Draft — not legal advice, not reviewed by counsel. See README.md.
Effective 13 October 2026 — part of terms.md.
This Data Processing Addendum forms part of the agreement between the collision repair shop ("Customer", "Controller") and HVN Group Limited ("HVN Group", "Processor"), operator of SuppSmith, and governs HVN Group's processing of personal data contained in estimate content on Customer's behalf.
1. Roles
- Customer is the Controller of any personal data (vehicle owner name, address, phone, email, VIN, plate, claim/policy number, adjuster contact, repair-order number) embedded in the estimates, supplements and photos it uploads.
- HVN Group is the Processor (or "service provider" under applicable US state law), processing that data only as needed to provide the service and on Customer's documented instructions, which include Customer's use of the service's ordinary features.
2. Purpose, nature and duration of processing
- Purpose: generating supplement suggestions and citations; providing support; product improvement via de-identified statistics.
- Nature: automated analysis, storage and transmission of estimate content between
Customer and the sub-processors listed in
subprocessors.md. - Duration: the term of Customer's subscription plus the retention periods in
data-retention.md. - Data subjects: vehicle owners/claimants named in estimates Customer uploads.
- Categories of data: name, contact details, VIN, plate, claim/policy number, adjuster contact, repair-order number, vehicle damage photos. No government ID numbers, payment card numbers or health information are intentionally collected.
3. Sub-processors
Customer authorises HVN Group to engage the sub-processors listed in subprocessors.md,
each processing estimate content only as needed to deliver the function shown there, under a
data-processing agreement or equivalent terms with HVN Group. Automated analysis asks for
no training on Customer content and no prompt logging. The request goes through OpenRouter
with data collection denied, to Mistral, and to Amazon Nova on Amazon Bedrock only if the
Mistral call fails. We do not promise a contractual US-only inference geography for that
hop. A request that cannot be served with data collection denied fails rather than moving
to a provider that stores or trains on the content.
Change notice: HVN Group will update subprocessors.md and notify Customer (by email to
the account holder, or by in-app notice) at least 10 days before a new sub-processor begins
processing estimate content. The notice names the provider, its purpose, whether it will see
estimate content, the processing region, and the date it takes effect, and gives Customer the
opportunity to object on reasonable data-protection grounds before that date.
4. Security measures
HVN Group maintains: encryption of estimate content in transit and at rest; access controls limiting estimate content to personnel and systems that need it; and an append-only record of personnel access to an estimate document (who opened it, which version, and on which internal surface — not the document contents).
Failed-extraction review is part of providing the service. When an estimate does not parse, or its figures do not reconcile, HVN Group reviews the redacted document so it can still deliver the audit or the suggestions Customer asked for. That review is processing on Customer's instructions. It does not require sample-use consent, and it does not place the estimate into any accuracy test set.
Export into the golden set, or any other sample corpus used to measure accuracy, is a
separate use. An estimate is included only when Customer has opted in: the sample-use
consent on that audit, or a shop-level opt-in recorded on the shop. An estimate with
neither is never exported. See sample-estimate-contribution.md.
5. Confidentiality
HVN Group ensures personnel authorised to process estimate content are subject to confidentiality obligations.
6. Data-subject requests
If HVN Group receives a request from a data subject (for example a vehicle owner) relating to estimate content, HVN Group will, where legally permitted, direct the request to Customer rather than respond directly, and will reasonably assist Customer in responding to legitimate requests.
7. Breach notification
HVN Group will notify Customer without undue delay, and in any case within 72 hours of becoming aware, of a confirmed security incident affecting Customer's estimate content. The notice states, with the information reasonably available at the time: when HVN Group became aware, what happened, which estimate content is affected, and what HVN Group is doing about it. HVN Group sends updates as the investigation progresses.
8. Deletion on termination
On termination of the subscription, or when Customer closes the shop account, HVN Group
deletes Customer's estimate content per data-retention.md (30 days from active systems,
90 days from backups), except for de-identified aggregated statistics, the de-identified
event-log skeleton that policy describes, free-audit samples Customer contributed under
sample-estimate-contribution.md, and records HVN Group must retain by law (including
billing and tax records).
9. Audit
On reasonable request (no more than once per 12 months, absent a security incident), HVN Group will complete a written security questionnaire from Customer.
10. Storage location and applicable frameworks
Estimate content is stored with the US-region sub-processors listed in subprocessors.md.
HVN Group processes data as a service provider under the CCPA and comparable US state privacy
laws and, to the extent any data in scope is subject to GLBA, as a service provider under
GLBA's exception framework.
11. Liability
This Addendum does not expand HVN Group's liability beyond the limitation set out in
terms.md.
12. Contact
HVN Group Limited — support@suppsmith.com — Flat/Rm 01, 27/F, Comweb Plaza, 12 Cheung Yue Street, Lai Chi Kok, Kowloon, Hong Kong