Version 2026-10-02 · Effective October 2, 2026

Data Processing Addendum

This Data Processing Addendum ("DPA") is between the consultancy customer ("Controller") and Measure IH, LLC ("Processor," "MeasureIH") and forms part of the MeasureIH Terms of Service. It applies when MeasureIH processes personal information on the Controller's behalf to provide Proposal Studio and the client portal.

1. Roles

The Controller determines the purposes of processing customer content (proposals, contacts, portal readers, team members). Measure IH, LLC processes that information only to operate, secure, and support the Service, and as required by law.

2. Instructions and confidentiality

Processor will process personal information only on documented instructions from the Controller, including this DPA and in-product configuration. Processor personnel who access customer content are bound by confidentiality obligations.

3. Security

Processor maintains organization-scoped access rules, authenticated server APIs for portal access, encryption in transit, vendor encryption at rest, private document storage with short-lived download URLs, and studio multi-factor authentication.

4. Sub-processors

Controller authorizes the following sub-processors: Google Firebase (authentication and database), Vercel (hosting and file storage), Resend (transactional email), ClickSend and optionally Twilio (transactional SMS), Stripe (payments), Sentry (error monitoring, no session replay), and optional AI providers (Google Gemini, OpenAI, Anthropic, or OpenRouter) when the Controller uses AI features. SDS text and proposal content submitted to those features are sent to the selected AI provider to generate results.

5. Assistance, export, and deletion

Workspace administrators can download a JSON export of workspace records from Settings → Data, or permanently delete the workspace. File downloads are omitted from the JSON export. PDF and Excel bulk export are not available yet. Customer-content retention after deletion will be stated when counsel finalizes the Customer Data Protection agreement. Processor will assist with reasonable data-subject requests that cannot be completed in-product. Authentication logs are retained for 90 days. Proposal and portal audit records are retained for the life of the workspace unless the Controller deletes the workspace.

6. International transfers

Sub-processors may process data in the United States and other countries where they operate. Transfers are subject to those providers' terms and applicable transfer mechanisms.

7. Contact

Measure IH, LLC: legal@measureih.com.