Data Processing Addendum
When you use BlindSpot to process documents about your own customers, you are the controller of that data and we are your processor (service provider). This page summarizes how we handle it and how to put a signed Data Processing Addendum (DPA) in place.
Getting a signed DPA
We offer a DPA to any customer on request. Email vraj@byeblindspot.com and we will send our standard DPA for signature. Our DPA follows widely recognized industry standards and is built to satisfy the CCPA/CPRA service-provider requirements and the GDPR Article 28 processor requirements.
What we process, and why
Subject matter: providing the BlindSpot service. Duration: for as long as your subscription is active. Nature and purpose: receiving, reading, and analyzing repair orders and insurer estimates to produce supplements and balance statements, on your instructions only.
Types of personal data (within documents you upload): names, contact details, vehicle identifiers including VINs, and insurance information. Categories of data subjects: your customers (vehicle owners).
Our commitments as your processor
- Process personal data only on your documented instructions
- Keep it confidential and limit access to authorized personnel
- Apply appropriate security measures, including encryption in transit
- Help you respond to data-subject requests, to the extent feasible
- Notify you without undue delay if we become aware of a breach
- Use sub-processors only under contract, and tell you before adding new ones
- Delete or return personal data after termination, except where law requires retention
Current sub-processors
We use the following sub-processors to provide the Service. We will update this list and, where our DPA requires, give notice before adding a new one:
- Vercel Inc. — Website hosting and content delivery (Configured service region)
- Cal.com, Inc. — Demo scheduling (Configured service region)
- Railway — Application hosting and managed infrastructure (Configured service region)
- Supabase, Inc. — Authentication and session management (Configured service region)
- OpenAI, LLC — Optional model-assisted matching and review when remote processing is enabled (Configured service region)
- Anthropic, PBC — Optional model-assisted matching and review when remote processing is enabled (Configured service region)
- xAI — Optional model-assisted matching and review when remote processing is enabled (Configured service region)
- Datalab — Optional hosted OCR when remote processing is enabled (Configured service region)
- Resend, Inc. — Transactional email delivery (Configured service region)
- PostHog, Inc. — Optional product analytics (Configured service region)
- Sentry — Optional error monitoring (Configured service region)
- Cloudflare R2 — Optional backup storage; encryption configured by the operator (Configured service region)
Contact
To request our DPA or ask a data-processing question, email vraj@byeblindspot.com.