Data Processing Addendum
This Data Processing Addendum explains how NGO Analytics acts as processor for customer personal data when Grant Ops or Fiscal Sponsor OS is used. It applies under the Terms of Service unless a signed DPA replaces it.
Roles of the parties
The customer is the controller of personal data in its workspace. NGO Analytics is the processor and processes personal data only on the customer's documented instructions.
Data subjects and categories
Processing covers customer personnel (names, work emails, authentication records), end users of hosted pages, and any content the customer uploads, including organization facts such as EINs, award records, and uploads.
Duration and return/deletion
Processing lasts for the subscription term plus any retention period required by the Terms of Service or applicable law. On termination, customer data is returned or deleted per the retention policy.
Security measures
Organization-scoped roles, MFA for administrative access, TLS in transit, encryption at rest, and audit logging of sensitive actions.
International transfers
Hosting is in the United States (Supabase, DigitalOcean, Amazon SES in us-east-1). Transfers outside the customer's region rely on safeguards in the Terms of Service.
Subprocessors
Customers are notified before a new subprocessor receives production customer content. The current subprocessor list is on this page.
Request a signed DPA or the current subprocessor list at security@ngoanalytics.com. See also subprocessors and Security.