Data Processing Addendum
Last reviewed: May 10, 2026. This DPA supplements the Terms of Service and Privacy Policy. By using EarnDrift, you accept this DPA. Counsel-negotiated DPAs are available for enterprise accounts — email legal@earndrift.com.
1. Definitions
"Customer" means the EarnDrift account holder. "Personal Data" means information relating to an identified or identifiable natural person processed by EarnDrift on Customer's behalf, including contractor names, addresses, email, phone, Tax Identification Numbers, and payment history. "Applicable Privacy Law" means the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), Colorado Privacy Act (CPA), Virginia Consumer Data Protection Act (VCDPA), Connecticut Data Privacy Act (CTDPA), Texas Data Privacy and Security Act (TDPSA), and any other comprehensive U.S. state privacy law applicable to Customer's data.
2. Roles
Customer is the "business" / "controller" of Personal Data. EarnDrift is a "service provider" / "processor" acting only on Customer's documented instructions. EarnDrift will not (a) sell or share Personal Data, (b) retain, use, or disclose Personal Data outside of the direct business relationship between Customer and EarnDrift, or (c) combine Personal Data with data from other sources except as permitted to provide the Service.
3. Subprocessors
Customer authorizes EarnDrift to engage the subprocessors listed at earndrift.com/legal/subprocessors. EarnDrift will notify Customer of new or replacement subprocessors by updating that page at least 30 days before the change takes effect. Customer may object in writing; EarnDrift will use reasonable efforts to provide an alternative or, if none is reasonably available, Customer may terminate the affected portion of the Service.
4. Security
EarnDrift implements appropriate technical and organizational measures to protect Personal Data, including: TLS in transit; PostgreSQL pgcrypto encryption at rest for Tax Identification Numbers; Row-Level Security policies enforced at the database layer; secret management with credentials never committed to source control; least-privilege administrative access; and an internal incident response process. See earndrift.com/security for the current summary.
5. Data Subject Requests & Deletion
EarnDrift will assist Customer in responding to data subject access, correction, deletion, and portability requests. Customer can self-serve account deletion from Settings; on deletion, all contractor records, payment data, uploaded documents, and profile data are permanently removed from primary systems within 30 days, and from backups within 90 days.
6. Breach Notification
EarnDrift will notify Customer of any confirmed data breach affecting Customer's Personal Data without undue delay and within the timeframes required by Applicable Privacy Law, and will provide reasonable cooperation with Customer's notification obligations. Notifications will describe the nature of the incident, the categories of data affected, and the steps EarnDrift has taken or is taking in response.
7. International Transfers
EarnDrift processes Personal Data in the United States. EarnDrift does not knowingly process data of EU/UK/Swiss data subjects in the ordinary course; if a Customer's use of the Service requires such processing, additional safeguards (such as Standard Contractual Clauses) must be agreed in writing.
8. Audits
On reasonable written request and no more than once per year, and subject to confidentiality, EarnDrift will provide responses to Customer's reasonable security questionnaires sufficient to demonstrate compliance with this DPA. EarnDrift may satisfy this obligation by providing a current security overview, third-party attestations (when available), or a completed industry-standard questionnaire (e.g., CAIQ).
9. Term & Return / Deletion
This DPA is effective for as long as EarnDrift processes Personal Data on Customer's behalf. On termination, EarnDrift will return or delete Personal Data as described in Section 5, except where retention is required by law (e.g., financial-records retention).