Data Processing Agreement

Last updated: August 31, 2026

This Data Processing Agreement ("DPA") is part of our Terms of Service and applies whenever ParseAPI processes personal data on your behalf. It applies to every plan automatically. No separate signature is needed. If you require a countersigned copy for your records, email Email.

1. Definitions

"Personal data", "processing", "controller", "processor", and "data subject" have the meanings given in the EU General Data Protection Regulation (GDPR). Equivalent terms in the CCPA and other privacy laws ("business", "service provider", "personal information") apply the same way.

2. Roles

For data you send through the API and bulk tools (the values you look up and the files you upload), you are the controller and ParseAPI is your processor. If you act on behalf of your own clients, you are our instruction-giver and remain responsible for having the rights to send us that data.

For your own account, billing, and site data, ParseAPI is the controller as described in the Privacy Policy. That data is not covered by this DPA.

3. What we process

• Subject matter. Operating the parseAPI lookup and validation services, including the API, bulk file jobs, and integrations.
• Nature and purpose. Receiving values you submit, returning results, and keeping operational logs so your dashboards and billing work.
• Categories of data. Whatever you send: typically IP addresses, email addresses, phone numbers, postal addresses, and names, plus request metadata (endpoint, timing, status, parameters).
• Data subjects. Your users, customers, and contacts.
• Duration. While your account is active, plus the retention windows below.

4. Our obligations

• We process personal data only to provide the service and follow your documented instructions. Using the service is the instruction.
• People with access to personal data are bound by confidentiality obligations.
• We apply the technical and organizational measures described on the Security page, including TLS 1.3 in transit, passwordless authentication, scoped API keys, and role-based team access.
• We assist you, as reasonably needed, with data subject requests, security assessments, and your own compliance obligations.
• We notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information we have at the time.

5. Subprocessors

You authorize us to use subprocessors to run the service. They only receive what their job requires and are bound by data protection terms at least as protective as this DPA. We remain responsible for their performance. Current categories:

• Hosting and infrastructure providers
• Database and logging providers for API usage
• Stripe for payments
• Email delivery for auth and notices (e.g. Resend)

A current named list is available on request from Email. We will update this page when categories change. If you object to a new subprocessor on reasonable data protection grounds and we cannot resolve it, you may cancel the affected service.

6. Data subject requests

If a data subject contacts us directly about data we process for you, we will refer them to you and will not respond on your behalf beyond that, except where the law requires us to.

7. Audits

We make information reasonably necessary to demonstrate compliance available on request, including answers to security questionnaires and this documentation. Where the GDPR grants you an audit right that this does not satisfy, an audit may be conducted at most once per year, at your expense, on reasonable notice, under confidentiality, and without access to other customers' data.

8. International transfers

We process data in the United States and other countries where our providers operate. Where GDPR or UK GDPR requires a transfer mechanism, the EU Standard Contractual Clauses (module two, controller to processor) and the UK Addendum are incorporated into this DPA by reference, with you as data exporter and ParseAPI as data importer.

9. Retention and deletion

• Request logs are kept for a limited operational window (weeks to a few months) and then dropped or aggregated, as described in the Privacy Policy.
• Bulk job files and results delete 30 days after the job completes.
• When your account closes, we delete or anonymize personal data we process on your behalf within 90 days, except records we must keep for legal or billing reasons.

10. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms on data protection matters, this DPA wins. If it conflicts with the Standard Contractual Clauses, the Clauses win.

11. Changes

We may update this DPA to reflect new laws or service changes. The date at the top changes when we do. Material changes will not reduce the protections here.

Part of the Terms of Service. Questions or a countersigned copy: Email