Version 1.2
Effective Date: September 27, 2026
Last Updated: September 27, 2026
This Data Processing Addendum ("DPA") is incorporated into the Get Me Paid Terms of Service between BlueForge Tech LLC, doing business as Get Me Paid ("Get Me Paid," "BlueForge," "Processor," "Service Provider," "we," or "us"), and the Business that accepts the Terms ("Business," "Controller," or "you"). It applies automatically when Get Me Paid processes personal information contained in Business Content on the Business's behalf.
This DPA is intended for U.S. business use. If a future use of the Service requires contractual safeguards under European, United Kingdom, or other international privacy law, the parties will execute any additional legally required transfer or processing terms before that processing begins.
1. Definitions
"Business Content" means personal information that the Business or its authorized users enter, import, upload, generate, or maintain in the Service about customers, contacts, workers, jobs, invoices, quotes, payments, communications, and related business records.
"Personal Information" means information defined as personal data, personal information, or a comparable term under an applicable U.S. privacy law.
"Processing" has the meaning given by applicable privacy law and includes collecting, storing, accessing, using, transmitting, organizing, deleting, or otherwise handling Personal Information.
"Subprocessor" means a third party engaged by BlueForge to Process Business Content on behalf of the Business.
2. Roles and Instructions
For Business Content, the Business is the controller or business and BlueForge is the processor or service provider. BlueForge will Process Business Content only:
•
to provide, secure, support, maintain, and improve the Service for the Business;
•
on the documented instructions contained in the Terms, this DPA, the Business's configuration and use of the Service, and lawful support requests;
•
as needed to prevent fraud, abuse, or security incidents; or
If BlueForge is legally required to Process Business Content contrary to the Business's instructions, BlueForge will notify the Business before doing so unless law prohibits notice.
The Business is responsible for the lawfulness of its instructions, the accuracy and lawfulness of Business Content, and providing all notices and obtaining all rights or consents required to collect and Process that information.
3. Nature, Purpose, and Duration of Processing
BlueForge Processes Business Content to provide invoicing, quotes, customer and service records, payment and accounts-receivable workflows, collection tools, scheduling, workforce coordination, reminders, email communications, reporting, imports, exports, support, security, and related Service functions selected by the Business.
Processing continues for the life of the Business account and any applicable deletion hold, plus the retention and review periods described in the Terms and Privacy Policy for financial, audit, consent, dispute, security, backup, and legal records. BlueForge may derive aggregate or de-identified service statistics as described in the Terms and Privacy Policy, without publishing Business-level or individual-level results.
4. Categories of Data Subjects and Personal Information
Data subjects may include the Business's customers, customer contacts, employees, contractors, team members, service recipients, payers, and other individuals whose information the Business lawfully places in the Service.
Personal Information may include:
•
names and contact information;
•
billing and service addresses;
•
customer preferences and language;
•
invoice, quote, service, scheduling, and job information;
•
payment status, transaction records, refunds, reversals, and dispute information, excluding raw card credentials processed by Stripe;
•
expense and business-financial records that contain personal information;
•
communications, reminders, email message content and delivery status, and historical communication-consent or opt-out records where retained;
•
notes and other custom Business Content;
•
workforce roles, assignments, and historical activity attribution;
•
public document-link and interaction metadata; and
•
technical or audit metadata associated with those records.
The Service is not designed for special-category health information, Social Security numbers, full payment-card credentials, or other highly sensitive personal information unless an applicable feature expressly requests it. The Business should not enter unnecessary sensitive information into free-text fields, customer communications, notes, or other unrestricted content fields.
5. Confidentiality
BlueForge will ensure that persons authorized to Process Business Content are subject to appropriate confidentiality obligations and receive access only as reasonably necessary for their responsibilities.
6. Security Measures
BlueForge will maintain reasonable administrative, technical, and organizational safeguards appropriate to the Service and the nature of the Business Content. These measures include, as applicable:
•
authenticated access and session controls;
•
tenant/business separation and database row-level access controls;
•
encryption at rest provided by the hosting infrastructure;
•
protected server-side credentials and separation of privileged credentials from client applications;
•
security logging and error monitoring;
•
controls on public document links, including scoped tokens, expiration, and revocation;
•
access and deletion procedures for workforce and account changes; and
•
vendor security and contractual controls appropriate to the provider's role.
No security program can eliminate all risk, and this section does not create a guarantee of absolute security.
7. Security Incidents
BlueForge will notify the Business without undue delay and, in any event, within 72 hours after BlueForge confirms a security incident involving unauthorized access to, acquisition of, or disclosure of Business Content for which notice to the Business is required under this DPA.
The notice will provide information reasonably available to BlueForge about the nature of the incident, affected data, likely consequences, and mitigation or remediation steps. Information may be provided in phases as the investigation continues.
BlueForge's notice of an incident is not an admission of fault or liability. The Business remains responsible for determining whether it has separate notice obligations to its customers, regulators, or other persons, and BlueForge will provide reasonable information and assistance for that assessment.
8. Subprocessors
The Business provides general authorization for BlueForge to use Subprocessors necessary to provide the Service. The current Subprocessor list is published at https://getmepaid.dev/subprocessors.
Before adding a new Subprocessor that will materially Process Business Content, BlueForge will update the Subprocessor list and provide email or in-Service notice at least 15 days before the new Subprocessor begins material Processing, unless an emergency security, continuity, or legal need requires shorter notice.
The Business may object during that 15-day period by emailing legal@getmepaid.dev and explaining reasonable data-protection grounds for the objection. The parties will work in good faith to address the concern. If no commercially reasonable alternative is available, the Business may stop using the affected feature or terminate the affected Service before the new Subprocessor begins Processing, subject to the Terms.
BlueForge will impose data-protection obligations on Subprocessors that are appropriate to the services they provide and the nature of the information they Process.
9. State Privacy-Law Service-Provider Commitments
To the extent U.S. state privacy law applies to Business Content, BlueForge will act as a processor or service provider and will not:
•
retain, use, or disclose Business Content outside the direct business relationship with the Business except as permitted by applicable law and this DPA;
•
use Business Content for cross-context behavioral advertising or targeted advertising profiles; or
•
combine Business Content received from the Business with personal information received from another person or from BlueForge's own consumer interactions except where applicable law permits a service provider or processor to do so for security, fraud prevention, service improvement, or another allowed purpose.
BlueForge will notify the Business if BlueForge determines it can no longer meet a material obligation under this section, and the Business may take reasonable and appropriate steps permitted by law to stop and remediate unauthorized Processing.
10. Data-Subject and Consumer Requests
Taking into account the nature of the Processing, BlueForge will provide reasonable assistance to the Business in responding to verified requests from individuals to exercise access, correction, deletion, or portability rights under applicable privacy law when the relevant information is Business Content and the Business cannot reasonably fulfill the request using available Service tools.
If BlueForge receives a request directly from an individual relating to Business Content controlled by the Business, BlueForge may refer the requester to the Business and notify the Business where appropriate, unless law requires BlueForge to respond directly.
11. Assessments, Regulatory Cooperation, and Audits
BlueForge will provide information reasonably necessary for the Business to demonstrate compliance with applicable processor-contract requirements, including this DPA and available security documentation.
Where applicable law requires assessment assistance, BlueForge will reasonably cooperate with the Business, taking into account the nature of the Processing and information available to BlueForge.
The Business may not conduct on-site audits of BlueForge facilities under this DPA. No more than once per year, unless a confirmed security incident or regulator requires additional review, the Business may submit a reasonable written security or privacy questionnaire. BlueForge may satisfy an audit request by providing then-current third-party reports, certifications, security materials, or written responses that reasonably address the request, subject to confidentiality and security restrictions.
12. Return, Deletion, and Retention
During an active account and the 30-day deletion hold, the Business may use available export tools to obtain Business Content. After final deletion, BlueForge will delete or de-identify ordinary Business Content that is not required for retained financial, transaction, tax, dispute, consent, security, provider, or audit records.
BlueForge may retain:
•
financial, transaction, tax, provider, and audit records until an approved deletion review after the applicable 7-year period is completed, and longer if required by law, an active dispute, a provider obligation, or a legal or security hold;
•
historical communication-consent, opt-out, provider, or compliance records for the period reasonably necessary to document compliance, resolve disputes, or satisfy applicable law;
•
security, fraud-prevention, and deletion-tombstone records for as long as reasonably necessary, generally not more than 7 years unless law or an active matter requires longer; and
•
backup copies until the applicable rolling backup period expires, which is up to 7 days for the launch production configuration.
Retained information remains subject to the confidentiality and security obligations in this DPA for as long as BlueForge retains it.
13. Government Requests
If BlueForge receives a legally binding request from a government authority for Business Content, BlueForge will notify the Business before disclosure unless law prohibits notice. BlueForge will disclose only the information it reasonably believes it is legally required to disclose.
14. Liability and Order of Precedence
The liability limitations, exclusions, dispute-resolution provisions, and other remedies in the Terms apply to this DPA. If this DPA conflicts with the Terms on the Processing of Business Content, this DPA controls for that conflict. The Privacy Policy describes our public privacy practices but does not expand BlueForge's obligations under this DPA.
15. Term and Changes
This DPA remains in effect while BlueForge Processes Business Content for the Business. We may update this DPA consistently with the change-notice provisions in the Terms. A material change that adversely affects the Business's data-protection rights will receive at least 15 days' notice unless a shorter period is required for security, provider continuity, or law.
16. Contact
BlueForge Tech LLC, doing business as Get Me Paid
4105 Shawnee Cir
Bryan, TX 77802
United States
Privacy: privacy@getmepaid.dev
Legal notices and Subprocessor objections: legal@getmepaid.dev
Website: https://getmepaid.dev
Subprocessors: https://getmepaid.dev/subprocessors