Squaremetry: Data processing agreement
Version 2026-10-15

1. Parties and scope

This agreement is between you, the business customer ("controller"), and Squaremetry ("processor"), the trade name of a sole proprietorship in the Netherlands. It applies to personal data of your clients and others that you put in Squaremetry, such as addresses, names in notes, photos and floor plans of homes. It is part of our terms of service when you use Squaremetry for your business, and lasts as long as you do.

  Business name: Squaremetry
  Legal form: sole proprietorship (eenmanszaak)
  Address: Noorderwind 49, 6846 WC Arnhem, the Netherlands
  Chamber of Commerce (KvK): 98353810
  VAT number: NL005326211B22
  Email: info@squaremetry.com

2. Only on your instructions

We process the data only to provide Squaremetry to you, as described in the terms and as you use it. We do not use it for our own purposes, do not sell it and do not use it to train AI. The one exception is the box "Help improve detection with my corrected tracing": only the owner or an admin of your workspace can switch it on, and then we keep copies of traced images to make detection better (see the privacy policy). For those copies we are the controller ourselves; by switching it on you give them to us for that purpose, so make sure you may. It is off until someone switches it on. If we think an instruction breaks data protection law, we tell you. If the law requires us to do something else with the data, we tell you first, unless the law forbids that.

3. Which data and whose

  * People: your clients, occupants and owners of homes, your team members and people you share plans with.
  * Data: names and email addresses, home addresses and building details, floor plans, photos and notes, share and edit history.
  * No special categories of data are needed. Please do not put them in Squaremetry.

4. Confidentiality and security

Everyone at Squaremetry who can access the data is bound to confidentiality. We take appropriate technical and organizational measures, including:

  * storage in the European Union;
  * a database that checks on every request who may read a plan, tested on every change;
  * sign-in without passwords, and sign-in with a passkey for staff who can see account data;
  * a log every time staff look at customer data in the admin area, and a security log kept for 13 months;
  * encrypted connections (HTTPS) for all traffic.

5. Sub-processors

You allow us to use the sub-processors listed in the privacy policy: Scaleway, Scaleway Transactional Email, Cloudflare, Google Workspace, Anthropic, Sentry, A second storage provider for backups. This includes those listed there as planned, once they start. AI actions a user starts go to Anthropic in the United States. Paddle is itself responsible for payments and is not a sub-processor. We bind them to the same duties as in this agreement. Data only leaves the European Economic Area with the safeguards the GDPR requires: the EU-US Data Privacy Framework or the EU Standard Contractual Clauses, as the privacy policy says per sub-processor. We tell you at least 30 days before we add or replace a sub-processor; you may object for a good reason, and if we cannot solve it you may end the agreement.

6. Helping you

We help you to answer requests from people about their data (access, correction, deletion, export), mostly through the tools in Squaremetry. We also help with a data protection impact assessment or a question from a supervisory authority, where it concerns our service.

7. Data breaches

If we discover a breach that affects your data, we tell you without undue delay and within 48 hours, with what we know and what we do about it, so that you can meet your own duty to report within 72 hours.

8. End of the agreement

You can export your data at any time. When you delete your account or the agreement ends, we erase the data within 30 days, unless the law requires us to keep it. Backups expire by themselves: daily ones after 35 days, monthly ones after 400 days. Until then we use them only to restore after a failure.

9. Checks

On request we give you the information you need to show that we meet this agreement. You may have an audit done once a year by an independent auditor bound to confidentiality, at your own cost, with 30 days’ notice.

10. Liability and law

The liability rules in the terms of service apply. Dutch law applies, and disputes go to the court in Gelderland (Arnhem), the Netherlands. Want a signed copy? Email us at info@squaremetry.com.

Controller (business customer): name, address, signature, date


Squaremetry: signature, date