- will provide all notices and obtain all consents Data Protection Laws and other laws require, including consent for texts under Section 8 of the Terms;
- will respond to requests from individuals to exercise their privacy rights; and
- will not instruct JobRev to process Personal Information in violation of law.
You confirm that you have a lawful right to share Personal Information with JobRev for the business purposes in Section 3.
5. JobRev's obligations (including CCPA service-provider terms)
JobRev will:
- Process only on instructions. Process Personal Information only for the business purposes in Section 3, on your documented instructions, and as Data Protection Laws require. Your instructions include the Terms, this DPA, and your configuration and use of the Service. JobRev will tell you if it believes an instruction violates Data Protection Laws. It may decline to follow that instruction.
- Not sell or share. Not sell or share (as those terms are defined in the CCPA) Personal Information.
- Stay within the relationship. Not retain, use, or disclose Personal Information for any purpose other than the business purposes in Section 3, including for any commercial purpose, or outside the direct business relationship between you and JobRev, except as Data Protection Laws permit.
- Not combine. Not combine Personal Information with personal information JobRev receives from or on behalf of anyone else, or collects from its own interactions with individuals, except as Data Protection Laws permit service providers to do.
- Comply and protect. Comply with the obligations that apply to it under the CCPA and other Data Protection Laws. It will provide the same level of privacy protection those laws require of you.
- Notify if unable to comply. Notify you if it determines that it can no longer meet its obligations under Data Protection Laws.
- Allow you to stop and fix misuse. On notice, permit you to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Information. One such step is directing JobRev to delete specific data.
- Confidentiality. Ensure that personnel who process Personal Information are bound by confidentiality obligations and have access only as needed.
- Assistance. Taking into account the nature of the processing, provide reasonable assistance, mainly through the Service's features, to help you:
- respond to individuals' requests to access, correct, delete, or obtain a copy of their Personal Information; and
- meet your security, breach notification, and data protection assessment obligations.
If JobRev receives a request directly from an individual about Customer Data, it will refer the individual to you where it can identify you, and will not respond otherwise unless the law requires. Assistance that goes beyond the Service's standard features may be charged at JobRev's reasonable rates, unless the law prohibits charging.
- De-identified data. If JobRev uses de-identified data derived from Customer Data, it will take reasonable measures to ensure the data cannot be associated with an individual. It will publicly commit not to re-identify the data, and will not attempt to.
6. Subprocessors
6.1 Authorized Subprocessors. You authorize JobRev to engage the following Subprocessors:
| Subprocessor | Purpose | Location |
|---|---|---|
| Vercel | Application hosting and delivery | U.S. region |
| Neon | Postgres database and object storage for photos and files | AWS us-east-1, United States |
| Twilio | SMS delivery | U.S.-based provider |
| Resend | Email delivery | U.S.-based provider |
| Stripe | Payment processing on your connected account; JobRev subscription billing | U.S.-based provider |
| OpenStreetMap Foundation (Nominatim) | Address geocoding (service addresses are sent) | May be outside the United States |
| Esri (ArcGIS) | Map tiles displayed in the Service | May be outside the United States |
| Browser push services (operated by each user's browser vendor) | Delivering encrypted push notifications to Authorized Users who turn them on | May be outside the United States |
| Intuit (QuickBooks Online) | Accounting sync, only if you enable it | U.S.-based provider |
6.2 Subprocessor obligations. JobRev will have terms with each Subprocessor that require it to protect Personal Information in a manner appropriate to the services it provides and consistent with Data Protection Laws. Some Subprocessors provide standardized services on their published terms. JobRev remains responsible for its obligations under this DPA, as Data Protection Laws require.
6.3 Changes. JobRev will update the Subprocessor list in the Privacy Policy and notify you by email or in the Service at least 15 days before a new Subprocessor begins processing Personal Information. In an urgent situation, such as replacing a failed provider, JobRev will notify you as soon as practicable. If you object on reasonable data protection grounds, tell us within that period. We will discuss the objection in good faith. If we cannot resolve it, your sole remedy is to terminate the affected Service and receive a pro-rated refund of prepaid fees for the unused period.
6.4 Integrations you choose. Third-Party Services that you choose to enable or connect, such as QuickBooks Online and your own Stripe account, receive data at your direction. For data they receive, they are not JobRev's Subprocessors and act under their own terms.
7. Data location
JobRev stores Customer Data in the United States: the database and file storage in Neon (AWS us-east-1), and the application in Vercel's U.S. region. As shown in Section 6.1, certain features involve limited processing by providers that may operate outside the United States: service addresses sent for geocoding, map tile requests, and encrypted push notifications.
8. Security
JobRev will maintain reasonable administrative, technical, and physical safeguards appropriate to the nature of the Personal Information, as described in Annex A. JobRev may update its safeguards as long as the update does not materially reduce overall protection. You are responsible for the security measures within your control, including:
- user access and permissions;
- credential protection;
- the devices your Authorized Users use; and
- keeping your own copies of records.
9. Security Incidents
If JobRev confirms a Security Incident affecting your Personal Information, JobRev will:
- notify you without undue delay, and in any event as soon as practicable as Data Protection Laws require (including A.R.S. § 18-552 where it applies);
- give you the information reasonably available to JobRev that you need to meet your own notification obligations; and
- take reasonable steps to contain, investigate, and remediate the incident.
As the owner or licensee of the Personal Information, you are responsible for any notifications to individuals, regulators, or consumer reporting agencies, unless the law requires otherwise or the parties agree in writing. JobRev's notice of a Security Incident is not an admission of fault or liability. Unsuccessful attempts or activities that do not compromise the security of Personal Information do not count as Security Incidents. Examples are pings, port scans, blocked login attempts, and denial-of-service attacks.
10. Compliance information and assessments
On written request, no more than once in any 12-month period (or more often where required by Data Protection Laws or after a Security Incident), JobRev will provide information reasonably necessary to demonstrate its compliance with this DPA. This may take the form of written responses to a reasonable security questionnaire and a description of its safeguards. If Data Protection Laws require an assessment beyond that, the parties will agree on its scope, timing, duration, and confidentiality in advance. It will be performed at your expense by a qualified, independent assessor bound by confidentiality. It will not include access to other customers' data or to JobRev's Subprocessors' systems. Any information provided is JobRev's Confidential Information.
11. Return and deletion
- During the term and the 30-day Export Window after termination, you may export Customer Data using the Service's export tools or by request (Section 22 of the Terms).
- After the Export Window, JobRev will delete Customer Data from its active systems, except where the law requires retention.
- Copies in routine backups will be deleted or overwritten as those backups expire in the ordinary course. Until then they remain protected by this DPA and are not actively used.
- On request, JobRev will confirm deletion in writing.
12. Liability
Each party's liability arising out of or relating to this DPA is subject to the exclusions and limitations of liability in Section 24 of the Terms. This DPA does not limit any rights that individuals have directly under Data Protection Laws that cannot be limited by contract.
13. Term and changes
This DPA lasts as long as JobRev processes Personal Information in Customer Data for you. JobRev may update this DPA:
- to reflect changes in Data Protection Laws or Subprocessors; or
- in any way that does not materially reduce your protections.
Changes follow the notice process in Section 28 of the Terms.
Annex A – Security measures
JobRev's safeguards currently include:
- Hosting. Application hosted on Vercel (U.S. region). Database and file storage on Neon (AWS us-east-1).
- Encryption in transit. HTTPS/TLS for connections to the Service.
- Authentication. First-party sign-in. Passwords stored only as bcrypt hashes and never in readable form.
- Tenant separation. Each Shop's data is logically separated, and access is enforced by account and role.
- Access control. Role-based permissions within each Shop account. JobRev personnel access Customer Data only as needed for support, security, or operations.
- Private file storage. Job photos and files are kept in private object storage and are viewable only through signed links that expire after 5 minutes.
- Messaging controls. When text messaging is enabled for a Shop, the Service records SMS consent and opt-outs per contact, processes STOP/START keywords automatically, and is designed to block texts to contacts without recorded consent or with an opt-out on file. Text messaging is not offered until these controls are in place.
- Payment data. Full card numbers are handled by Stripe and are not stored by JobRev.
- Vendor management. Use of established infrastructure providers, and review of Subprocessor terms.
- Incident response. A process to investigate, contain, and notify of Security Incidents as described in Section 9.