Data Processing Agreement
1. Parties and roles
This Data Processing Agreement ("DPA") is between the pawn shop that uses PawnCounter ("the Shop") and Adelyons Software LLC, PO Box 53, Council Bluffs, IA 51502 ("Adelyons"). It forms part of the Terms of Service.
For the personal information of the Shop's customers contained in files the Shop uploads, the Shop is the controller (the party that decides why and how the information is used) and Adelyons is the processor (the party that handles it on the Shop's behalf).
2. Scope of processing
| Subject matter | Providing PawnCounter: reading the Shop's POS and police-reporting exports and producing reports, dashboards and offer recommendations. |
|---|---|
| Duration | For as long as the Shop uses PawnCounter, and until deletion under section 9. |
| Data subjects | The Shop's customers (pledgors, sellers and buyers) and the Shop's staff named in exports. |
| Categories of data | Names, government ID numbers and types, dates of birth, addresses, phone numbers and physical descriptors where present in exports; transaction, item and dollar details; staff names or IDs. |
| Processing operations | Receiving, storing, parsing, hashing identity fields, computing metrics, rendering reports, and deleting. |
3. Processing on the Shop's instructions
Adelyons processes the Shop's customer information only to provide and improve PawnCounter for the Shop, as described in the Terms and this DPA, or as the law requires. Uploading a file and using PawnCounter's features are the Shop's instructions. Adelyons does not sell this information, use it for advertising, or share it with other shops.
Customer identity fields are replaced with one-way hashes before analysis. Adelyons keeps the original uploaded files, encrypted, until the Shop asks for deletion, so that the Shop's history can be re-read as PawnCounter improves. Adelyons plans to add a step that strips identity columns from stored files.
4. Confidentiality
Only people who need access to operate or support PawnCounter can reach the Shop's data, and they are bound to keep it confidential.
5. Security measures
Adelyons maintains these measures today:
- Encryption in transit: all traffic to PawnCounter uses HTTPS (TLS).
- Encryption at rest: the database and file storage are encrypted at rest by the hosting providers (Supabase and Google Cloud).
- Hashing at ingest: customer identity fields are hashed before any analysis; reports use only the hashed ledger.
- Private storage: uploaded files sit in a private bucket reachable only with a server-held key.
- Least-privilege keys: the website holds only a public key that cannot read stored data; privileged keys stay on the server.
- Row-level security: database rules limit each signed-in user to their own shop's records.
- Logging: server access and error logs are kept to detect and investigate misuse.
6. Subprocessors
The Shop authorizes Adelyons to use these subprocessors:
| Subprocessor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication and file storage | United States (AWS us-east-1) |
| Google Cloud | Server hosting for the website and analysis engine | United States (us-central1) |
| Stripe | Payments (receives billing details only, not uploaded files) | United States |
| Resend | Transactional email (receives account email addresses only) | United States |
Adelyons will update this list and notify account holders by email before adding a subprocessor that receives uploaded files.
7. Security incidents
If Adelyons becomes aware of a breach affecting the Shop's customer information, it will notify the Shop by email without undue delay and within 72 hours, describe what happened and what data was involved, and help the Shop meet any notification duties it has.
8. Assistance
Adelyons will help the Shop respond to requests from its customers and from regulators about the data Adelyons processes, to the extent it can. Requests go to support@pawncounter.com.
9. Deletion and return
On the Shop's request, or when the Shop closes its account and asks for it, Adelyons will return a copy of the Shop's uploaded files and delete the original files, the ledger, reports and account data, except where the law requires Adelyons to keep a record.
10. Audits
On reasonable written request, Adelyons will answer the Shop's security questions and provide information needed to show compliance with this DPA. Adelyons does not currently hold third-party security certifications.
11. The Shop's obligations
The Shop remains responsible for its own obligations under the Gramm-Leach-Bliley Act and state pawn, privacy and reporting laws, including having a lawful basis to share its customers' information with Adelyons and complying with its POS license terms.
12. Contact
Questions about this DPA, or requests under it, go to support@pawncounter.com.