Data Processing Addendum
How we process the personal data of the people you send cards to, on your instructions.
Effective October 26, 2026 · Last updated October 26, 2026
This Data Processing Addendum ("DPA") is part of the notecardHQ Terms of Service, or any other agreement for notecardHQ (the "Agreement"), between Canary Canary LLC ("notecardHQ", "Processor") and the customer ("Customer", "Controller"). It applies when notecardHQ processes personal data for the Customer. If the Customer is itself a processor for someone else (for example an agency or platform sending cards for its clients), notecardHQ is its subprocessor and this DPA applies the same way.
1. Definitions
"Data Protection Laws" means the laws that apply to the processing, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, and US state privacy laws including the CCPA. "Personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings in the GDPR. "Service provider" has the meaning in the CCPA.
2. What we process
| Item | Detail |
|---|---|
| Subject matter | Writing, addressing and mailing handwritten cards the Customer orders |
| Duration | The term of the Agreement, plus the deletion period in section 9 |
| Nature and purpose | Receiving, storing, verifying (US addresses), reviewing, rendering into handwriting, writing by robot, mailing, and reporting status |
| Data subjects | People the Customer sends cards to; the Customer's users |
| Personal data | Recipient name, company and postal address; note text; any context fields the Customer sends; the Customer's identifiers for the recipient (external id); production status, dates and tracking number where there is one |
| Special categories | None intended. The Customer will not send special category data or data about children unless it has told us in writing and has a lawful basis. |
3. Our obligations
notecardHQ will:
- Instructions. Process personal data only on the Customer's documented instructions (the Agreement, this DPA, and the Customer's use of the service), unless the law requires otherwise, in which case we will tell the Customer first unless the law forbids it. We will tell the Customer if we think an instruction breaks Data Protection Laws.
- Confidentiality. Make sure everyone who handles the data is bound to keep it confidential.
- Security. Keep the measures in Annex 2 in place.
- Subprocessors. Follow section 5.
- Help with requests. Help the Customer answer data subject requests (access, correction, deletion, objection, portability), taking into account what the service lets the Customer do itself. If a recipient contacts us directly, we will pass the request to the Customer and not answer it ourselves unless the Customer asks us to.
- Help with compliance. Give reasonable help with data protection impact assessments and consultations with authorities about the service.
- Breaches. Tell the Customer without undue delay, and in any case within 48 hours after we confirm a personal data breach affecting the Customer's data, with what we know and what we are doing, and keep the Customer updated.
- Audits. Make available the information needed to show compliance with this DPA, and allow reasonable audits by the Customer or its auditor, no more than once a year, on 30 days' notice, during business hours, at the Customer's cost, unless a breach or an authority requires otherwise. notecardHQ holds no third-party security certification; we answer security questionnaires instead.
CCPA. For recipient data, notecardHQ is a service provider. We will not sell or share it, keep, use or disclose it for any purpose other than providing the service, or combine it with other personal data except as the CCPA allows. We understand these restrictions and will comply with them.
4. The Customer's obligations
The Customer is responsible for having a lawful basis to send each card, for giving recipients any notice the law requires, for the accuracy of what it sends, and for its instructions complying with Data Protection Laws.
5. Subprocessors
The Customer authorizes the subprocessors below. We will give at least 14 days' notice by email, and on this page, before adding or replacing one. The Customer may object on reasonable data protection grounds within that time; if we cannot resolve the objection, the Customer may end the affected service and get a refund of its unused prepaid balance. We impose data protection terms on each subprocessor that protect the data at least as well as this DPA, and we remain responsible for them.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Convex | Database, file storage and backend functions | All account and recipient data | Provider's US infrastructure |
| Vercel | Hosts the portal, the API endpoints and this website | Requests passing through, request logs | Provider's US infrastructure |
| Fly.io | Hosts our Shopify and HubSpot apps | Send records from those platforms; encrypted keys and tokens | United States (Newark, New Jersey) |
| EasyPost | US address verification | Recipient name, company and US address | Provider's US infrastructure |
| Resend | Sends sign-in code emails | Sign-in email address | Provider's US infrastructure |
| Google Workspace | Our email | Whatever you email us | Google's infrastructure |
| Whop | Payment processing for saved cards, top-ups and invoices | Payer name, email and card details (held by Whop, not by us) | Provider's US infrastructure |
| Slack | Internal new-note alerts to our team. Only if enabled for your workspace. | Recipient name, city and country; for notes we write from context, the first 120 characters of that context | Provider's US infrastructure |
| Anthropic | Writes a note from the context you send. Only if enabled for your workspace. | The context sent with that note | Provider's US infrastructure |
| Postal services | Deliver the card: the US Postal Service, and for international cards the destination country's postal operator | Name and address on the envelope | United States and the destination country |
Handwriting rendering and robot production happen on notecardHQ's own computers in our New York office, not at a subprocessor.
6. International transfers
Data is processed in the United States. Where Data Protection Laws require a transfer mechanism for personal data from the EEA, the UK or Switzerland, notecardHQ will, on the Customer's request, sign the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two (controller to processor) or Module Three (processor to processor) as fits, completed with the details in section 2 and the Annexes below. For UK transfers we will add the UK International Data Transfer Addendum, and for Swiss transfers the amendments the Swiss FADP requires. To request them, email inquiry@notecardhq.com.
7. Data subject requests from platforms
- Shopify: when Shopify sends a customer redaction request, the notecardHQ Shopify app removes that customer's data from its own records and asks notecardHQ to delete the notes sent for them. A shop redaction request, 48 hours after uninstall, deletes everything the app holds for the shop and asks notecardHQ to delete the shop's notes.
- HubSpot: when HubSpot reports a contact deleted, the HubSpot app wipes that contact's stored data, stops any pending card, and asks notecardHQ to delete the notes sent for them.
- A card already prepared for our robots or written when the request arrives is mailed, and its data is cleared at that moment.
8. Our own data
notecardHQ is a controller, not a processor, for the Customer's account and billing data, and for security records. Our Privacy Policy covers those.
9. Return and deletion
When the Agreement ends, or earlier on the Customer's written request, we will delete the Customer's personal data within 30 days, unless the law requires us to keep it, and confirm in writing. Before deletion the Customer can ask us for an export of its notes.
Our handwriting system keeps a bank of single written words with no link to any note, Customer or recipient. A banked word can be a first name; we remove a word on request.
10. Liability and order of precedence
Each party's liability under this DPA is subject to the limits in the Agreement, except where Data Protection Laws do not allow it. If this DPA conflicts with the Agreement, this DPA wins on data protection; Standard Contractual Clauses signed under section 6 win over both.
Annex 1: Parties
- Data exporter (Controller): the Customer, as named in its workspace. Contact: the workspace's account email.
- Data importer (Processor): Canary Canary LLC (notecardHQ), 6 W 18th St, Suite 2C, New York, NY 10011, USA. Contact: inquiry@notecardhq.com.
Annex 2: Security measures
As described on our Security page, in summary:
- All traffic to the portal, API and apps uses HTTPS. Card files move between our own computers over encrypted SSH.
- API keys are stored only as SHA-256 hashes. The Shopify and HubSpot apps encrypt stored API keys and OAuth tokens with AES-256-GCM.
- Payment cards are held by our payment processor; we keep only the brand and last four digits.
- Sign-in is by one-time email code (8 digits, valid 15 minutes). Workspace access is limited to the workspace's own members; staff access is limited to a named list of notecardHQ staff.
- Incoming webhooks from Shopify and HubSpot are verified by signature; outgoing webhooks we send are signed.
- Each workspace's data is separated in every query; a request for another workspace's record is answered as not found.
- Test keys never produce real cards; test notes are marked and never rendered or mailed.
- Changes to notes and settings are recorded in an audit log with who made them.
- Recipient data is cleared on the schedule in our Privacy Policy; outgoing webhook payloads are deleted after 30 days and public previews after 24 hours.
- An incident response process, with switches to stop a workspace, an integration, or production at once.
Privacy Policy · Terms of Service · Data Processing Addendum · Security