Data Processing Agreement — Stonebridge CRM

Effective date: 2026-09-26

Stonebridge CRM, LLC, a Florida limited liability company ("Stonebridge," "we," "us")
Contact: info@stonebridgecrm.com

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Stonebridge and the organization that subscribes to the Service (the "Organization"). It applies wherever Stonebridge processes personal information on the Organization's behalf. If this DPA and the Terms conflict on a matter of data processing, this DPA controls.

1. Roles

The Organization decides what personal information about its members, households, donors, and staff is recorded in the Service, why, and who on its staff may see it. The Organization is the controller of that information. Stonebridge is its processor, acting only on the Organization's documented instructions, which are: the Terms, this DPA, and the Organization's own use of the Service's features. Stonebridge is the controller only of the limited account and technical data it collects to run and secure the Service itself, as described in the Privacy Policy.

2. What we process, and for whom

The categories are those the Privacy Policy describes: member and household records (names, contact details, relationships, membership status), giving and billing records (donations, pledges, charges, payments, invoices), religious-lifecycle records the Organization chooses to keep (Hebrew names, memorial dates, family remembrances), donor details submitted through the Organization's public website, and staff sign-in and action records. Data subjects are the Organization's members and their households, its donors, and its staff. Because many Organizations are religious communities, the fact that a person appears in the Organization's records may itself indicate religious affiliation; Stonebridge treats all such information with the same protections regardless of sensitivity.

3. Our obligations as processor

Stonebridge will:

• Process only on instructions. Use the Organization's data solely to provide, secure, support, and improve the Service for that Organization. Never sell it, rent it, use it for advertising, or use it to train artificial-intelligence models. If we believe an instruction would violate applicable law, we will say so and may pause the affected processing until it is resolved.
• Keep it confidential. Limit access to personnel and subprocessors who need it to perform the Service and who are bound by confidentiality obligations. Our own administrative access to an Organization's production data requires a logged, time-limited, reason-stated grant, and those grants form a permanent audit record.
• Protect it. Maintain the safeguards described in Section 5.
• Help the Organization meet its own duties. Refer any data-subject request we receive to the Organization within five business days; provide the export and deletion capabilities in Section 7; and provide the information the Organization reasonably needs to assess our processing and respond to its own regulators or auditors.
• Tell the Organization about incidents. Notify the Organization without undue delay, and in any case within 72 hours of confirming, any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to the Organization's data. The notice will describe what we know: the nature of the incident, the data and data subjects likely affected, the steps taken, and a contact. We will update it as facts are established.
• Delete or return at the end. See Section 7.

4. Subprocessors

The Organization authorizes Stonebridge to use the subprocessors listed in the Privacy Policy, which at the effective date are: Supabase (database, authentication, and server functions, hosted on Amazon Web Services in the US East (N. Virginia) region), Stripe (payment processing, for Organizations that enable it; card details go directly from the payer to Stripe and never pass through Stonebridge), Resend (transactional email), Vercel (application and website hosting, and DNS), Sentry (error monitoring; receives technical error reports), and Google Workspace (Stonebridge's own business email). Each processes data only as needed for its function, under its own published terms and security commitments.

Stonebridge will give the Organization at least 30 days' notice by email before adding or replacing a subprocessor that will process the Organization's data. If the Organization objects on reasonable data-protection grounds and we cannot resolve the objection, the Organization may terminate the affected Service on notice, and Section 7 applies. Stonebridge remains responsible to the Organization for its subprocessors' performance of the obligations in this DPA.

5. Security measures

These are the safeguards Stonebridge operates today.

• Isolation. Every Organization's data is separated from every other Organization's by access controls enforced in the database itself (row-level security), not only in application code.
• Authentication. Passwords are stored only as one-way hashes, with minimum-strength and known-breach checks applied by our authentication provider. Multi-factor authentication is enforced for Stonebridge's own platform administrators and for Organization staff; a password alone does not grant access to an Organization's records.
• Administrative access. Stonebridge's own access to an Organization's production data is gated behind a logged, time-limited, reason-stated grant, reviewable by the Organization on request.
• Encryption. Data is encrypted in transit. Data at rest is encrypted by our hosting provider.
• Backups. The database is backed up daily on a rolling seven-day cycle, and the restore procedure is rehearsed, not assumed. Uploaded files (an Organization's website images and logos) are not currently included in these backups; a separate copy is planned before Organizations rely on the Service for media they cannot re-supply.
• Monitoring. Errors are monitored; security-relevant administrative actions are recorded in audit tables that ordinary users cannot alter.
• Payment data. Stonebridge never receives, stores, or transmits payment card numbers.

What we do not claim. Stonebridge holds no SOC 2 report and no PCI-DSS attestation at this time; we minimize card-data scope architecturally instead. We do not yet offer a contractual uptime guarantee. We will not describe a safeguard we do not operate.

6. Audits and information

On the Organization's reasonable written request, no more than once a year unless an incident or a regulator requires otherwise, Stonebridge will provide the documentation and answers the Organization needs to verify our compliance with this DPA: our security controls description, our subprocessor list, our backup and restore records, and summaries of relevant audit records concerning the Organization's own data. Where a question can only be answered by inspecting systems, we will do so ourselves and report the result; we do not grant third parties direct access to production infrastructure shared with other Organizations.

7. Export, return, and deletion

At any time during the term, the Organization may request an export of its data, and we will provide it in a reasonable, machine-readable format. On termination, and on the Organization's request, we will export the Organization's data to it and then delete it from the live Service, subject to our rolling backup cycle (data may persist in backups for up to seven days before aging out) and to any records we are legally required to retain. We will confirm deletion in writing. Where a regulator or a legal obligation requires us to keep some record, we will tell the Organization what and why.

8. International transfer

Stonebridge is operated from the United States and stores data in the United States. The Service is offered to Organizations in the United States. If an Organization has members or donors outside the United States, it is responsible for determining that its own collection and our processing are lawful in those places; we will assist with reasonable information.

9. Liability

Liability under this DPA is subject to the limitations in the Terms of Service. Nothing in this DPA limits liability that cannot lawfully be limited.

10. Term, changes, and governing law

This DPA lasts as long as Stonebridge processes the Organization's data. We may update it to reflect changes in our processing, subprocessors, or the law, with notice to the Organization before material changes take effect; changes that reduce protections for data already in the Service take effect only after that notice. This DPA is governed by the laws of the State of Florida, without regard to conflict-of-laws rules, with exclusive venue in the state or federal courts of Palm Beach County, Florida, matching the Terms.

11. Contact

info@stonebridgecrm.com · Stonebridge CRM, LLC, 4436 James Estate Lane, Lake Worth, FL 33449, USA.