Data Processing Addendum
Last updated: 2026-09-25
This Data Processing Addendum ("DPA", version 2026-09-25) forms part of the Terms of Service between Idea Engine LLC, a Wisconsin limited liability company ("Processor"), and the contractor company using FenceFlow ("Customer"). A company owner accepts it on the company's behalf in the app.
1. Scope and roles
This DPA applies to personal information about Customer's customers, prospects and staff that Customer enters into or collects through FenceFlow ("Customer Personal Data"): names, email addresses, phone numbers, property addresses and coordinates, drawings, photos, documents, estimates, signatures and signing audit data, invoices, notification preferences and consent records. Customer is the controller (a "business" under U.S. state privacy laws) and Idea Engine LLC is its processor ("service provider").
2. Instructions
Idea Engine LLC processes Customer Personal Data only to provide FenceFlow as described in the Terms, on Customer's documented instructions (including the way Customer uses the product), and as required by law. We will tell Customer if we believe an instruction breaks the law. We will not sell or share Customer Personal Data, use it for our own purposes (including advertising or AI training), or combine it with other data except as needed to provide the service.
3. Customer responsibilities
Customer is responsible for having a lawful basis to collect Customer Personal Data, for giving its customers any required notices, and for obtaining consent before sending emails or text messages through FenceFlow.
4. Confidentiality and personnel
Anyone authorized by Idea Engine LLC to process Customer Personal Data is bound by confidentiality obligations and accesses it only as needed to operate and support the service.
5. Security
We maintain reasonable technical and organizational measures, including: company-scoped access checks on database queries and file downloads; token-scoped homeowner links; encryption in transit; private, encrypted and versioned file storage; role-based access for contractor staff; and logging of errors and security-relevant events.
6. Sub-processors
Customer authorizes the sub-processors listed on our sub-processors page. We impose data-protection obligations on each that are at least as protective as this DPA and remain responsible for them. We will update that page at least 30 days before adding a sub-processor; Customer may object on reasonable data-protection grounds by emailing privacy@idea-engine.studio, and if we cannot address the objection Customer may terminate the affected service.
7. Security incidents
We will notify Customer without undue delay (and aim for within 72 hours) after confirming a breach of security that leads to unauthorized access to Customer Personal Data, with the information reasonably available to help Customer meet its own notice obligations (for example under Wis. Stat. § 134.98), and we will take reasonable steps to contain it.
8. Assistance with requests
Taking into account the nature of the processing, we will help Customer respond to requests from individuals to access, correct, delete or export their data. FenceFlow provides CSV exports, customer editing and deletion, and an owner-only "anonymise customer" action. We forward to Customer any request we receive directly about Customer Personal Data.
9. Return and deletion
On termination, Customer may export its data for 30 days, after which we delete Customer Personal Data from production systems (backups age out on their normal schedule), unless the law requires us to keep it or Customer asks us to retain signed contract records.
10. Location and audits
Customer Personal Data is processed in the United States. On reasonable written request (no more than once a year), we will provide information needed to show compliance with this DPA.
11. Liability and precedence
The limitation of liability in the Terms applies to this DPA. If this DPA and the Terms conflict about Customer Personal Data, this DPA controls.