Data Processing Agreement
PublishedUpdated September 30, 2026
For business owners who need one to satisfy their own compliance obligations.
Overview
This Data Processing Agreement ("DPA") is part of the Terms of Service between A&Q Management Solutions LLC ("we," "us," "Processor") and the business that has an MTScheduling account ("you," "Customer," "Controller"). It applies to the personal information of your own customers ("End Recipients") that you enter into MTScheduling, and takes effect when you accept the Terms of Service. If this DPA conflicts with the Terms of Service on how End Recipient information is handled, this DPA controls.
Roles
You decide whose information goes into MTScheduling, why, and when reminders are sent. For End Recipient information, you are the controller (a "business," in some US state laws) and we are the processor (a "service provider"). We process that information only on your behalf, to provide the Service. For your own account information (name, email, billing details), we act as an independent business, as described in our Privacy Policy; this DPA does not cover that information.
What We Process
End Recipients' name, email address, phone number, mailing address, notes, reminder preference, and opt-out records, plus related records: maintenance items, due dates, completion history, price/cost figures, and reminder and review-request delivery history. We process it to store your records, work out due dates, send the reminder and review-request emails you configure, and honor opt-outs - for as long as your account is open, and until deletion as described below. We do not sell End Recipient information, use it for advertising, combine it with information from other customers, or use it for any purpose other than providing the Service to you.
Your Instructions
We process End Recipient information only on your documented instructions: the Terms of Service, this DPA, and your use of the Service's settings and features. If we believe an instruction would break the law, we will tell you. You are responsible for having a lawful basis and any required consent to collect End Recipient information and to email those people, including consent under CAN-SPAM in the United States and CASL in Canada. We help by including an unsubscribe link in every reminder and review-request email and blocking email to anyone who has opted out.
Confidentiality
Only people at A&Q Management Solutions LLC who need access to operate or support the Service can access End Recipient information, and they are bound by confidentiality obligations. Our internal metrics channel cannot see End Recipients' names, emails, phone numbers, or addresses.
Security
We protect End Recipient information with the measures described in our Security Overview, including database-level access controls that keep each business's data separate from every other business's, encryption in transit (HTTPS/TLS), hashed passwords, rate-limiting and error monitoring, and email authentication (SPF, DKIM, DMARC). We may update these measures over time, but will not make them materially weaker.
Sub-processors
You agree that we may use the providers listed on our Sub-processors page. Those that handle End Recipient information are Supabase (database hosting and authentication), Resend (email delivery), Vercel (application hosting and the daily reminder job), and Sentry (error monitoring, which may incidentally include limited account context). Stripe, Google, and Upstash do not receive End Recipient information. We require each sub-processor to protect the information under written terms no less protective than this DPA, and we remain responsible for their handling of it. If we add or replace a sub-processor that will handle End Recipient information, we will update the Sub-processors page and email the account owner at least 30 days before it starts. If you object on reasonable data-protection grounds, you may stop using the Service and close your account.
Security Incidents
If we confirm that End Recipient information was accessed, disclosed, or lost without authorization, we will notify the account owner without unreasonable delay and no later than 5 business days after confirming it, and tell you what we know, what we are doing about it, and what you may need to do (for example, notify your customers or a regulator). You are responsible for any notice to End Recipients that the law requires of you as controller.
Helping You Meet Your Obligations
If an End Recipient asks you to access, correct, or delete their information, you can usually do it yourself inside the app. If you need our help, email support@mtscheduling.com and we will respond within a reasonable time. If an End Recipient contacts us directly, we will point them to you and will not respond to the request ourselves unless the law requires it. We will give you reasonable help with an assessment or regulator inquiry about your use of the Service, and may charge a reasonable fee for unusually burdensome requests.
Return and Deletion
You can delete individual customers at any time inside the app, and the account owner can delete the whole account from Settings; both take effect immediately and also delete the related maintenance, reminder, and review-request records. If you ask us to close the account by email instead, we complete it within 30 days. Payment records are held by Stripe, not by us, and never contain End Recipient information. Our sub-processors delete their copies on their own schedules, described on our Data Retention & Deletion page (for example, email delivery logs at Resend are deleted within 30 days). If we keep database backups, deleted information may remain in them until they expire. Before closure, you can request a copy of your End Recipient information by emailing support@mtscheduling.com.
Audits and Records
On reasonable written request, no more than once a year, we will give you the information needed to show we are following this DPA, such as our Security Overview and Sub-processors page. We do not offer on-site audits.
Where Information Is Processed
Our providers host information in the United States. The Service is intended for businesses and End Recipients in the United States and Canada. We do not offer the Service for information subject to the EU or UK GDPR, so this DPA does not include international-transfer clauses for those regions.
Term and Conflicts
This DPA lasts as long as we process End Recipient information for you. Our liability under it is subject to the limitations in the Terms of Service.
Contact
Questions about this DPA? Contact A&Q Management Solutions LLC at support@mtscheduling.com.