How to sign
This DPA is incorporated into the Terms of Service and applies automatically; you do not need to sign anything for it to apply. If you need a countersigned copy for your records, request a signed DPA by email to hello@toolports.com with your company name, address and signer, and we will return a countersigned PDF.
1. Parties and roles
Toolports is a sole proprietorship: an individual doing business as Toolports, not a corporation or limited-liability company. In this DPA, Toolports is the “Provider” and the customer that accepted the Terms is the “Customer.” For Customer Personal Data, Customer is the controller (or “business”) and Toolports is the processor (or “service provider” / “contractor” under the California Consumer Privacy Act). If Customer acts for another controller, Toolports is a subprocessor and Customer will pass these terms on.
2. Definitions
“Customer Personal Data” means personal data in the data Toolports processes for Customer through the service, including records read from or written to Connected Services (such as QuickBooks Online and Jobber), files uploaded to a port, and audit records. “Applicable Data Protection Laws” means US federal and state privacy laws that apply to that processing, including the CCPA/CPRA and comparable state laws. Other capitalized terms have the meanings in the Terms.
3. Scope and duration
This DPA applies while Toolports processes Customer Personal Data and ends when that processing ends under section 11. If this DPA conflicts with the Terms on data protection, this DPA controls.
4. Customer instructions
Toolports processes Customer Personal Data only on Customer’s documented instructions. The Terms, your port settings (read/write permissions, allowed tools, confirm steps) and the requests made by your authorized agents and users are your instructions. Toolports will not sell or share Customer Personal Data, will not retain, use or disclose it outside the direct business relationship or for any purpose other than providing the service, and will not combine it with data from other sources except as Applicable Data Protection Laws permit. Toolports will tell Customer if it believes an instruction violates the law or if it can no longer meet its obligations.
5. No AI training on customer data
Toolports will not use Customer Personal Data or any other customer data to train, fine-tune, develop or improve any artificial-intelligence or machine-learning model, whether its own or a third party’s. Toolports does not run its own model over your data; your AI agent and model provider are chosen and governed by you.
6. Security
- OAuth tokens for Connected Services are encrypted at rest; API keys are stored as hashes.
- All traffic uses TLS; port servers are reachable only through a TLS proxy.
- Writes are off by default, scoped per connection and per tool, with optional confirm steps.
- Files uploaded for attachment are not kept after they are attached to the Connected Service; unattached uploads are deleted within 24 hours.
- Audit logs (tool, outcome, record ids; no secrets or request bodies) are kept 90 days, then deleted.
- Access to production systems is limited to the operator. [PLACEHOLDER: confirm MFA on Vercel, Neon, DigitalOcean, Stripe and GitHub before stating it here.]
Toolports personnel with access to Customer Personal Data are bound by confidentiality. Toolports will notify Customer without undue delay, and in any case within 72 hours, after confirming a security breach affecting Customer Personal Data, with the information Customer reasonably needs to meet its own obligations.
7. Data subject requests
Toolports will forward any request it receives from an individual about Customer Personal Data to Customer and will reasonably help Customer respond, taking into account the nature of the processing. Most records live in your Connected Service, where you can access, correct or delete them directly.
8. Customer responsibilities
Customer is responsible for having a lawful basis and all notices and consents needed for Toolports to process Customer Personal Data, for the accuracy of that data, and for the configuration of its agents and permissions. Customer will not send sensitive data (such as health, biometric or government ID data) through the service unless required by its own records and permitted by law.
9. Subprocessors
Customer generally authorizes Toolports to use the subprocessors on the Subprocessors page. Toolports imposes data-protection terms on each that are no less protective than this DPA and remains responsible for their performance. Toolports will update that page, and email Customers who ask for notice, at least 15 days before adding or replacing a subprocessor. Customer may object on reasonable data-protection grounds within that period; if we cannot resolve it, Customer may cancel the affected service and receive a pro-rated refund of prepaid fees. Connected Services you choose to connect (Intuit, Jobber) are not Toolports subprocessors.
10. Audits
Once a year, or when a regulator requires it, Customer may request written information reasonably necessary to show compliance with this DPA. Toolports will answer reasonable security questionnaires. On-site audits require reasonable notice, confidentiality and Customer’s cost.
11. Return and deletion
When Customer removes a connection, Toolports stops processing through it and deletes its stored tokens. When the service ends, Toolports will stop processing Customer Personal Data and delete it within 30 days, except audit logs, which expire on their 90-day schedule, data in backups until they rotate, and records the law requires us to keep. Customer data in your Connected Services stays there and is not affected.
12. Location
Toolports and its subprocessors process data in the United States (and, for Jobber, in Canada where the Connected Service operates). Customers that need EU/UK transfer terms should contact us.
13. Miscellaneous
Liability under this DPA is subject to the limitations in the Terms. This DPA is governed by the law chosen in the Terms. Toolports may update this DPA to reflect changes in law or subprocessors and will not reduce its protections for the current subscription term without Customer’s agreement.
Annex: Details of processing
- Data subjects: Customer’s users; vendors, customers, employees and contractors who appear in Customer’s Connected Service records.
- Personal data: names, emails, phone numbers, addresses, billing and payment records, job and invoice details, and other fields the Connected Service exposes under the scopes Customer authorizes; user account and authentication details; IP address and request metadata.
- Sensitive data: not intended. Bank account fragments may appear in accounting records; they are processed only to complete the request.
- Frequency: continuous, per agent request.
- Nature and purpose: relaying requests between Customer’s AI agents and its Connected Services, enforcing permissions, logging for security and billing.
- Retention: as in sections 6 and 11.