Data Processing Addendum

BrandTrust.reviews — operated by Brand Lew LLC

Last updated: November 2, 2026

Overview

This Data Processing Addendum ("DPA") forms part of, and is incorporated into, the BrandTrust.reviews Terms of Service (the "Agreement") between Brand Lew LLC ("BrandTrust," "we," "us") and the business customer that uses the Services (the "Customer," "you"). It applies whenever BrandTrust processes Customer Personal Data on the Customer's behalf and the Customer is subject to Data Protection Laws.

It reflects how the Services actually work, which keeps the processing footprint small: the embeddable widget sets no cookies and no device storage on a site visitor's browser, and the limited visitor data we do process for view counting is reduced to one-way cryptographic hashes (see Annex A and our Privacy Policy). Most content shown by the Services is the Customer's own existing reviews, retrieved from platforms the Customer connected.

This DPA applies automatically to your use of the Services where it is required; a counter-signed copy for your records is available on request at hello@brandtrust.reviews. If there is any conflict between this DPA and the rest of the Agreement on the subject of data protection, this DPA controls.

1. Definitions

  • "Data Protection Laws" means all privacy and data-protection laws applicable to the processing of Customer Personal Data under the Agreement, including, as applicable, the EU General Data Protection Regulation 2016/679 ("EU GDPR"), the UK GDPR and Data Protection Act 2018 ("UK GDPR"), and U.S. state privacy laws including the California Consumer Privacy Act as amended by the CPRA ("CCPA").
  • "Controller," "Processor," "Data Subject," "Personal Data," "Processing," and "Personal Data Breach" have the meanings given in the EU GDPR (and the equivalent terms, such as "business," "service provider," and "consumer," under the CCPA).
  • "Customer Personal Data" means Personal Data that BrandTrust processes on the Customer's behalf in providing the Services, as described in Annex A.
  • "Sub-processor" means a third party engaged by BrandTrust to process Customer Personal Data. The current list is in Annex C.
  • "SCCs" means the EU Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, and "UK Addendum" means the UK Information Commissioner's International Data Transfer Addendum to the SCCs.

2. Roles of the Parties

  • For Customer Personal Data, the Customer is the Controller (or a Processor acting for its own customer) and BrandTrust is the Processor (or sub-processor). Under the CCPA, the Customer is the business and BrandTrust is a service provider.
  • Each party is responsible for complying with its own obligations under Data Protection Laws. The Customer is responsible for the lawfulness of the Customer Personal Data and of its instructions, including having a lawful basis and any required notices or consents to connect its platform accounts and display reviews through the Services.
  • The platforms a Customer connects (for example Google, Meta/Facebook, TripAdvisor, Etsy, eBay, Judge.me, and the Customer's own WooCommerce store) are independent controllers of the data they hold; BrandTrust retrieves the Customer's reviews from them at the Customer's direction and is not their Processor.

3. Scope and Instructions

  • BrandTrust will process Customer Personal Data only on the Customer's documented instructions, including as set out in the Agreement, this DPA, and the Customer's configuration and use of the Services, unless required to do otherwise by law (in which case we will inform the Customer unless the law prohibits it).
  • The Customer's instructions are described in Annex A. The Customer may give additional reasonable instructions consistent with the Agreement.
  • BrandTrust will inform the Customer if, in its opinion, an instruction infringes Data Protection Laws.

4. Confidentiality

BrandTrust ensures that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and process the data only as needed to provide the Services.

5. Security

BrandTrust implements and maintains appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art, costs, and the nature, scope, and purposes of processing and the risks involved. Those measures are described in Annex B and may be updated over time provided the level of protection is not materially decreased.

6. Sub-processors

  • The Customer provides general authorization for BrandTrust to engage Sub-processors to process Customer Personal Data. The current Sub-processors are listed in Annex C.
  • BrandTrust imposes on each Sub-processor data-protection obligations that are substantially the same as those in this DPA, and remains responsible for its Sub-processors' performance.
  • BrandTrust will give the Customer notice before adding or replacing a Sub-processor (by updating this page and/or by email where the Customer has subscribed to notifications), so the Customer has an opportunity to object on reasonable, data-protection grounds. If the Customer reasonably objects and the parties cannot resolve it, the Customer may terminate the affected Services as its exclusive remedy.

7. Assistance with Data Subject Requests

Taking into account the nature of the processing, BrandTrust will assist the Customer by appropriate technical and organizational measures, insofar as possible, to respond to requests from Data Subjects to exercise their rights (access, rectification, erasure, restriction, portability, objection). Many of these can be handled directly by the Customer in the account (for example, excluding or deleting specific reviews, disconnecting a source, or deleting data). If a Data Subject contacts BrandTrust directly about Customer Personal Data, we will, where permitted, direct them to the Customer.

8. Personal Data Breach

BrandTrust will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide information reasonably available to help the Customer meet its own notification obligations. Notice of a breach is not an acknowledgment of fault or liability.

9. Deletion and Return

Upon termination of the Services, or on the Customer's request, BrandTrust will delete Customer Personal Data within a commercially reasonable period, except to the extent retention is required by law. The Customer can also trigger deletion itself at any time (for example, "Disconnect & delete all data," deleting a widget, or closing the account), which removes the stored reviews and connected-platform credentials for the affected connection. Routine view and interaction records and the per-visitor hashes are purged automatically on the schedule described in the Privacy Policy.

10. Audits and Information

BrandTrust will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates. To avoid disrupting the Services or compromising the security of other customers, the parties will agree in advance on the reasonable scope, timing, and cost of any audit, and BrandTrust may satisfy audit requests by providing relevant documentation and answering written questions.

11. International Transfers

  • BrandTrust is based in the United States and processes Customer Personal Data in the U.S. and in its Sub-processors' regions.
  • Where BrandTrust processes Personal Data subject to the EU GDPR or UK GDPR and transfers it to a country without an adequacy decision, the parties incorporate the SCCs (for EU transfers) and the UK Addendum (for UK transfers) by reference, with BrandTrust as "data importer" and the Customer as "data exporter," module two (controller-to-processor) or module three (processor-to-processor) as applicable. Annex A supplies the information required by the SCCs' annexes, and Annex B supplies the technical and organizational measures.
  • Where there is a conflict between the SCCs and this DPA, the SCCs prevail for transfers they govern.

12. California and Other U.S. State Laws

  • BrandTrust acts as a service provider (or "processor"/"contractor") and processes Customer Personal Data only to provide the Services under the Agreement.
  • BrandTrust will not sell or share (as those terms are defined under the CCPA) Customer Personal Data, will not retain, use, or disclose it for any purpose other than the Services or as permitted by law, and will not combine it with Personal Data from other sources except as permitted by the CCPA. BrandTrust certifies that it understands and will comply with these restrictions.
  • These commitments apply equally under comparable U.S. state laws (for example, Virginia, Colorado, Connecticut, Utah, Texas, and others) to the extent applicable.

13. Reviewer Personal Data

Reviews displayed through the Services typically include Personal Data of reviewers (for example, a reviewer's display name and photo). The Customer instructs BrandTrust to retrieve, cache, and display that data as part of the Services and is responsible for having an appropriate basis to display reviews about or concerning identifiable individuals. BrandTrust minimizes this data (for example, by displaying a neutral label where a platform withholds a name or photo, and by not storing reviewer profile URLs) and processes it only to provide the Services.

14. Term, Liability, and Precedence

This DPA takes effect when the Customer accepts the Agreement (or begins using the Services) and continues for as long as BrandTrust processes Customer Personal Data. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. Except as expressly modified here, the Agreement remains in full force.

Annex A — Details of Processing

Subject matter. BrandTrust's provision of the Services: retrieving, caching, refreshing, and displaying the Customer's reviews through embeddable widgets and the WordPress plugin, and related account, billing, analytics, and support functions.

Duration. For the term of the Agreement, plus any limited retention described in the Privacy Policy or required by law.

Nature and purpose. Collection, storage, organization, caching, display, transmission (including transmitting a Customer's reply back to a source platform at the Customer's direction), de-duplication, aggregate analytics, abuse prevention, and deletion — all to provide the Services the Customer requests.

Categories of Data Subjects.

  • Reviewers whose reviews the Customer displays (from connected platforms or entered manually).
  • Site visitors who view a page where a widget or plugin is displayed.
  • The Customer's own authorized users (account owner and invited team members).

Categories of Personal Data.

  • Reviewers: display name (where provided), photo URL, star rating or recommendation, review text, timestamp, source platform, verified-purchase indicator (where provided), related product name/link (for product reviews), and any business-owner reply. A neutral label is shown where a platform withholds a name or photo.
  • Site visitors: a one-way hash derived from IP address, user-agent, and referring-site origin, and a one-way hash derived from IP address alone, used for per-day de-duplication and abuse-limiting; plus the widget identifier, event type, and timestamp. No raw IP, user-agent, referrer, cookie, or visitor identifier is stored in our application, and the widget sets no cookies or device storage.
  • Customer users: name, email, authentication identifiers, role and project access, and account/usage metadata.

Special-category data. Not intentionally processed. Reviews are free-text written by third parties and may incidentally mention such information; the Customer controls which reviews it displays.

Frequency. Continuous for the duration of the Services (scheduled sync, on-demand display, and event-driven analytics).

Annex B — Technical and Organizational Measures

  • Encryption in transit: all traffic to the Services and the embed is served over HTTPS.
  • Encryption of secrets at rest: connected-platform credentials (OAuth access/refresh tokens and API secrets) are encrypted at the application layer using AES-256-GCM before storage, in addition to provider-level encryption at rest.
  • Authentication: account authentication is handled by a managed provider (Supabase Auth); BrandTrust does not store or process raw passwords. Access to the production database uses service-role credentials held server-side only.
  • Payments: card data is handled entirely by Stripe on Stripe-hosted pages and does not reach BrandTrust's servers.
  • Data minimization by design: the widget is cookieless and sets no device storage; visitor view/abuse data is reduced to irreversible hashes; interaction events store only a widget id, event type, and timestamp; reviewer profile URLs are not stored; raw IP/user-agent/referrer are not stored in the application.
  • Access controls: role-based access within the application for team members and projects; administrative functions restricted to authorized personnel; least-privilege service credentials.
  • Tenant isolation: per-account scoping of data access in application logic and database row-level security on shared tables.
  • Retention and deletion: automated purging of view and interaction records (~24 months) and short-lived per-day hash counters; Customer-initiated deletion of reviews and credentials; account deletion removes associated data.
  • Resilience: managed, redundant hosting and database infrastructure provided by the Sub-processors in Annex C, with their own backup and availability controls.

Annex C — Sub-processors

BrandTrust engages the following Sub-processors to process Customer Personal Data in providing the Services:

  • Vercel Inc. — application hosting, edge/CDN delivery, and cookieless web analytics. United States.
  • Supabase, Inc. — managed PostgreSQL database and authentication, hosted on Amazon Web Services (AWS) infrastructure. United States.
  • Stripe, Inc. — subscription billing and payment processing (card data is handled by Stripe, not by BrandTrust). United States.
  • Resend (Plus Five Five, Inc.) — transactional and account email delivery. United States.

Not Sub-processors. The review platforms a Customer connects (Google, Meta/Facebook, TripAdvisor, Etsy, eBay, Judge.me, and the Customer's own WooCommerce store) are the Customer's own data sources and independent controllers, not BrandTrust Sub-processors. When the Customer configures a widget to use a Google font, the visitor's browser loads that font directly from Google under Google's own terms.

Questions about this DPA, or to request a counter-signed copy, contact hello@brandtrust.reviews.

Brand Lew LLC

1110 W Elliot Rd #1049

Tempe, AZ 85284

United States