Data Processing Agreement
Bevel — A Backend Output LLC Product
Effective date: July 5, 2026 · Last updated: October 6, 2026
This is Bevel's standard Data Processing Agreement (“DPA”). It describes how Backend Output LLC processes personal data on behalf of customer organizations, and it supplements our Terms of Service and Privacy Policy. Enterprise customers who need a countersigned copy can request one at support@bevel.build.
1. Roles and Scope
Your organization (the “Customer”) is the controller (or, under US state privacy laws, the “business”) of the personal data it submits to Bevel. Backend Output LLC (“Bevel”) acts as a processor (or “service provider”) — we process that data only to provide the Bevel service under our agreement with you.
This DPA applies to personal data contained in the content your organization submits to the platform: contact records, team member profiles, project documents, photos, messages, voice recordings, timesheet entries, and similar data.
2. Details of Processing
Nature and purpose: hosting, storage, transmission, AI-assisted analysis and extraction, notification delivery, and related services needed to operate a construction project management platform.
Duration: for as long as the Customer maintains an account, plus the post-termination export window described in the Terms of Service. On request, personal identifiers are removed after a 30-day reversible window; Customer business records are retained, with the affected individual's actions anonymised rather than deleted, because those records are the Customer's own construction records and carry multi-year retention exposure. Subject to the legal-retention and litigation-hold exceptions in the Terms of Service §11. Removal of records beyond identifiers is handled case by case on written request, not as a standing commitment.
Categories of data subjects: the Customer's employees and authorized users, business contacts the Customer manages in the platform (subcontractors, suppliers, architects, engineers, owners, and their personnel), and third parties who send email to the Customer's Bevel reply addresses.
Categories of personal data: names, business contact details (email, phone, company, role), phone numbers used for SMS, photos and voice recordings that may include individuals, location data where the Customer enables location-based features, and message content — including messages the Customer's team addresses to the Bevel bot in connected chat platforms such as Microsoft Teams, calendar event details (title, time, location, organizer name) of users who individually connect their Outlook calendar, and email messages and their attachments sent to the Customer's Bevel reply addresses, including by third parties. Bevel does not request and does not need special categories of personal data (e.g. health or biometric data); the Customer agrees not to submit them.
3. Bevel's Obligations
- •Instructions only. We process Customer data only to provide and maintain the service, as documented in the Terms of Service and this DPA — never for advertising, data sales, or training AI models.
- •Confidentiality. Personnel with access to Customer data are bound by confidentiality obligations. Construction plans and project financials are treated as confidential business documents.
- •Security. We maintain the technical and organizational measures described in Section 5.
- •Breach notification. If we become aware of a personal data breach affecting your data, we will notify you without undue delay after confirming the breach, with the information we have about its nature, scope, and remediation.
- •Assistance. We provide reasonable assistance with data subject requests (access, correction, deletion, export). Correction and CSV export are available directly in the platform; deletion and complete-copy requests are handled through privacy@bevel.build on the timelines in the Privacy Policy.
- •Return, and identifier removal. You can export your data at any time while your account is active and through the post-termination export window. On request we remove an individual's personal identifiers after a 30-day reversible window and anonymise their past actions; your business records are retained. We do not offer standing deletion of Customer business records — they are your construction records and you are likely to need them. Removal beyond identifiers is considered case by case on written request. Retention that is legally required (SMS opt-out records, tax and billing records) and anything under a litigation hold you have notified us of are excepted in all cases.
- •Demonstrating compliance. On written request, we will provide information reasonably necessary to demonstrate compliance with this DPA, including summaries of our security practices.
4. Subprocessors
The Customer authorizes Bevel to use the following subprocessors. We will update this list before adding or replacing a subprocessor that handles Customer personal data; customers with an executed DPA will be notified by email and may object on reasonable data protection grounds.
| Subprocessor | Purpose |
|---|---|
| Supabase, Inc. | Database, file storage, and authentication |
| Anthropic, PBC | AI processing of documents, plans, chat, and incoming email |
| Google LLC | Voice transcription (Gemini API) and address autocomplete |
| Vercel, Inc. | Application hosting and privacy-friendly analytics |
| Railway Corp. | Background compute for AI processing pipelines |
| Stripe, Inc. | Payment processing |
| Telnyx LLC | SMS message delivery |
| Microsoft Corporation | Microsoft Teams message delivery (Azure Bot Framework) — engaged only if the Customer connects Microsoft Teams; Outlook calendar sync (Microsoft Graph, delegated read-only Calendars.Read) — engaged only for individual users who connect their own calendar |
| Resend, Inc. | Transactional email delivery, and receipt of email sent to the Customer Bevel reply addresses |
| Intuit Inc. | QuickBooks Online sync — only if you connect it |
Our AI subprocessors (Anthropic, Google) process Customer content solely to fulfill the requested operation and do not use it to train their models.
5. Security Measures
- •Tenant isolation: every table carrying customer data is protected by row-level security scoped to the organization; server-side functions are required to verify organization membership, and automated static checks and continuous security audits enforce that requirement
- •Encryption: data encrypted in transit (TLS) and at rest
- •Authentication and access control: token-based authentication, role-based permissions within each organization, and least-privilege service credentials
- •Private storage: uploaded documents live in private storage buckets accessed through short-lived signed URLs
- •Rate limiting and abuse controls: platform-level rate limits and input scanning on AI features
- •Monitoring: automated security audits, error monitoring, and audit logging of sensitive changes
6. Data Location and International Transfers
Bevel stores and processes Customer data in the United States. If you use Bevel from outside the US, you are transferring data to the US.
For customers subject to GDPR or UK GDPR, transfers to Bevel are made under the European Commission's Standard Contractual Clauses (Module 2: controller-to-processor), which are incorporated into executed DPAs by reference, together with the UK Addendum where applicable.
7. US State Privacy Laws
Where the CCPA/CPRA or similar US state privacy laws apply, Bevel acts as a “service provider.” We do not sell or share Customer personal data, do not retain, use, or disclose it for any purpose other than providing the service, and do not combine it with data from other sources except as permitted for service providers. We will notify you if we determine we can no longer meet these obligations.
8. Liability and Execution
Liability under this DPA is subject to the limitations of liability in the Terms of Service. If this DPA conflicts with the Terms of Service on the subject of personal data processing, this DPA controls.
This page reflects our standard processing commitments and applies to all customers. Organizations that require a signed agreement — or have negotiated terms — should email support@bevel.build to execute a countersigned copy.
Bevel is a product of Backend Output LLC. This standard DPA is provided as a framework and is not legal advice; both parties should have their own counsel review it before execution.