How Sledge handles personal data in your workspace on your behalf.
Effective Date: November 27, 2026 ยท Last updated: October 28, 2026
This Data Processing Agreement ("DPA") is part of the Sledge Terms of Service (the "Agreement") between DMR Corp, doing business as Sledge ("Sledge"), and the Customer. It applies when Sledge processes Customer Personal Data to provide the Services. If this DPA conflicts with the Agreement, this DPA controls for data protection.
2.1 The Customer is the controller (or "business"). Sledge is the processor (or "service provider"). If the Customer is itself a processor for someone else, Sledge is its subprocessor.
2.2 Sledge will process Customer Personal Data only on the Customer's documented instructions. The Agreement, this DPA, and the Customer's use and settings of the Services are the Customer's complete instructions. Sledge will tell the Customer if it believes an instruction breaks Data Protection Laws.
2.3 The Customer is responsible for having a lawful basis and giving any notices or getting any consents needed for Sledge to process Customer Personal Data, including data about its employees, crews, clients, subcontractors, and vendors, and location data from team devices.
2.4 Sledge's own limited purposes. The Customer instructs and authorizes Sledge to also use Customer Personal Data, as Data Protection Laws allow for service providers and processors, to:
Data from connected integrations, such as Gmail, Google Calendar, Outlook, QuickBooks, and bank connections, is never used for AI training or improvement.
Sledge will not use Customer Personal Data to build or change a profile of any person for another business, and will not try to re-identify De-identified Data.
2.5 Details of the processing (subject matter, duration, purpose, types of data, and categories of people) are in Annex 1.
3.1 Confidentiality. Sledge will make sure everyone who can access Customer Personal Data is bound by confidentiality duties and accesses it only as needed to provide the Services.
3.2 Security. Sledge will keep the technical and organizational measures in Annex 2. Sledge may update them as long as protection does not go down overall.
3.3 Subprocessors. The Customer approves the Subprocessors on Sledge's Subprocessors page. Sledge will:
The Customer may object to a new Subprocessor on reasonable data protection grounds within that 30 days. If the parties cannot resolve it, the Customer may end the affected Services and get a refund of prepaid fees for the unused period.
3.4 Individual requests. If Sledge receives a request from a person to exercise privacy rights about Customer Personal Data, Sledge will send it to the Customer and not respond itself, except to say it was forwarded. Sledge will give reasonable help, including through self-service tools in the Services, so the Customer can respond.
3.5 Security Incidents. Sledge will notify the Customer without undue delay after confirming a Security Incident. The notice will include what Sledge knows about what happened, the data and people affected, likely effects, and steps taken. Sledge will update the Customer as it learns more and help the Customer meet its own notice duties.
3.6 Assessments. Sledge will give reasonable help with the Customer's data protection impact assessments and consultations with regulators, using information Sledge has.
3.7 Audits. Sledge will make available information needed to show it follows this DPA. Once Sledge has a SOC 2 report, it will share the most recent report under confidentiality, and that report satisfies audit requests unless a regulator requires more. The Customer may otherwise audit once a year, with 30 days' notice, during business hours, at its own cost, and under confidentiality.
3.8 Return and deletion. When the Agreement ends, the Customer may export its data for 30 days. Deleting an account starts a 30-day window in which the Customer can undo the request; once it closes, Sledge permanently deletes Customer Personal Data, with backups rolling off afterward under Sledge's retention schedule, unless the law requires Sledge to keep it. Sledge will confirm deletion in writing on request. De-identified Data, aggregated data, and AI models and features already trained or improved under Section 2.4 are not Customer Personal Data and are not returned or deleted.
3.9 AI. Sledge may use De-identified Data to improve its own AI models and features under Section 2.4 unless the Customer turns this off. Sledge will not use Customer Personal Data in identifiable form to train AI models shared with other customers unless the Customer opts in. Sledge's AI Subprocessors may process Customer Personal Data only to provide results to Sledge, and may not train their models on it.
3.10 AI providers. Sledge's AI model providers are Subprocessors under Section 3.3 and are listed on the Subprocessors page. Sledge only engages providers bound by written terms that limit their use of data to returning results and bar training on it.
3.11 Customer-connected AI. If the Customer connects its own AI account, API key, or model, that provider is the Customer's own vendor, not a Sledge Subprocessor, and this DPA does not cover its processing.
3.12 APIs, MCP, and connected apps. When the Customer connects Sledge to its own tools or to outside AI assistants through Sledge's APIs or MCP server, Customer Personal Data sent to them is transferred on the Customer's instructions. Those apps are the Customer's own vendors, not Sledge Subprocessors.
3.13 AI agents. Sledge AI agents that process Customer Personal Data in the background act only on the Customer's instructions, within the permissions of the user or workspace that set them up, use only the model providers allowed under Section 3.10, and are logged.
For Customer Personal Data subject to the CCPA, Sledge will not:
Sledge will follow the CCPA and give the same level of privacy protection the CCPA requires. Sledge will notify the Customer if it can no longer meet these duties. The Customer may take reasonable steps to stop and fix unauthorized use. Sledge certifies that it understands and will follow these restrictions.
5.1 Sledge processes Customer Personal Data in the United States.
5.2 For personal data transferred from the European Economic Area, the parties agree to the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 (the "SCCs"), Module Two (controller to processor), and Module Three (processor to processor) where the Customer is a processor. The SCCs are incorporated by reference, with these choices: Clause 7 (docking) applies; Clause 9 option 2 (general authorization, 30 days' notice); Clause 11 optional language does not apply; Clauses 17 and 18: the law and courts of Ireland. Annexes 1 and 2 of this DPA complete the SCC annexes.
5.3 For transfers from the United Kingdom, the UK International Data Transfer Addendum to the SCCs applies. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection.
5.4 If Sledge certifies to the EU-U.S. Data Privacy Framework in the future, it may rely on that instead.
6.1 Each party's liability under this DPA is subject to the limits and exclusions in the Agreement, except where Data Protection Laws or the SCCs do not allow a limit.
6.2 This DPA lasts as long as Sledge processes Customer Personal Data, and ends when that data is deleted or returned.
6.3 Sledge may update this DPA to reflect changes in law or its Services, as long as the update does not lower the protection of Customer Personal Data.
6.4 Changes in law. If Data Protection Laws or official guidance change, Sledge may update this DPA and its Annexes to comply, and will work in good faith with the Customer on any additional terms the law requires. Questions or requests about this DPA go to legal@getsledge.com.
Parties. The data exporter is the Customer, as controller. The data importer is DMR Corp, doing business as Sledge, as processor (support@getsledge.com).
Subject matter and purpose. Providing the Sledge Services, including construction job, contract, document, financial, payment, and AI features, under the Agreement, and the limited purposes in Section 2.4.
Duration. The term of the Agreement, plus the deletion period in Section 3.8.
Frequency. Continuous.
People whose data is processed. The Customer's owners, employees, and field crews; its clients, subcontractors, vendors, and their contacts; and other people named in Customer Content.
Types of personal data. Names, contact details, job titles, trade and license information, signatures on uploaded documents, photos, voice recordings, precise location tied to records, time entries, bank and payment details (through Stripe), tax IDs, insurance certificate details, messages and email content, and device and usage data.
Sensitive data. Bank account details and precise location. These are protected by the measures in Annex 2, with access limited to what is needed. The Customer should not upload health, biometric, or other special category data unless it is needed for a job record.
Subprocessors. As listed on the Subprocessors page.
EU supervisory authority. The authority where the Customer is established, or Ireland if there is none.
Sledge applies commercially reasonable technical and organizational measures appropriate to the risk, including those below. Sledge may update them as the Services change, provided protection is not materially reduced.
See the current Subprocessors page.
October 28, 2026. Added Sledge's own limited purposes (2.4), including de-identified AI improvement with a Customer opt-out and Sledge ownership of De-identified Data. Kept identifiable training opt-in. Excluded De-identified Data and trained models from return and deletion. Added Canadian privacy law.
October 23, 2026. Replaced specific security commitments with commercially reasonable measures until each one is defined, tied return and deletion to the deletion flow in the product, and removed the AI model choice that Sledge does not offer.