Data processing addendum
Draft DPA. TrustMetrics Ltd (company number 12596565, registered office 20-22 Wenlock Road, London, England, N1 7GU) is the processor. The customer is the controller of Google Business Profile data and customer contact data they submit.
Questions about this addendum: support@trustmetrics.io.
For support, email support@trustmetrics.io or use the support form.
Subject matter
Processing is limited to hosting, displaying, and sending the data the customer puts into TrustMetrics so the customer can manage reviews and review requests. Duration is the subscription, plus the periods in the retention table below. It is the same table as the Privacy notice.
| Data | Retention |
|---|---|
| Account data | While the account is active |
| Billing and tax records | 6 years |
| Support messages | 2 years |
| Google review content | Up to 30 days after the last sync |
| Customer contacts and campaign data | Until you delete them, or 30 days after the subscription ends |
| AI usage ledger | Cost metadata only, not review text |
Instructions
The processor follows the customer’s instructions given through the product and this addendum. It does not sell that data and does not use it to train public models.
Security and sub-processors
The processor uses the sub-processors listed in the Privacy notice: Supabase, Vercel, Stripe, Resend, Twilio (the customer’s own account), Vercel AI Gateway / Anthropic, and Google. The processor gives account owners 30 days’ notice by email before it adds or replaces a sub-processor. The customer may object to that change.
Assistance and deletion
The processor will assist with data-subject requests that the customer cannot complete in the product. When the subscription ends, the processor deletes customer data within 30 days. Backups expire on the providers’ normal cycle. Daily backups are kept for 7 days.
International transfers
Some of our providers store data in the United States: Supabase, Vercel, Stripe, Anthropic (via Vercel AI Gateway), Google, Resend, and Twilio. For transfers out of the UK we rely on the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the UK Addendum, and on UK adequacy regulations where they apply (including the UK-US Data Bridge).
Governing law
This addendum is governed by the laws of England and Wales, including the UK GDPR and the Data Protection Act 2018.