This agreement forms part of the Terms of Service between InEngage LLC, a Wyoming limited liability company (“InEngage”, “we”), and the business using InEngage (“you”). It applies whenever InEngage processes personal data on your behalf: the details of your customers, your crew and anyone else you put into InEngage. You act as the controller of that data, or as a processor for another controller, in which case we act as your sub-processor. Where the EU or UK General Data Protection Regulation applies, this agreement sets out the terms its Article 28 requires.
Annex A describes the processing, Annex B our security measures and Annex C how personal data is protected when it leaves the EU or UK.
1. Instructions
- We process the personal data only on your documented instructions: these terms, and your use of InEngage’s settings and features. If the law requires us to process it otherwise, we will tell you first unless the law forbids it.
- We will tell you immediately if, in our opinion, an instruction breaks EU or UK data protection law.
2. Our obligations
We will:
- make sure everyone at InEngage who can access the data is bound by confidentiality;
- protect the data with the measures in Annex B, and review them regularly;
- help you, taking into account the nature of the processing and the information available to us, to answer requests from the people concerned and to meet your obligations on security, breach notification, data protection impact assessments and prior consultation with a supervisory authority;
- make available the information needed to show we meet this agreement, and allow and contribute to audits, including inspections, by you or an auditor you appoint, as data protection law requires. We will normally arrange an audit with reasonable notice, during business hours, and in a way that protects other customers’ data and InEngage’s security. Each party bears its own costs.
3. Your obligations
You are responsible for having a lawful basis for the data you collect and for contacting people, for the questions you add to your booking form, for who you share customer and crew links with, and for the instructions you give through InEngage.
4. Sub-processors
You authorise us to use the sub-processors below.
| Sub-processor | Service | Data it receives |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, bot checks, custom domains | All personal data we process for you; IP addresses for bot checks |
| Resend | Email delivery | Recipient, reply-to address, subject and message text of the emails sent for you |
| Google LLC (Geocoding) | Turning a job address into a map position | The address typed into your booking form |
Our other providers (Google Places, Google Fonts, Anthropic, Firecrawl, Polar, CARTO and Nager.Date) do not receive personal data we process for you; see our Privacy Policy.
- We will tell you at least 30 days before we add or replace a sub-processor, by email to the business’s owner and on this page.
- If you object on reasonable data protection grounds, we will work with you to address the concern. If we cannot, you may stop using the affected service before the new sub-processor starts processing your data.
- Each sub-processor is bound by data protection terms at least as protective as these, and we remain responsible to you for how it meets them.
5. Requests from the people concerned
Requests from your customers about their data go to you. In InEngage you can correct a customer’s details and remove photos at any time, delete a new request together with its customer, and erase a customer. Erasing removes their name, contact details, address, answers, messages, notes and photos; amounts, dates and the activity history stay so your books still add up, including any note you wrote on a payment. An owner can download the business’s records as a file. For anything these tools do not cover, email us and we will help.
6. Personal data breaches
If we become aware of a personal data breach affecting data we process for you, we will notify you without undue delay, with what we know at the time: what happened, the data and people likely to be affected, the likely consequences and what we are doing about it. We will send further details as we learn them.
7. End of processing
- While a business is paused, its records are kept. We will email the owner at least 60 days before we delete a paused business.
- When you stop using InEngage for a business, an owner can download its records first. At your choice, we will then delete or return the personal data we process for you within 30 days of your request, unless the law requires us to keep it.
- Records deleted from our live database can remain in our database backups for up to 30 days before they are gone.
8. Contact
Data protection questions: admin@inengage.com.
Annex A: Details of the processing
- Subject matter and duration: providing InEngage to you, for as long as you use it, then as set out in section 7.
- Nature and purpose: receiving booking requests, sending and showing quotes, keeping booking, job and payment records, sending the emails you ask for, and showing job sheets to your crew.
- People concerned: your customers and the people who send you requests; your crew members.
- Personal data: names, phone numbers, email addresses, job addresses and their map positions, request details and answers, photos, messages, quote, booking and payment records, and when a customer opened their quote page and read your messages.
- Special categories: we do not process special categories of data on purpose. Do not ask for them in your booking form unless you have a lawful basis to collect them.
Annex B: Security measures
- All traffic over HTTPS, with HSTS.
- Database encrypted at rest. Photos kept in private storage and shown only through links that expire after 24 hours.
- Location, camera and other details removed from photos before storage. Only JPEG, PNG and WebP photos are accepted, and the original file is never stored.
- Every request is checked on our servers for the caller’s business and role, and automated tests check that one business cannot read or change another’s records.
- Customer and crew links use long random codes. A customer link can be replaced, and the old one stops working at once. Crew links stop working 14 days after the job ends.
- Script policy, cross-site request protection and rate limits on public pages; bot checks on sign-up and booking forms.
- Passwords and one-time links stored only in hashed form; two-step sign-in available to every account.
- Only InEngage staff who need it to run the service, or to answer your support request, can reach stored data.
- The database can be restored to any point in the last 30 days, so service can be brought back after an incident.
- Security is tested as the service changes: automated tests run on every change, including the tests above.
Annex C: International transfers
InEngage LLC is in the United States.
- EU: where the EU GDPR applies to personal data you transfer to us, the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 form part of this agreement: Module Two where you are a controller, Module Three where you are a processor. Annex A of this agreement provides the information for Annex I of the Clauses, and Annex B for Annex II. Clause 7 applies; under Clause 9 the general written authorisation option applies, with the notice in section 4; the option in Clause 11 does not apply; the Clauses are governed by the law of Ireland, and disputes go to the courts of Ireland.
- UK: where the UK GDPR applies, the International Data Transfer Addendum issued by the UK Information Commissioner forms part of this agreement, completed with the same information.
- Our sub-processors: for transfers to them we rely on their certification under the EU–US Data Privacy Framework (and its UK extension) or on the standard contractual clauses in their data processing terms.
You can ask for a copy of these safeguards at admin@inengage.com.