Data processing addendum

Version: 1.3
Last updated: October 24, 2026

The current version is at https://solar360.io/dpa/

This data processing addendum (the DPA) is part of the Terms of service (the Terms) between Solar 360, LLC (Solar 360, we, us, our) and the Customer (you, your). It applies to every Customer. It needs no separate signature.

This DPA states how Solar 360 processes the personal information in Customer Data for the Customer. If the Terms and this DPA do not agree about the processing of Customer Data, this DPA controls.

1. Definitions

The words that the Terms define have the same meaning in this DPA. These words also apply:

Customer Personal Information: the Personal Information in Customer Data that Solar 360 processes for the Customer.
Personal Information: information that identifies, relates to, or describes a person or a household, or that can reasonably link to a person or a household. It includes “personal data” and “personal information” as US State Privacy Laws define them.
Process and Processing: any operation on Personal Information, such as collection, storage, use, disclosure, and deletion.
Security Incident: a breach of security that causes the accidental or unlawful destruction, loss, or change of Customer Personal Information. It also includes the disclosure of, or the access to, Customer Personal Information without authorization.
Sell and Share: the meanings that US State Privacy Laws give to these words. “Share” includes disclosure for cross-context behavioral advertising.
Sub-processor: a company that Solar 360 engages to process Customer Personal Information.
US State Privacy Laws: the privacy laws of US states that apply to the Processing. They include the California Consumer Privacy Act, as the California Privacy Rights Act changed it, with its regulations. They also include the consumer data privacy laws of other states.

2. Roles

The Customer is the “business” or the “controller” of Customer Personal Information. The Customer decides why and how the Service processes it.
Solar 360 is the “service provider” or the “processor” of Customer Personal Information. Solar 360 processes it only for the Customer.
Solar 360 is the controller of Account Data, Billing Data, and the data of the Site. The Privacy Policy covers that data. This DPA does not.
Each party complies with the US State Privacy Laws that apply to it.

3. Details of the Processing

Subject

The Processing that is necessary to give the Service to the Customer under the Terms.

Duration

The term of the Terms, and then the time until Solar 360 deletes the Customer Personal Information under section 9.

Nature

Hosting, storage, organization, search, display, calculation, transmission, and deletion. This includes:

the emails and push notifications that the Service sends for the Customer
the map lookups through Google Maps Platform
the calendar sync of the Users who connect a calendar

Purpose

To give, maintain, secure, and support the Service for the Customer, as the Terms and the instructions of the Customer state. This is the business purpose of the Processing.

Categories of persons

Homeowners and leads: the people whose homes are the subject of a lead, a knock, an appointment, or a deal
Users: the staff, the sales representatives, the contractors, and the homeowners that the Customer invites
other people whose names appear in notes, files, and messages

Categories of Personal Information

Contact details: names, phone numbers, email addresses, and home addresses
Property and project information: the property, the system size, the price, the financing, the stage, the permits, the designs, and the contracts
Appointments: times, people, status, and results
Notes and messages: notes on leads, deals, and properties, chat messages, and messages with homeowners
Files and photos: contracts, designs, permits, and photos of the work, with the metadata that the device puts in each file. This metadata can hold the GPS position where a photo was taken, the date and time, and the camera model. The Service keeps it as uploaded.
Location:
- the GPS position of the phone of a User at each knock, with its accuracy and the distance to the door
- the GPS position in the metadata of uploaded photos
Work and pay records of Users: role, team, tasks, quotas, knocks, appointments, points, training results, commissions, and payroll
Calendar data: busy times, and the events that the Service writes for appointments
Technical data: the push addresses of devices, and the browser names

Sensitive Personal Information

The precise location of Users at each knock, and the GPS position in the metadata of uploaded photos, are sensitive personal information under some US State Privacy Laws. The Customer gives the notices and gets the consents that the law requires for it.

The Service is not made to hold government identity numbers, financial account numbers, or health information. If the Customer puts such information into the Service, for example in a file, the Customer is responsible for that decision.

4. Duties of the Customer

The Customer:

has a lawful basis for the Processing, including the notices and consents that the law requires
has a lawful basis to collect information about Homeowners and to contact them, as section 9 of the Terms states
gives only lawful instructions
answers the requests of the persons whose Personal Information it controls

5. Duties of Solar 360

Instructions

Solar 360 processes Customer Personal Information only on the documented instructions of the Customer. The Terms, this DPA, and the use and settings of the Service by the Customer are these instructions.
If a law requires other Processing, we tell the Customer before we do it, unless that law forbids the notice.
If we think that an instruction breaks the law, we tell the Customer. We can then refuse that instruction.

Confidentiality

Each person who processes Customer Personal Information for Solar 360 has a duty of confidentiality. Only the people whose work needs the access can access it.

Security

We apply the measures of Annex 1. We can change these measures, but we do not decrease the general level of protection.

Requests from persons

The Service lets the Customer find and correct Customer Personal Information.
If the Customer must export or delete Customer Personal Information to answer a request, the Customer asks us at support@solar360.io. We do the export or the deletion in time for the Customer to meet its legal deadline.
If the Customer needs more help to answer a request, we give reasonable help.
If we get a request from a person about Customer Personal Information, we tell the person to contact the Customer. We tell the Customer without undue delay when we can identify it. We do not answer the request ourselves, unless the Customer tells us to.

Assessments

We give the Customer the reasonable information and help that it needs for its data protection assessments and for its consultations with authorities about the Processing.

Notice of a problem

If Solar 360 can no longer meet its duties under US State Privacy Laws, we tell the Customer. The Customer can then take reasonable steps to stop and correct the Processing that is not authorized.

Requests from authorities

If an authority asks us for Customer Personal Information, we ask the authority to contact the Customer. If we must disclose the information, we tell the Customer first, unless the law forbids it.

6. Terms that US State Privacy Laws require

Solar 360:

does not Sell or Share Customer Personal Information
does not keep, use, or disclose Customer Personal Information for a purpose other than the business purpose of section 3, except as US State Privacy Laws allow
does not keep, use, or disclose Customer Personal Information for a commercial purpose other than the business purpose, or outside the direct business relationship with the Customer
does not combine Customer Personal Information with other Personal Information, except as US State Privacy Laws allow for a business purpose. Other Personal Information is information that Solar 360 gets from or for another person, or collects from its own contact with a person.
does not use Customer Personal Information to train artificial intelligence (AI) models
does not try to identify a person again from data that the Customer gives in a form that does not identify the person
complies with US State Privacy Laws, and gives Customer Personal Information the level of privacy protection that these laws require of the Customer
lets the Customer take reasonable steps to make sure that Solar 360 uses Customer Personal Information as these laws require

Solar 360 certifies that it understands these restrictions and will comply with them.

7. Sub-processors

The Customer gives a general authorization for the Sub-processors in Annex 2.
Each Sub-processor has a written contract with Solar 360, or accepts written terms from Solar 360. These terms give data protection duties at least as strict as the duties of this DPA, as US State Privacy Laws require.
Solar 360 is responsible for the work of its Sub-processors under this DPA.

Changes to Sub-processors

We send an email to the Owner, and we change Annex 2, at least 30 days before a new Sub-processor processes Customer Personal Information.
If we must replace a Sub-processor quickly for security or for continuity of the Service, we tell the Owner as soon as possible.

Right to object

The Customer can object to a new Sub-processor for reasonable data protection reasons. Send the objection to support@solar360.io within 30 days after our notice.
We then try in good faith to find a solution, such as another way to give the Service.
If we find no solution, the Customer can end the Terms with a notice before the new Sub-processor starts. We then refund the Fees that the Customer paid for the time after the end.

8. Security Incidents

We tell the Customer about a Security Incident without undue delay, and within 72 hours after we confirm it. We send the notice to the email address of the Owner.
The notice tells what happened, the categories and the approximate number of persons and records, the likely effects, the measures that we took or propose, and a contact person. If we do not know all of this at first, we send the information when we get it.
We take reasonable steps to stop the Security Incident, to investigate it, and to decrease its effects.
We help the Customer meet its duties to give notice to persons and to authorities. The Customer decides about these notices. We do not tell the persons ourselves, unless the Customer agrees or the law requires it.
Attempts that do not compromise security are not Security Incidents. Examples are pings, port scans, and failed sign-ins.
A notice of a Security Incident is not an admission of fault.

9. Return and deletion

During the subscription, the Owner can ask for an export of Customer Data at support@solar360.io.
When the subscription ends, or when we suspend the Organization, the Customer has 60 days to export its Customer Data, as section 7 of the Terms states.
After these 60 days, we delete the Customer Personal Information from the Service. The copies in backups expire within the next 14 days. Old versions of files expire within the next 30 days.
If a law requires us to keep some Customer Personal Information, we keep only that information. We protect it and use it only for that legal purpose.
On a written request, we confirm the deletion in writing.

10. Audits and information

On a written request, at most once in 12 months, we give the Customer the information that shows our compliance with this DPA. This information includes:
- our answers to a reasonable security questionnaire
- a written description of our security measures
- the audit reports or certifications that we have, if any
The Customer can ask more often after a Security Incident, or when an authority requires it.
If a US State Privacy Law requires an assessment that this information does not cover, the Customer can use a qualified, independent assessor. The Customer gives us 30 days of notice. The assessor has a duty of confidentiality. The assessment happens during business hours, with the least possible effect on the Service, at the cost of the Customer. As an alternative, we can engage a qualified, independent assessor and give the report to the Customer.
All the information of this section is Confidential Information of Solar 360.

11. Liability

The limits and the exceptions of section 17 of the Terms apply to this DPA.

12. Duration and changes

This DPA applies as long as Solar 360 processes Customer Personal Information.
We change this DPA as section 20 of the Terms states. A change of Annex 2 follows section 7 of this DPA.
A change that US State Privacy Laws require can take effect sooner, as the law requires.

Annex 1: Security measures

Encryption

TLS encrypts the traffic between the devices of Users and the Service.
The database, its backups, and the file store are encrypted at rest.
The app encrypts the calendar tokens with AES-256-GCM, with a key that it uses for no other purpose.
Passwords are stored only as one-way hashes. The authenticator secrets and the backup codes of two-factor authentication are stored encrypted.
The tokens of the links in appointment emails and homeowner invitations are stored only as SHA-256 hashes.

Separation of Customers

Each table that holds Customer Data has row-level security in PostgreSQL. Each request of the app can read only the rows of one Organization.
The database user of the app cannot bypass row-level security.
Links between records always include the Organization, so a record cannot point to a record of another Organization.

Access control

In the app, the role of each User controls what the User can see and do.
Users must verify their email address. Two-factor authentication is available to each User.
Sessions end 7 days after the last use, and at sign-out. A password reset ends all sessions of the User.
After repeated failed sign-ins, the account locks for 15 minutes.
Only a small number of authorized engineers can access the production systems. Each engineer has a personal account with the permissions that the work needs.

Network

The servers of the app accept no connections from the internet. They reach Cloudflare through an encrypted outbound tunnel, and Cloudflare protects the app from attacks.
The database is in a private network. It accepts no connections from the internet.
Rate limits protect sign-in, email, search, maps, and other functions from abuse.

Files

Files are in a private Amazon S3 bucket. All public access is blocked.
A User reaches a file only through a signed link that expires after 15 minutes.
The Service refuses uploads of file types that a browser can run, such as HTML and SVG.

Backups and recovery

The database has automatic daily backups, with restore to a point in time, for 14 days.
The database has protection against deletion.
The file store keeps old versions of files for 30 days.

Logs and monitoring

The server logs keep one line for each request: the method, the path, the status, the duration, and the ids of the Organization and the User. They do not keep the content of requests.
We keep server logs for 30 days.
Error reports and performance data go to Sentry. Before a report leaves the app, we remove passwords, tokens, cookies, request bodies, and email addresses.
Alarms tell our engineers about errors and failures.

Development and staff

Changes to the code go through automated tests before release.
Our staff have a duty of confidentiality.
We respond to Security Incidents as section 8 states.

Data minimization

For Street View, we store only the panorama id, never the image.
From a connected calendar, we copy only the start and the end of busy times.
The record of a failed sign-in holds a hash of the email address, and no IP address.

Annex 2: Sub-processors

Sub-processor	What it does	Location
Amazon Web Services, Inc.	Hosting, database, file storage, and email (Amazon SES)	United States
Apple Inc.	The Apple Push Notification service: it delivers the notifications of the Solar 360 app for iPhone. Apple gets the device token and the readable text of each notification.	United States and other countries
Cloudflare, Inc.	DNS, network protection, and the tunnel to the app	United States and other countries
Stripe, Inc.	Payments, invoices, and taxes	United States
Google LLC	Google Maps Platform, and Google Calendar if a User connects it	United States and other countries
Google LLC (Firebase Cloud Messaging)	Firebase Cloud Messaging: it delivers the notifications of the Solar 360 app for Android. Google gets the device token and the readable text of each notification.	United States and other countries
Microsoft Corporation	Microsoft Outlook calendar, through Microsoft Graph, if a User connects it	United States and other countries
Google LLC (Google Workspace)	The support mailbox, support@solar360.io	United States and other countries
Functional Software, Inc. (Sentry)	Error monitoring: error reports and performance data (the timings of requests and jobs), with technical data. We remove passwords, tokens, cookies, request bodies, and email addresses before a report leaves the app.	United States