ZenPilot Reports Data Processing Addendum
Effective date: October 13, 2026 · Version 1.0
1. Parties, scope, and order of precedence
1.1 This Data Processing Addendum (“DPA”) is between DoInbound, LLC d/b/a ZenPilot (“ZenPilot,” “we,” “us”) and the customer identified in the account or Order Form (“Customer,” “you”). It forms part of the ZenPilot Reports Terms of Service (the “Terms”) and any Order Form.
1.2 This DPA applies where we process Personal Data on your behalf in providing the Service and that processing is subject to Data Protection Law. It does not apply to Personal Data we process as a controller, such as your account contacts and billing records, which our Privacy Policy covers.
1.3 If this DPA conflicts with the Terms or an Order Form, this DPA controls on data protection matters, unless the Order Form expressly states that it amends a specific section of this DPA. If the Standard Contractual Clauses conflict with this DPA or an Order Form, the Standard Contractual Clauses control.
1.4 This DPA takes effect on the later of the date you accept the Terms and the effective date of this DPA, and lasts as long as we process Personal Data for you.
1.5 A signed copy of this DPA is available on request by emailing legal@zenpilot.com. Acceptance of the Terms is sufficient; a signature is not required for this DPA to apply.
2. Definitions
Capitalized terms not defined here have the meaning given in the Terms.
- “Data Protection Law”: all laws that apply to the processing of Personal Data under this DPA, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act as amended (“CCPA”).
- “Personal Data”: information in Customer Data that relates to an identified or identifiable natural person.
- “Processing,” “Controller,” “Processor,” “Data Subject,” “Supervisory Authority,” and “Personal Data Breach” have the meanings given in the GDPR. “Business,” “Service Provider,” “Sell,” and “Share” have the meanings given in the CCPA.
- “Subprocessor”: a third party we engage to process Personal Data on your behalf.
- “Personnel”: our employees and individual contractors who work under our direct supervision and are bound by written confidentiality and data protection obligations.
- “Standard Contractual Clauses” or “SCCs”: the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Decision (EU) 2021/914.
- “UK Addendum”: the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
- “Restricted Transfer”: a transfer of Personal Data to a country that Data Protection Law treats as not providing adequate protection, where the transfer would be unlawful without a transfer mechanism.
3. Roles and details of processing
3.1 You are the Controller (or, where you act for another controller, a Processor) and we are your Processor. Where the CCPA applies, you are a Business and we are a Service Provider.
3.2 Annex I describes the subject matter, duration, nature and purpose of processing, the categories of Data Subjects, and the types of Personal Data. In short: we process the Personal Data in your ClickUp Workspace and the data your team enters, for the duration of your subscription, to produce profitability, utilization, and project reporting for you.
3.3 You are responsible for the lawfulness of the Personal Data you make available to us, including having a lawful basis to process your team members’ data and giving them any notices Data Protection Law requires.
3.4 Your instructions to us are: the Terms, this DPA, your configuration and use of the Service, and any further written instructions we agree to. You also instruct us to create Aggregated Data from Customer Data as described in Terms §6.3. Aggregated Data is de-identified so it does not relate to an identified or identifiable person, and we will not attempt to re-identify it. We will tell you if we believe an instruction violates Data Protection Law, but we are not obliged to review your instructions for legal compliance.
4. Our obligations as Processor
4.1 Instructions. We process Personal Data only on your documented instructions (section 3.4), including for transfers, unless Data Protection Law requires otherwise. In that case we will tell you before processing, unless the law prohibits it.
4.2 Confidentiality. We limit access to Personal Data to Personnel who need it to provide the Service.
4.3 Assistance. Taking into account the nature of the processing and the information available to us, we will help you meet your obligations under Data Protection Law on security, breach notification, data protection impact assessments, and consultations with Supervisory Authorities. We may charge a reasonable fee for assistance beyond what the Service already provides.
4.4 Records. We keep the records of processing that Data Protection Law requires of a Processor and will make them available to you on request.
4.5 No sale or sharing. We do not sell or share Personal Data, use it for our own purposes, or combine it with Personal Data from other sources except as the Terms allow for Aggregated Data (Terms §6.3) and as Data Protection Law permits.
5. Security
5.1 We maintain the technical and organisational measures in Annex II, which are appropriate to the risk of the processing. We may update them over time, but not in a way that materially reduces the overall protection of Personal Data during your subscription.
5.2 You are responsible for the security of your own systems and for how you configure the Service, including who you invite, what roles and permissions you grant (including access to financial data), and keeping your sign-in methods secure.
6. Subprocessors
6.1 You authorize us to engage the Subprocessors listed in Annex III and on our Privacy Policy at reports.zenpilot.com/privacy.
6.2 We will give you at least 30 days’ notice before adding or replacing a Subprocessor, by email to the Organization owner or in the app. You may object on reasonable data protection grounds within that period. We will then work with you in good faith; if we cannot resolve the objection, you may terminate the affected part of the Service and we will refund prepaid fees for the unused period.
6.3 We have a written agreement with each Subprocessor that imposes data protection obligations no less protective than this DPA. We remain responsible for each Subprocessor’s performance.
7. Personal Data Breach
7.1 If we become aware of a Personal Data Breach affecting your Personal Data, we will notify the Organization owner without undue delay and no later than 72 hours after confirming it.
7.2 The notice will describe, as far as we know at the time, the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures we have taken or propose. We will provide further information as it becomes available.
7.3 We will take reasonable steps to contain and remediate the breach. Our notice is not an admission of fault or liability. You are responsible for notifications to Supervisory Authorities and Data Subjects; we will give reasonable help.
8. Data Subject requests
8.1 The Service lets Organization owners and admins view, correct, and delete Personal Data directly, and export reports that contain it as CSV files. Use those features first; for requests they don’t cover, contact us as set out in section 8.3.
8.2 If a Data Subject contacts us directly about Personal Data we process for you, we will not respond beyond acknowledging the request and directing them to you, unless Data Protection Law requires otherwise. We will tell you about the request without undue delay.
8.3 Where you cannot handle a request through the Service, we will give you reasonable help within 10 business days of your written request.
9. International transfers
9.1 We host and store Personal Data in the United States. Our Personnel may access it remotely from other countries to support and maintain the Service. Where you are established in the EEA, the UK, or Switzerland, your use of the Service involves a Restricted Transfer to us.
9.2 EEA transfers. The SCCs are incorporated into this DPA for any Restricted Transfer from the EEA, with these selections: Module Two (controller to processor) applies, or Module Three where you act as a processor; Clause 7 (docking) is included; in Clause 9 Option 2 (general authorisation) applies with the notice period in section 6.2; the optional language in Clause 11 is not included; in Clause 13 the Supervisory Authority is the one for your EEA member state; in Clauses 17 and 18 the governing law and courts are those of Ireland. Annexes I, II, and III of this DPA serve as Annexes I, II, and III of the SCCs.
9.3 UK transfers. For Restricted Transfers from the UK, the SCCs apply as amended by the UK Addendum. Tables 1 to 3 of the UK Addendum are completed with the information in this DPA, and for Table 4 either party may end the UK Addendum as set out in its section 19.
9.4 Swiss transfers. For Restricted Transfers from Switzerland, the SCCs apply with the Swiss Federal Data Protection and Information Commissioner as the competent authority, references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the SCCs also protect the data of legal entities until Swiss law no longer requires it.
9.5 If a Supervisory Authority or court invalidates these mechanisms, or Data Protection Law changes so that they no longer suffice, the parties will cooperate in good faith to put an alternative lawful mechanism in place.
9.6 We will not transfer Personal Data to a Subprocessor, or allow Personnel to access it, from a country outside the United States, the EEA, the UK, or Switzerland unless the transfer meets the onward transfer requirements of the SCCs and Data Protection Law.
10. Audits and information
10.1 On written request, no more than once a year, we will give you the information reasonably needed to show compliance with this DPA, including a summary of our security measures and any third-party audit reports or certifications we hold.
10.2 Where a Supervisory Authority requires an inspection that the information in section 10.1 cannot satisfy, we will cooperate with that inspection as Data Protection Law requires. Any information we provide under this section is Confidential Information under the Terms.
10.3 Audits of our Subprocessors are carried out through the information and reports they make available to us; we will pass relevant findings on to you.
11. Return and deletion
11.1 During your subscription, Organization owners and admins can export reports from the Service as CSV files, and owners can permanently delete an Organization and its Customer Data from within the app.
11.2 When the Terms end, you may request an export of the Personal Data you entered in the Service within 30 days. After that, we delete Personal Data from our live systems within a further 30 days unless Data Protection Law requires us to keep it, in which case we keep it only as long as required and only for that purpose. residual copies in backups are deleted within 30 days and are not used for any other purpose.
11.3 Synced ClickUp detail outside your Plan’s data window is deleted on a recurring schedule as described in Terms §6.5; the source data remains in your ClickUp Workspace.
12. US state privacy laws
12.1 Where the CCPA or a similar US state law applies, we act as your Service Provider (or equivalent) and process Personal Data only to provide the Service under the Terms.
12.2 We will not sell or share Personal Data; retain, use, or disclose it outside the direct business relationship with you or for any purpose other than providing the Service; or combine it with Personal Data we receive from others, except as those laws permit for a service provider.
12.3 We certify that we understand these restrictions and will comply with them. We will tell you if we can no longer meet them, and you may take reasonable steps to stop and remediate unauthorized use.
12.4 We give the same level of privacy protection as those laws require, allow you to take reasonable steps to check that we use Personal Data consistently with your obligations, and will help you respond to consumer requests as set out in section 8.
13. Liability and general
13.1 Each party’s liability under this DPA, including the SCCs to the extent the law allows, is subject to the limits and exclusions in the Terms (§19). Nothing in this DPA limits either party’s liability to Data Subjects under Data Protection Law.
13.2 We may update this DPA to reflect changes in Data Protection Law, the Service, or our Subprocessors. Material changes follow the notice process in Terms §21. Prior versions are available on request.
13.3 Notices under this DPA go to the Organization owner’s email for you and to legal@zenpilot.com for us.
13.4 This DPA is governed by the law stated in the Terms, except where the SCCs or Data Protection Law require otherwise. If any provision is unenforceable, the rest stays in effect.
Annex I — Details of processing
| Item | Detail |
|---|---|
| Data exporter (Controller) | The Customer identified in the account or Order Form |
| Data importer (Processor) | DoInbound, LLC d/b/a ZenPilot, Pennsylvania, USA · legal@zenpilot.com |
| Subject matter | Profitability, utilization, and project reporting built from the Customer’s ClickUp Workspace and the inputs the Customer’s team enters |
| Duration | The term of the Customer’s subscription, plus the deletion period in section 11 |
| Nature | Hosting, syncing, storing, calculating, displaying, and exporting; sending transactional email; providing support |
| Purpose | Providing the Service to the Customer as described in the Terms |
| Data Subjects | The Customer’s employees and contractors who are members of its ClickUp Workspace; End Users who sign in to the Service; the Customer’s clients where client names appear in ClickUp or project records |
| Personal Data | Names, email addresses, ClickUp user IDs and avatars; time entries (who, when, how long, which task); task, list, folder, and space names; roles, departments, capacity, billable and cost rates; expense records and receipt files uploaded by the Customer; sign-in session records |
| Special categories | None intended. The Customer must not submit special-category data (health, biometric, political, religious, and similar) to the Service |
| Locations of processing | Hosting and storage in the United States; remote access by Personnel from other countries under section 9 |
| Frequency | Continuous (automatic sync on the Plan’s cadence, plus manual syncs) |
| Retention | Synced ClickUp detail: the Plan’s data window (Terms §6.5). Customer-entered data: the subscription term plus section 11 |
| Competent Supervisory Authority (SCC Clause 13) | The authority of the EEA member state where the Customer is established |
Annex II — Technical and organisational measures
| Area | Measures |
|---|---|
| Encryption in transit | TLS for all connections to the Service and between the Service and its Subprocessors |
| Encryption at rest | Database and file storage encrypted at rest by the hosting providers (Neon, Vercel). ClickUp access tokens are additionally encrypted at the application layer with AES-256-GCM; the key is held outside the database |
| Access control | Role-based permissions inside each Organization (Owner, Admin, Member). Cost rates, margins, and profit are visible only to Owners, Admins, and Members an Admin has granted access; billable rates and revenue are visible to all Members; invitations and removals controlled by Organization owners and admins; sign-in via Google OAuth or emailed one-time links; no passwords stored |
| Tenant isolation | Every record is scoped to an Organization; API requests validate that referenced records belong to the caller’s Organization; uploaded receipts are stored privately and served only through an Organization-scoped proxy |
| Production access | Limited to named Personnel with a need, using individual accounts protected by multi-factor authentication; access removed when someone leaves |
| Availability and backups | Hosting on Vercel and Neon with provider-managed redundancy; Neon point-in-time restore for the past 7 days and daily snapshots retained for 30 days, after which backup copies are deleted automatically |
| Monitoring | Error and performance monitoring (Sentry) with personal data scrubbed from reports where feasible; cron and sync health checks; rate limiting on sign-in, sync, invitation, workspace-creation, billing, and account-deletion endpoints |
| Data minimisation | Only the ClickUp objects needed for reporting are synced; detail outside the Plan’s data window is deleted on a weekly schedule; Organization deletion removes the Organization’s data from live systems immediately, including uploaded receipt files, and cancels any active subscription. End Users’ login accounts are not Customer Data and are kept until the End User deletes them or they go unused |
| Subprocessor management | Written agreements with each Subprocessor; list published on the Privacy Policy; 30 days’ notice of changes |
| Incident response | Breach detection, containment, and notification per section 7 |
| Personnel | Written confidentiality and data protection obligations for all Personnel with access to Customer Data |
Annex III — Subprocessors
Current as of the effective date; the live list is at reports.zenpilot.com/privacy.
| Subprocessor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting, serverless functions, private file storage | United States |
| Neon Inc. | Postgres database hosting | United States (AWS us-east-1) |
| Stripe, Inc. | Subscription payments (card details never reach the Service) | United States |
| Resend, Inc. | Transactional email delivery | United States |
| Upstash, Inc. | Rate limiting and background job queueing | United States |
| Functional Software, Inc. (Sentry) | Error and performance monitoring | United States |
| Google LLC | Sign-in with Google (only if the End User chooses it) | United States |
The ClickUp Workspace you connect is your own service, governed by your agreement with ClickUp. It is a data source, not a Subprocessor.