Data Processing Addendum

Effective November 10, 2026  ·  ArcAngel CRM, a product of ArcAngel Technical Services, LLC

This Data Processing Addendum (the “Addendum”) is between ArcAngel Technical Services, LLC (“ArcAngel,” “we,” “us”) and the organization that subscribes to, accesses, or places data in the Service (the “Organization”). This Addendum takes effect upon the Organization’s subscription to the Service or initial transfer of Organization Data, forms part of the Terms of Service, and sets out how we handle the information the Organization keeps in ArcAngel CRM (the “Service”). Where this Addendum and the Terms disagree about the handling of Organization Data, this Addendum governs.

It says nothing the Service does not already do. Each commitment below describes how the Service is built and run today; where something is not yet in place, the Addendum says so rather than promising it.

1. Definitions

• Organization Data — everything the Organization, its staff, volunteers and Participants put into the Service, and everything the Service records about their use of it: records about people, uploaded documents, forms and answers, accounts, and the audit log.
• Participant — a person who receives services from the Organization and about whom it keeps a record, including children.
• Sub-processor — a vendor we use that processes Organization Data on our behalf.
• Security Incident — a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Organization Data.
• Data Protection Law — the laws that apply to the Organization's handling of personal information, including U.S. state privacy laws and, where they apply to the Organization, sector rules such as those described in Section 4 of the Privacy Policy.

2. Roles

The Organization decides what Organization Data is collected, from whom, why, and for how long; it is the controller, or the “business,” for that data. We process Organization Data only on the Organization's behalf, as its processor or “service provider.”

We process Organization Data only on the Organization's instructions. Those instructions are the Terms, this Addendum, the way the Organization configures and uses the Service, and any further written instruction from an Organization administrator that is consistent with them. If we believe an instruction would break the law, we will say so and will not follow it.

We do not sell or rent Organization Data; use it for advertising or to build profiles; use it to train machine-learning or artificial-intelligence models; combine it with another organization's data for any purpose, including benchmarking or statistics; or keep, use or disclose it for any purpose other than providing the Service to the Organization, except as the law requires.

3. The Organization's responsibilities

• Having a lawful basis for what it records, giving Participants any notice the law requires, and obtaining and recording the consents its programs need (the Service records consent per person and per purpose).
• Deciding who in the Organization may see what, through the roles it assigns, and keeping sign-in credentials confidential.
• Setting and observing its own record-retention obligations, including those its funders impose (see the Retention & Deletion Schedule).
• Not placing in the Service protected health information subject to HIPAA, or substance use disorder records subject to 42 CFR Part 2, until we offer the agreement those rules require. We do not offer a Business Associate Agreement or a Qualified Service Organization Agreement today. A victim service provider should assess the Service against its VAWA confidentiality obligations first; we have not completed that assessment.

4. Who at ArcAngel can reach Organization Data

Only a small number of named ArcAngel personnel operate the Service. Each is bound by a written confidentiality obligation, signs in with two-factor authentication, and holds only the access their role needs.

ArcAngel staff cannot see the Organization's records on their own. When the Organization asks for help, they work in a support session: as one of the Organization's own users, with that person's permissions and no more, never that person's password, two-factor settings or profile, for a limited time that ends when they sign out, read-only unless the work needs more, and only inside a window of at most 24 hours that the person or an Organization administrator approved for that request; responding to a security incident is the one exception, and is flagged as such in the Organization's audit log. The person being viewed as and the Organization's administrators see a banner while it runs, an administrator can end it at any time, and every page viewed and action taken is written to the Organization's audit log.

The one exception is what the Organization's people send us themselves:

• feedback through Send feedback, which anyone with an account at the Organization may send;
• requests for help through Help & support, which only its staff may send.

These are addressed to us and we read them without a support session. They are encrypted using a separate administrative key, are deleted with the rest of Organization Data when the Organization's account is erased, and each time we open one it is recorded in the Organization's audit log.

5. Security

We maintain the technical and organizational measures in Annex B, which match the Security page. We may improve them, but will not reduce the overall protection they give without the Organization’s prior written consent.

6. Sub-processors

The Organization authorizes the Sub-processors listed in Annex C. Each is bound by written obligations that protect Organization Data at least as well as this Addendum, and we remain responsible for their work.

Before a new Sub-processor handles Organization Data, we will update the list and email the Organization's administrators at least 30 days ahead. The Organization may object in writing within that time. If we cannot address a reasonable objection, the Organization may end the Service without penalty and take its data with it (Section 10).

7. Helping the Organization answer Participants

Participants exercise their rights — to see, correct, receive a copy of, or delete their record — through the Organization, which holds the record. The Service lets the Organization do each of these itself. If a Participant contacts us directly, we will tell them to contact the Organization and let the Organization know, and we will not answer the request ourselves unless the Organization asks us to or the Organization no longer exists.

We will give reasonable help with the Organization's own privacy or risk assessments and with any regulator's questions about the Service.

8. Security Incidents

If we discover or confirm a Security Incident, we will notify the Organization without undue delay, and in any event within 72 hours of discovering it. The notice will say what happened, what data and which people are or may be affected (as far as we know), what we have done and are doing, and what the Organization may need to do, and we will add to it as we learn more. We will cooperate with any notification the Organization must make under Data Protection Law. We will not name the Organization in any public statement about an incident without its agreement, unless the law requires it.

9. Requests from authorities

If a court, law-enforcement agency or other authority asks us for Organization Data, we will refer it to the Organization where we can. If we must respond, we will notify the Organization first, where the law allows, so that it can object; disclose only what the request strictly requires; and challenge a request that appears unlawful or overbroad.

10. Returning and deleting Organization Data

• Export at any time. An Organization administrator can prepare a complete export (every table, every document) whenever it likes, including while its subscription is inactive. It is encrypted with a passphrase shown once, to that administrator, behind two-factor authentication, and never sent by email.
• Erasure on request. The Organization asks on its own data page; after a seven-day waiting period and our confirmation, the Service destroys the Organization's encryption key and then deletes its records, documents and exports. We will complete this within 60 days of the request, except where the law requires us to keep something, and will confirm in writing when it is done.
• Erasure after a subscription ends. If the Organization's account stays read-only because its subscription was cancelled or went unpaid, we erase its Organization Data in the same way one year after it became read-only. We email its administrators and billing contact 90 days and 7 days before. The erasure runs only after we confirm it, and paying again before then stops it. We confirm in writing when it is done.
• Backups. Copies of Organization Data in backups are removed on a rolling schedule of no more than 90 days. Because the Organization's key is destroyed first, the values the Service encrypts — names, dates of birth, contact details, narrative records and every document — cannot be read in any backup from that moment. Values the Service does not encrypt, such as dates and amounts, are also encrypted at rest in backup copies until those copies are removed.

The Retention & Deletion Schedule sets out how long each kind of data is kept and how it ends.

11. Information and audits

We will answer the Organization's reasonable written questions about how we meet this Addendum, including a security questionnaire, once a year or after a Security Incident. We will share a summary of the results of our most recent independent security assessment and penetration testing. Further audits are by agreement, on reasonable notice, at the Organization's cost, and in a way that does not expose any other organization's data.

12. Where Organization Data is kept

All Organization Data — the database, uploaded documents and backups — is stored in the United States (New York City region), with an encrypted off-site copy of the database backups in Backblaze's United States (US West) region. The one exception is outbound email, sent through a vendor in the European Union (Annex C), which receives only a recipient's address and that message, or, if the Organization sets one up, through its own mail server.

13. Term

This Addendum lasts for as long as we hold Organization Data, including after the Terms end, until Section 10 is complete.

Annex A — Details of the processing

Subject matter and purpose	Providing the Service: keeping the Organization's program records and producing what it needs from them (its own reports, its funders' reports, staff, volunteer, resident and tenant portals, and what it chooses to show its observers), and securing and supporting the Service.
Duration	The term of the Terms, then until Section 10 is complete.
Nature	Storage, retrieval, display, calculation, export and deletion, as the Organization's users direct in the Service; and reading pictures of pay stubs and receipts sent to it, on our own servers, to suggest their figures and match a stub to its employer, keeping none of the text read.
People the data is about	Participants (adults and children) and their household members and contacts; applicants and people who inquire; the Organization's staff, volunteers, commercial tenants and their contacts, and the observers it invites; its donors and the people related to them, the people its donors' gifts honor and the people a donor asks to be told of such a gift; the people who buy tickets to its events and the guests they name; supporters the Organization names, for example on its signs.
Kinds of data	As listed in Section 2 of the Privacy Policy: identification and contact details, household relationships, demographic information collected for funder reporting, program and housing history, income, benefits and finances, case notes, goals and incidents, consent records, signed documents and uploaded files, account and audit information.
Specially sensitive data	Information about children, and any health, disability, race or ethnicity, or criminal-legal information the Organization chooses to record. Subject to Section 3, no HIPAA or 42 CFR Part 2 records.

Annex B — Security measures

• Encryption at rest, per organization. Names, dates of birth, contact details, addresses and the narrative record (case notes, incidents, goals, notes) are encrypted field by field with AES-256-GCM under a key belonging to the Organization alone, before they reach the database. Every uploaded document is encrypted the same way, under a filename that reveals nothing.
• Encryption in transit on every connection, including between the application and its database.
• Isolation between organizations. Every request is confined to the signed-in user's organization; a record belonging to another organization is answered as though it does not exist.
• Access control. Role- and capability-based, set by the Organization; household-level visibility where the Organization chooses it; two-factor authentication available to every user, required for ArcAngel personnel, and required for the Organization's staff unless the Organization turns that off.
• Audit logging of sign-ins and of viewing, changing, exporting and downloading sensitive records, visible to the Organization's administrators.
• Brute-force and abuse protection on sign-in and every public form.
• Backups of the database, encrypted with a key held offline and not by our hosting provider, restored and verified in a quarterly drill.
• Minimization. The Service neither requires nor uses a Social Security number. The Organization records one only where its own funders, programs or legal obligations call for it, and is responsible for that decision. Where it does, the number is encrypted, never indexed, searched or exported, and shown on every screen only as its last four digits. It is revealed in full only to a user holding a separate permission who states a reason, and every reveal and refused attempt is audited. It is never revealed to ArcAngel personnel or to anyone outside the Organization. No advertising or analytics trackers; alert emails to ArcAngel carry no record about any person.

Annex C — Sub-processors

Vendor	What for	Where	What it receives
DigitalOcean, LLC	Hosting, database and file storage	United States (New York City)	All Organization Data, encrypted as in Annex B
Backblaze, Inc.	An off-site copy of the database backups	United States (US West)	Encrypted database backups, with a key Backblaze does not hold; and a copy of every stored file as we store it, each document and upload encrypted under the Organization's own key and its logo as published; each copy kept no more than 90 days
Cloudflare, Inc.	DNS, TLS and protection from attack traffic	Global edge network	Requests in transit; retains no Organization Data
Brevo (Sendinblue SAS)	Sending the Service's email	European Union (France)	A recipient's address and that message: invitations, sign-in links, a volunteer's or tenant's own reminders, staff notices naming places and work-order numbers, and an Organization's thank-you letters and giving statements to its donors (what each gave; a statement as a PDF), and its notices of a gift made in honor or in memory of somebody to the people a donor names, and its membership renewal reminders; and, to somebody who asked an Organization for financial assistance on its public form, that their request arrived and where it stands (never an amount, a reason or a note); a volunteer's answer to a shift they asked for; a resident's or tenant's notice that a work order they reported is complete, or that a weekly budget was sent back (never its figures or notes); and our own messages to the Organization's administrators and billing contact about its subscription, its storage, a data export being ready (never its passphrase), and each step of an erasure; never a record about a Participant, its notes, or a document
The Organization's own mail server, if it sets one up	Sending the Organization's invitations, reminders, links, notices and letters to donors from its own address	Wherever the Organization's provider is	The same as Brevo would for those messages. That provider is the Organization's, chosen and contracted by it, not our Sub-processor; we connect to it only over TLS with a verified certificate, and never to a private address. Password resets and sign-in mail stay with Brevo
Stripe, Inc.	Collecting the Organization's own subscription fees	United States	The Organization's name, the address it chooses for invoices, and its plan; card and bank details go to Stripe directly, never through us; nothing about a Participant
Stripe, Inc.	Taking donations online, only if the Organization connects its own Stripe account	United States	The amount, what it is for, and the donor's name and email; card details go to Stripe directly, never through us
ProPublica, Inc. (Nonprofit Explorer)	Finding an organization's latest Form 990 revenue when it signs up	United States	The EIN typed at sign-up; nothing else
National Weather Service (NOAA)	The temperature on a lobby sign, only if the Organization turns it on	United States	A position rounded to about 10 km, worked out from the sign's zip code on our own servers; nothing about any person

Signatures

This Addendum takes effect automatically upon the Organization’s subscription to the Service or initial transfer of Organization Data. If the Organization requires a countersigned copy for its records, authorized representatives of each party may optionally execute below:

---

Questions about this document? Contact info@arcangelts.com.
ArcAngel Technical Services, LLC