Data processing addendum
When you store your customers' information in Homeforce, we process it for you. This addendum sets out how, and it's part of our Terms of service. No signature is needed; it applies automatically when you use Homeforce.
1. Scope and roles
This Data Processing Addendum ("DPA") is part of the Terms of service between Homeforce LLC ("Homeforce") and the business using Homeforce ("Customer"). It applies when Homeforce processes Customer Personal Data while providing the service.
Customer Personal Data means personal information about Customer's own customers, leads, contacts and workers that Customer or its users put into Homeforce, or that Homeforce collects on Customer's behalf (for example, through Customer's booking form, chat widget, phone numbers or connected integrations).
For Customer Personal Data, Customer is the controller (or "business") and Homeforce is the processor (or "service provider"). Homeforce acts as a controller only for information about Customer's account users that it uses to run its own business, such as billing, security, support and product analytics, which the Privacy policy covers.
If this DPA and the Terms conflict on data protection, this DPA controls.
2. Processing only on Customer's instructions
Homeforce will process Customer Personal Data only to provide, secure and support Homeforce, and as Customer instructs. Customer's instructions are the Terms, this DPA, and what Customer and its users do in Homeforce: entering records, sending messages, turning on features and connecting integrations.
Homeforce won't sell Customer Personal Data, share it for cross-context behavioral advertising, use it for its own marketing, or combine it with other data except as allowed for service providers by law. Homeforce won't use Customer Personal Data to train AI models.
Homeforce will tell Customer if it believes an instruction breaks data protection law, or if it can no longer meet its obligations under this DPA.
3. Customer's responsibilities
Customer is responsible for having a lawful basis and any required notices and consents for the Customer Personal Data it puts into or collects through Homeforce. That includes consent to text and call people, notice and consent for call recording, notices to employees about location readings taken from the mobile app, and responding to its customers' privacy requests.
4. Confidentiality and staff access
Homeforce will make sure anyone it authorizes to process Customer Personal Data is bound by confidentiality. Homeforce staff access a customer account only to provide support Customer asks for, to keep the service secure, or when the law requires. Support access requires a stated reason, is time-limited, and is logged.
5. Security
Homeforce will maintain appropriate technical and organizational measures to protect Customer Personal Data, taking into account the nature of the data and the risks. The measures currently in place are listed in Annex 2. Homeforce may update them as long as overall protection isn't reduced.
6. Subprocessors
Customer authorizes Homeforce to use the subprocessors listed on our Subprocessors page. Homeforce will have a written agreement with each one that protects Customer Personal Data at least as well as this DPA, and is responsible for their work.
Homeforce will update the Subprocessors page and email the account owner at least 15 days before adding or replacing a subprocessor. Customer may object on reasonable data protection grounds within that period. If we can't resolve the objection, Customer may cancel the affected service and receive a refund of prepaid fees for the unused part of the term.
Integrations Customer chooses to connect (such as QuickBooks, Google, Microsoft 365, a phone system or an app using our API) aren't Homeforce's subprocessors; Customer is directing the data to them.
7. Requests from individuals
If Homeforce receives a request from one of Customer's customers or workers to access, correct, delete or stop processing their information, Homeforce will pass it to Customer and won't respond itself except to say it has done so. Homeforce gives Customer tools to find, edit, export and archive records, and will provide reasonable additional help with requests Customer can't handle with those tools.
8. Security incidents
If Homeforce becomes aware of unauthorized access to, or loss, disclosure or alteration of, Customer Personal Data on systems Homeforce or its subprocessors control, Homeforce will notify Customer without undue delay, and in any case within 72 hours of confirming it. The notice will describe what happened, the data involved, and the steps taken, as far as known, with updates as more is learned. Homeforce will take reasonable steps to contain the incident and help Customer meet any notification duties it has.
9. Assistance and audits
Homeforce will give Customer reasonable information and help needed for Customer's data protection assessments and for dealing with regulators, as far as it relates to Homeforce's processing.
On written request no more than once a year, Homeforce will answer a reasonable written security questionnaire and provide information needed to show compliance with this DPA. Any on-site audit requires a mutually agreed scope, time and confidentiality terms, and is at Customer's expense.
10. Return and deletion
During the subscription, Customer can export its main records to CSV. After the subscription ends, Customer can ask Homeforce in writing to delete Customer Personal Data. Homeforce will then delete it from its active systems within 90 days, except where the law requires Homeforce to keep it. Copies in backups kept by Homeforce's hosting providers are removed as those backups expire and remain protected by this DPA until then.
11. Where data is processed
Homeforce and its subprocessors process Customer Personal Data in the United States and other countries where the subprocessors operate. Homeforce is built for U.S. businesses. If Customer is subject to laws that restrict transfers of personal data to the U.S., Customer should contact us before using Homeforce for that data so we can agree on appropriate terms.
12. Liability
Each party's liability under this DPA is subject to the limitation of liability in the Terms.
13. Annex 1: Details of the processing
| Details | |
|---|---|
| Subject matter and duration | Providing Homeforce to Customer for the length of the subscription, plus the deletion period above. |
| Nature and purpose | Storing, organizing, displaying and sending Customer's business records; scheduling and dispatch; sending texts, emails, calls and notifications; processing payments through Stripe; generating AI drafts and agent replies; syncing with integrations Customer connects; support and security. |
| People the data is about | Customer's customers, leads and their contacts; visitors to Customer's booking form, portal, payment pages and chat; Customer's employees and contractors. |
| Types of data | Names, phone numbers, email and postal addresses, property details and access notes, equipment details, job, estimate, invoice and payment records (no full card numbers), messages, call logs and links to recordings, signatures and the signer's IP address, photos and videos (which may include location), location readings from workers' mobile devices, timesheets and pay information, AI conversations, and any custom fields Customer creates. |
| Sensitive data | Homeforce isn't designed for sensitive data such as health, financial account or government ID numbers. Customer shouldn't enter it except where a feature asks for it (for example, the EIN needed for carrier registration). |
14. Annex 2: Security measures
- Each company's records are kept separate by database row-level security rules, enforced for the application's database role.
- Passwords are stored as one-way argon2id hashes. Session, sign-in, API and OAuth tokens are stored only as hashes.
- Repeated failed sign-ins lock the account temporarily, and sign-in attempts are rate-limited by email and IP address.
- Session cookies are HTTP-only and sent only over HTTPS in production.
- Role-based permissions, custom roles and field-level security control what each user can see and change; the server enforces them.
- An audit log records important changes and who made them.
- Credentials for connected integrations are encrypted with AES-256-GCM before they're stored.
- Files are kept in private storage and served through signed-in routes or links that expire after a few minutes.
- Homeforce staff access to customer accounts requires a stated reason, is time-limited, and is logged. Homeforce's internal admin tools require a passkey or one-time code to sign in.
- Card and bank details are entered directly into Stripe and never reach Homeforce's systems.
- Errors are monitored, and personal data isn't sent to error monitoring by default.
Last updated Nov 5, 2026.