Data Processing Addendum

Last updated: July 21, 2026 · Effective for all accounts

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Extant 2000 LLC ("Hitt Hosting", "we") and the customer ("you") for Hitt Hosting CRM and Pulse Analytics. It applies automatically to every account — there is no separate signature process. If your organization requires a countersigned copy, email privacy@hitthosting.com and we will return an executed PDF of this same text.

1. Roles

For contact records you store in the CRM and visitor data collected by Pulse on your websites, you are the controller and we are the processor. We process that data only to provide the service, on your documented instructions (your configuration of the product), and never sell it or use it for our own marketing or advertising.

2. What we process

• CRM: contact names, email addresses, and the properties, notes, events, and files you attach to them.
• Pulse: page views with hashed visitor identifiers (salted, rotating — raw IP addresses are not stored), coarse geography (country/region/city), device/browser class, and referrers. If a visitor arrives from one of your tracked emails, an opaque token can associate the visit with the matching CRM contact.

3. Security

TLS in transit; encryption at rest; per-organization row-level isolation enforced in the database; access limited to what operating the service requires. We notify you without undue delay after becoming aware of a personal-data breach affecting your data.

4. Subprocessors

Current subprocessors: Supabase (database hosting, AWS us-west-2), OVHcloud US (application servers, Virginia), and Stripe (billing only — no CRM/Pulse data). We will update this page before adding a subprocessor; continuing to use the service after an update constitutes acceptance, and you may terminate if you object.

5. Assistance and deletion

We provide the tools to honor data-subject requests yourself: contact export, correction, and hard deletion are self-serve in the product (deleting a contact erases the record and its timeline; suppression entries survive so opted-out addresses are never re-emailed). Pulse data is purged automatically on your plan's retention schedule. On account termination we delete your data within 30 days, except records we must retain by law.

6. Your obligations

You are responsible for having a lawful basis for the contact data you store and the visitor tracking you enable, and for the privacy disclosures on your own sites — see the Pulse privacy guide for copy-paste disclosure language.

Questions: privacy@hitthosting.com · Extant 2000 LLC, 7051 Brookfield Plz, PO Box 41, Springfield, VA 22150, USA