Data Processing Addendum

When you use Toasted to collect Client information, you are the data controller (or “business” under CCPA). You determine what Client data is collected and why. Toasted acts as a data processor (or “service provider”), storing and processing that data only as necessary to provide the Services you use.

Client personal data belongs to your business relationship with them. Toasted does not use Client data for our own marketing or sell it to third parties.

Categories of personal data processed on behalf of Artists include:

• Client contact information (name, phone number, email)
• Booking and appointment history
• Payment method tokens and transaction records (via Stripe)
• SMS and email message content between Artist and Client
• Preferences, notes, photos, and consultation data you enter
• SMS consent records (TCPA)
• Signed service-agreement snapshots
• Calendar Sync metadata when you opt in (external calendar ids, encrypted OAuth tokens for Google, export mappings, and event titles/times derived from Toasted appointments)

We process Client data solely to provide the Services, including:

• Storing Client profiles for your CRM
• Sending automated or Artist-initiated SMS/email where consent and settings allow
• Processing bookings and payments
• Displaying history and records in the app
• Retaining signed agreements and consent archives as required
• Exporting schedule events to Apple or Google Calendar when you enable Calendar Sync

We do not sell, rent, or share Client personal data with third parties for their own marketing. Mobile numbers and message content are not shared with third parties for those parties’ promotional use.

By using Toasted to communicate with Clients, you confirm that:

• You have obtained valid SMS consent before studio texts are sent
• You comply with applicable privacy and telemarketing laws (including TCPA, and CCPA/GDPR where they apply)
• You will honor Client requests to access, correct, delete, or opt out of communications
• You will notify us promptly if you learn consent was revoked outside the STOP flow
• You will not instruct us to process data unlawfully

Toasted uses the following subprocessors. Each is engaged under agreements appropriate to their role:

• Supabase — database, authentication, file storage
• Stripe — payment processing and card tokenization
• Twilio — SMS delivery and phone number provisioning
• Resend — email delivery
• Vercel — web hosting
• Apple — APNs; EventKit runs on-device for Apple Calendar Sync
• Google — Google Calendar API when an Artist connects Google Calendar Sync; Analytics only with website consent
• PostHog — application error monitoring (not Client marketing profiles)

We will provide reasonable notice of material subprocessor changes. Continued use after notice constitutes acceptance unless you terminate under the Terms.

Technical and organizational measures include:

• Row-level security so Artists cannot access each other’s Client data
• TLS in transit; encryption at rest via our infrastructure providers
• Authentication required for Artist data access
• No plain-text storage of payment card numbers (Stripe tokens only)
• Google Calendar OAuth refresh tokens stored encrypted when Calendar Sync is enabled

We retain Client data while your Toasted account is active. After subscription cancellation, data is generally retained about 45 days past the final paid period, then purged, with reminder emails before purge as described in our Privacy Policy. Limited consent and agreement archives may be retained up to four years for legal defense. Request export before deletion via support@toastedtanz.com.

If a personal-data breach affecting your Clients’ information occurs, we will notify you without undue delay and no later than 72 hours after becoming aware, describe what we know, and cooperate with investigation and regulatory notification requirements that apply to you as controller.

If a Client contacts you for access, correction, or deletion, we will assist within a reasonable timeframe. Contact support@toastedtanz.com to initiate assistance. Clients may also email us and we will help route the request to the controlling Artist.

Processing primarily occurs in the United States. By using the Services you instruct us to process and transfer data as needed to operate the platform with the subprocessors listed above.

We may update this DPA for subprocessors, law, or service features. Material changes will be reflected by the “Last updated” date and, where appropriate, additional notice. Continued use constitutes acceptance.