Data Processing Addendum (Summary)

This is a plain-language summary of how OORT processes data on your behalf as a data processor for your workspace's business and customer-facing data. A formal, counter-signable DPA is available on request and supersedes this summary once executed.

Sub-processors

• Supabase — database, authentication, and file storage.
• PayPal — billing and payment processing.
• Resend — transactional email delivery (when configured).
• Meta / Google Ads — only if and when you explicitly connect a live ad account; not used during the private beta by default.
• U.S. Census Bureau, OpenStreetMap, Open-Meteo — free/public data sources used for modeled market context, not personal data about identifiable individuals.

Data subject requests

If a data subject contacts you about their data, and that data lives in OORT, use the export and deletion tools in your workspace (or contact us) to fulfill the request.

Security measures

Row-level security enforced per workspace, encrypted connections in transit, secret-gated background jobs, and access limited to what each user's role permits. See the Security Review document (docs/security-review.md) for the full technical detail.