Legal
Data Processing Addendum
Last updated: August 17, 2026 · Published by American Coastal Holdings, LLC. This Addendum forms part of the Terms of Service.
1. Roles
Your shop decides what customer information it collects and why, so your shop is the controller of that data. American Coastal Holdings, LLC processes it only to provide SprocketSuite, which makes us the processor. We act on your documented instructions, and using the product is such an instruction.
2. What we process
Categories of people: your customers, and your staff.
Categories of data: customer names, phone numbers, email addresses, postal addresses, bike and serial details, service history, signed waivers and signatures, photos attached to jobs, rental and deposit records; and for staff, names, usernames, access tiers, PIN hashes, pay rates, and time-clock punches.
Card data: we do not receive or store card numbers. Card transactions run through Square, which returns only a payment reference, card brand, last four digits, and a receipt link.
Purpose and duration: to run the shop-management features you use, for as long as your license is active plus the wind-down window in section 7.
3. Where the data actually lives
By default SprocketSuite keeps your records on your own computers, inside the browser profile that runs the app. If you do not enable cloud sync, we hold no copy of your shop data at all. If you enable cloud sync, a copy is stored in the hosted database listed in section 4 so your devices stay current.
4. Subprocessors
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Hosted database for optional cloud sync (shop records) | United States |
| Cloudflare | Hosting, DNS, and delivery of hosted app access | Global edge network |
| Square | Card processing under your own merchant agreement; we do not receive card numbers | United States |
We will give you notice before adding a subprocessor that handles your shop data, and you may object on reasonable data-protection grounds; if we cannot resolve it, you may terminate the affected service.
5. Security
Measures include: transport encryption to hosted services; optional AES-256 encryption of local data at rest, enabled with a station passphrase; per-user sign-in with access tiers, idle auto-lock, and manager approval for refunds, voids, discounts and overrides when Compliance Mode is on; a tamper-evident audit log chained with keyed HMAC-SHA-256; and masking of card-number-shaped strings in note fields.
Two limits stated plainly: masking covers 13–19 digit runs in note and reason fields only, not every free-text box; and local encryption is opt-in, so it protects a lost or stolen computer only if you turned it on and kept the passphrase safe.
6. Incidents and data subject requests
If we become aware of a personal-data breach affecting data we process for you, we will notify you without undue delay and share what we know so you can meet your own notification duties. If an individual contacts us directly about their data, we will refer them to you and assist you in responding, taking into account that most records live on your own machines and are under your direct control.
7. Return and deletion
You can export everything yourself at any time with Save Backup. On termination you keep that ability, and for 30 days afterwards we will help you retrieve data still held in hosted storage. After that window we may delete hosted copies. Data on your own computers is yours to keep or erase.
8. Audit
On reasonable written request, and no more than once a year unless a regulator requires otherwise, we will provide the information reasonably necessary to show we are meeting this Addendum.
9. Contact
Data protection questions: [email protected] · (904) 415-9478.