Data Processing Addendum

Between:

Business:The Customer identified in the PipSync Order Form / Service Agreement ("Customer", "Business")

Service Provider: pipsync, LLC, 2810 North Church Street, Wilmington, DE 19802, United States
Email: support@pipsync.io

Preamble

This Data Processing Addendum ("DPA") forms part of the PipSync Terms of Service or any other agreement between the Parties governing the Customer's use of the PipSync platform ("Principal Agreement"). It establishes the contractual terms under which PipSync processes Personal Information on behalf of the Customer as a service provider within the meaning of the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA").

Article 1 — Nature, Purpose, and Scope of Processing

PipSync processes Personal Information solely to provide the services described in the Principal Agreement, including: user authentication, trading signal ingestion and execution, ML-based automated trading, performance analytics, customer support, and billing.

Processing occurs only on documented instructions from the Customer.

Article 2 — Categories of Personal Information

• Identification data (name, email, user ID)
• Authentication data (hashed passwords, OAuth tokens)
• Financial data (subscription status, billing address, payment references)
• Trading data (broker account identifiers, signals, trade records, P&L)
• Technical data (IP address, device/browser, session tokens)
• Communications data (support ticket content)
• Behavioural data (usage events, audit log entries)

Article 3 — Service Provider Obligations

PipSync commits to:

• Process data only on the Business's documented instructions
• Bind all authorised personnel to confidentiality
• Implement appropriate technical and organisational security measures (see Annex 2)
• Assist with consumer privacy requests (right to know, delete, correct, opt out of sale or sharing, and limit the use of sensitive personal information)
• Notify the Business of data breaches within 48 hours
• Delete or return all data within 30 days of termination
• Enable audits (with reasonable advance notice)

Article 4 — Sub-processors

Approved sub-processors are listed below. PipSync will notify the Business 30 days in advance of any changes.

The written terms applicable to each sub-processor are available on request to support@pipsync.io.

Article 5 — Where Data Is Processed

PipSync processes all primary data on infrastructure located in Germany (Hetzner Cloud). Processing outside that infrastructure is limited to the sub-processors listed above, in the locations stated in that table.

Article 6 — Security Measures (Summary)

• AES-256 encryption at rest for credentials and OAuth tokens
• TLS 1.2+ for all data in transit
• Role-based access control; SSH-key-only admin access
• Daily automated backups (30-day retention)
• Append-only audit log
• sendDefaultPii: false in Sentry error monitoring; performance traces only when the user has opted in

Article 7 — Governing Law

This DPA is governed by the laws of the State of Delaware, USA. Disputes are subject to the exclusive jurisdiction of the courts of New Castle County, Delaware.

Request a Signed DPA