Data Processing Addendum

Last updated October 14, 2026

For the information a business enters about its customers and drivers, the business decides and Illuminant acts on its instructions. This addendum is part of the Terms for every business, with nothing to sign.

This Data Processing Addendum (“DPA”) is part of the Terms of Service between Illuminant Inc (“Illuminant”, “we”) and each business that uses Drop (“you”). It applies automatically, with no signature needed. If you’d like a countersigned copy, write to support@illuminantinc.com.

1. Roles

For the personal information you put into Drop about your customers and drivers (“your data”), you are the controller, and the “business” under the California Consumer Privacy Act (CCPA). Illuminant is your processor, and your “service provider” under the CCPA. For members’ own account information, Illuminant is responsible, as the Privacy Policy describes.

2. Scope and instructions

• Your data is the information listed in the Privacy Policy: customers’ contact details, addresses and delivery instructions, orders and stops, proof, the emails Drop sends, and drivers’ location during routes.
• We process it only to provide Drop to you, as the Terms and your settings in the app direct. Those are your instructions.
• We don’t sell or share your data. We don’t retain, use or disclose it for any purpose other than providing Drop, or outside our direct business relationship with you, and we don’t combine it with other data, except as the CCPA allows.
• We don’t use your data for advertising or to train AI models.
• If we believe an instruction breaks the law, we’ll tell you.

3. Our people

Everyone at Illuminant who can access your data is bound by confidentiality. Access is limited to the few people who need it, and every staff support view of a business is read-only, needs a written reason, lasts an hour and is logged.

4. Security

We keep your data on servers in the United States, encrypted in transit (HTTPS), with nightly backups encrypted with AES-256. Proof files are served only through signed, short-lived links. Customer links use long random codes, expire, and load nothing from other sites. On the phone, proof waiting to upload is protected by iOS data protection.

5. Subprocessors

You authorize the subprocessors on our subprocessors page. Each is bound by terms that protect your data at least as well as this DPA. We’ll tell you at least 30 days before adding a subprocessor that handles your data, except in an emergency, when we’ll tell you as soon as we can. You may object by writing to support@illuminantinc.com; if we can’t resolve it, you can end your subscription.

6. Helping you answer requests

When your customers or drivers ask to see, correct or delete their information, the app lets you do most of it yourself: edit or delete a customer, and export your records. If a request reaches us, we pass it to you and help you answer it.

7. Breaches

If we confirm a breach of security that affects your data, we’ll tell you without undue delay, with what we know about what happened, the data involved, and what we’re doing about it. We’ll help you meet any duty you have to notify others.

8. Deletion and return

You can export your data at any time in Account › Privacy & data, on every plan. When your business is deleted, its data is erased after a 30-day grace period, and copies in our encrypted backups are overwritten within a further 30 days. Proof and route lines are deleted earlier under your plan’s history period, as the Privacy Policy describes.

9. Location

We process and store your data in the United States.

10. Audits

On reasonable request, once a year, we’ll give you the information you need to check that we meet this DPA, such as answers to a security questionnaire.

11. Liability

The limits of liability in the Terms apply to this DPA.

12. Precedence

If this DPA and the Terms disagree about processing your data, this DPA wins.

Contact

Illuminant Inc
2082 Michelson Dr.
Irvine, CA 92612
United States

Email: support@illuminantinc.com