Data Processing Agreement
Last updated: September 29, 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you (“Customer”) and Tamation Inc. (“Processor”, “we”, “us”) and describes how we process personal data on your behalf when you use Rental Tracker.
Quick summary: The personal data you enter into Rental Tracker (owner contact details, tenant payment records, etc.) is your data — you are the controller and we are the processor. We only process it to run the service for you, we use a small number of vetted sub-processors, and we help you meet data subject requests, breach notification, and deletion obligations.
1. Scope and roles
This DPA applies where we process personal data on your behalf in connection with the Service. In respect of Customer Data (the properties, owners, transactions, and files you enter):
- Customer is the controller — you determine what personal data is entered and why;
- Tamation Inc. is the processor — we process that data only on your documented instructions, which are this DPA together with your use of the Service's features.
For account data (your email, name, hashed password) and technical logs, we act as controller as described in our Privacy Policy.
2. Processing details
| Item | Detail |
|---|---|
| Subject matter | Provision of the Rental Tracker property-management Service |
| Duration | For the term of your use of the Service, plus the deletion timelines in Section 7 |
| Nature and purpose | Hosting, storage, display, backup, import/export, and transactional email for the data you enter |
| Categories of data subjects | Property owners, tenants/payers, invited tenant users, and your business contacts whose details you enter |
| Categories of personal data | Names, contact details (email, phone, address), payment/transaction records, and any notes you choose to store. No special categories are required by the Service; you should not enter them |
3. Our obligations
We will:
- Process Customer Data only on your documented instructions (including with regard to transfers), unless required by law — in which case we'll tell you before processing unless legally prohibited;
- Ensure personnel with access to Customer Data are bound by confidentiality;
- Implement the technical and organizational measures described in Section 5;
- Engage sub-processors only as described in Section 4;
- Assist you, taking into account the nature of processing, in responding to data subject requests (access, rectification, erasure, restriction, portability, objection) — in practice most of these can be fulfilled by you directly inside the app;
- Assist you in meeting your obligations under Articles 32–36 GDPR (security, breach notification, data protection impact assessments);
- Delete or return Customer Data at the end of the relationship as described in Section 7;
- Make available information reasonably necessary to demonstrate compliance with this DPA.
4. Sub-processors
You authorize us to engage the following sub-processors. We'll announce additions or changes to this list by updating this page; continued use of the Service after an update constitutes acceptance.
| Sub-processor | Purpose | Location |
|---|---|---|
| Stripe | Payment processing for subscriptions | United States |
| Resend | Transactional email delivery | United States |
| Cloudflare | DNS, CDN, and DDoS protection | United States / global edge |
| Hetzner Online GmbH | Cloud server hosting | European Union (Germany/Finland) |
We remain fully liable for our sub-processors' performance of their data processing obligations.
5. Security measures
We maintain technical and organizational measures appropriate to the risk, including:
- TLS encryption for all data in transit;
- Adaptive hashing for passwords (never stored in plain text);
- JWT authentication with short-lived access tokens and rotating refresh tokens;
- Tenant-scoped database access controls so tenant data is isolated;
- Role-based access control within each tenant;
- Automated backups with a defined retention window;
- Access restricted to personnel who need it to operate the Service.
6. Personal data breaches
We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Data, providing the information reasonably required for you to meet your own notification obligations, and cooperating with your efforts to remediate.
7. Deletion and return of data
On account deletion (see Terms Section 6), Customer Data is soft-deleted immediately and permanently purged after the 30-day recovery grace period. Backups containing deleted data expire within 30 days. On request, we will provide an export (CSV) of your properties, owners, and transactions before deletion — email [email protected].
8. International transfers
Our production servers are hosted in the European Union. Sub-processors listed above may process data in the United States or elsewhere; where personal data originating from the EEA, UK, or Switzerland is transferred to a country not recognized as providing adequate protection, we rely on Standard Contractual Clauses (Module 2, controller-to-processor, and Module 3, processor-to-sub-processor) or an equivalent lawful transfer mechanism. If you are a controller in another jurisdiction (for example, California under the CPRA), this DPA incorporates the equivalent processor obligations for that regime by reference.
9. Audit
Given the nature of the Service, we meet audit requests by providing the information and attestations described in this DPA. On-site audits are not practical for a small-team SaaS; if you have specific compliance requirements, contact us before signing up and we'll tell you honestly what we can and can't support.
10. Liability and precedence
Liability under this DPA is subject to the limitations in the Terms of Service, except where mandatory law (such as the GDPR) provides otherwise. In case of conflict, this DPA prevails over the Terms with respect to the processing of personal data.
11. Contact
Data protection questions: [email protected].