Items still to be completed
This Addendum is published so it can be read before a purchase rather than written during one. Four items are marked [TO BE COMPLETED] in the text below — our registered address for notices, the transfer mechanism we rely on for EU and UK personal data, the deletion window on termination, and the sub-processor change-notice period. Those are commitments a company makes, not facts a document can report, and we would rather show you the gap than fill it with a number we have not decided. Ask at legal@wpintegrate.com and you will get the current position in writing.
1. Scope and roles
This Addendum applies whenever WPIntegrate processes personal data on your behalf in the course of providing the WPI Components platform, the embeddable components, and the related services described in our Terms & conditions. It supplements those terms and does not replace them.
- You are the controller of the personal data that reaches us through your account, your configured components, and your Microsoft 365 tenant. WPIntegrate is the processor of that data.
- Where you are yourself a processor acting for someone else, WPIntegrate is a sub-processor and this Addendum applies on that footing.
- WPIntegrate is a controller for the narrow set of data it needs to run its own business: signup details, billing records, support correspondence, and product analytics on the dashboard. That processing is described in our Privacy policy, not here.
"WPIntegrate", "we", "us" — Diverse Website Strategies LLC, a US-based company operating the wpintegrate.com brand and the dash.wpintegrate.com product platform. Registered address for notices: [TO BE COMPLETED].
2. Definitions
"Personal data", "processing", "controller", "processor", "sub-processor", "data subject", and "personal data breach" carry the meanings given to them in the EU General Data Protection Regulation (GDPR). Where the UK GDPR, the Swiss FADP, or a US state privacy statute applies instead, the nearest equivalent term is intended. "End user" means a visitor to a website on which you have embedded one of our components.
3. Subject matter and duration
Subject matter. Providing an embeddable web component platform that reads from, and writes to, your Microsoft 365 tenant, and that receives submissions from end users of the websites where you embed it.
Nature and purpose. Hosting, storage, transmission, retrieval, and deletion, performed only to deliver the service you have configured.
Duration. For the term of your subscription, plus the deletion window in clause 13. Individual categories carry shorter lifetimes where clause 4 says so.
Categories of data subject. Your personnel who hold dashboard accounts; the people recorded in the Microsoft 365 data your components read; and end users who submit a booking or a form through a component you have embedded.
4. What we process for you
The categories below are what the platform actually handles, in the places it actually keeps them. Everything in the "Retention" column is enforced in code, not by policy.
| Category | Typical fields | Where it is held | Retention |
|---|---|---|---|
| End-user submissions | Whatever fields you configure on a booking or form component — commonly name, email address, phone number, and free text. | Managed PostgreSQL, New York (NYC3), United States. | 7 days, then deleted by a nightly job. Permanent storage is yours to arrange through the email, webhook, or SharePoint destination you configure. |
| Microsoft 365 data | Calendar events, Bookings businesses and services, document library metadata, and directory records — whichever the component you configured reads. | Read on demand from Microsoft Graph in response to a request carrying your embed key. Held in memory to serve that request. | Not retained as a copy in our database. |
| Tenant connection | Microsoft tenant identifiers and the access tokens obtained for your tenant. | Managed PostgreSQL, in the token cache table. | For as long as the connection exists; removed when you disconnect. |
| Account and configuration | Account holder name and email, component settings, allowed domains, and any credentials you supply for proxy mode or your own SMTP. | Managed PostgreSQL, New York (NYC3), United States. | Life of the account, then clause 13. |
| Usage counts | Per-component view counts per day, per billing cycle. A count, not an event log, and not tied to an end user. | Managed PostgreSQL. | Life of the account. |
| Support correspondence | Ticket subject and body, the name and email of the person who filed it, and the account it was filed against. | Our support portal at components.wpintegrate.com. | Life of the account, then clause 13. |
5. Your instructions
We process personal data only on your documented instructions. Your configuration of the service — the components you create, the Microsoft 365 resources you point them at, the domains you allow them to render on, and the destinations you send submissions to — is that instruction. We do not process the data for our own purposes, we do not sell it, and we do not use it to train models.
We will tell you if an instruction appears to us to breach data protection law. Our personnel with access to personal data are bound by confidentiality.
6. No third-party telemetry in embedded widgets
The component bundles your visitors load contain no third-party analytics, no session recording, and no advertising SDK. This is a recorded architectural decision, not an account setting: there is no switch that turns one on for an individual customer, because no such code ships in the bundle.
Usage is counted on our own servers instead. We record component views per account per billing cycle in our own database to enforce plan limits. That is a first-party record of our API being called; it needs no tracker on your visitors and produces no profile of them.
What this means for your own compliance work: embedding a WPIntegrate component does not by itself add an entry to your cookie banner, a consent gate, or a sub-processor to your own privacy notice.
Webfonts are served from our own CDN, and were not always. Before
13 August 2026, selecting a non-system font family made the widget load that font's
stylesheet from fonts.googleapis.com — a request issued by your visitor's
browser, from your page, disclosing their IP address to Google. The five families we
offer are now hosted on cdn.wpistatic.com next to the component code. All
five are licensed under the SIL Open Font License 1.1, which is what permits us to host
them. No font selection causes a third-party request today.
Other third-party requests remain possible from inside a component, and each is the direct result of a choice you make in the builder. We list them because a security review will find them:
- Google Tag Manager. Only when you set your own GTM container ID on a component. The container is yours; we push named events into the data layer and ship no vendor tag of our own.
- Google reCAPTCHA. Only when you enable it on a booking or form component using your own site and secret keys, to stop submission abuse.
- A map SDK. Only on the Maps component, and only with your own API
key. Azure Maps (
atlas.microsoft.com) is the default; Google Maps (maps.googleapis.com) if you choose that provider.
All three are off unless you configure them, all three use your own vendor account, and none of them is a WPIntegrate sub-processor — you contract with Google or Microsoft directly and you are the party that discloses them.
7. Microsoft 365 access modes
Every account uses one of two modes for reaching Microsoft Graph. Which one applies to you is recorded on your account; new accounts default to managed. Your security team will want to know which, because the answer changes who holds credentials for your tenant.
Managed. WPIntegrate holds the Azure application credentials. Your IT administrator grants admin consent once to our multi-tenant application, and we obtain per-tenant tokens by the client credentials flow and call Microsoft Graph directly. In this mode Microsoft is a sub-processor of ours, and the tokens for your tenant sit in our token cache as described in clause 4.
Proxy. You supply a base URL and API key for a gateway you run in your own tenancy — typically Azure API Management. Our API calls your endpoint; it holds no Azure credentials for your tenant and never calls Microsoft Graph on your behalf. The Microsoft relationship stays entirely inside your own tenancy, and Microsoft is not our sub-processor for that data. The API key you give us is encrypted at rest and is never returned to a browser.
8. Sub-processors
You give general written authorisation for us to engage sub-processors. The current list, with what each one processes and where, is published and kept current at wpintegrate.com/subprocessors. That page also names the services that are present in our codebase but not enabled in production, so the list can be checked rather than trusted.
Each sub-processor is bound by written terms imposing data protection obligations no less protective than those in this Addendum, and we remain liable to you for their performance.
We will give notice before adding or replacing a sub-processor, with a period of [TO BE COMPLETED] in which you may object on reasonable data protection grounds. If we cannot resolve an objection, you may terminate the affected subscription without penalty for the remainder of its term.
9. International transfers
WPIntegrate is a US company and the platform runs on US infrastructure. Personal data you send us is processed in the United States. Where a component runs in managed mode, Microsoft Graph data is read from the region your own Microsoft 365 tenant sits in.
Transfer mechanism relied on for personal data originating in the EEA, the UK, or Switzerland: [TO BE COMPLETED]. We are not currently certified under the EU-US Data Privacy Framework and do not claim to be.
10. Security
The measures below are the ones actually implemented. We have deliberately not listed controls we intend to add.
- All platform endpoints are served over TLS.
- Credentials you supply — proxy API keys, SMTP passwords, reCAPTCHA secret keys — are encrypted at rest with AES-256-GCM before storage and are never returned to a browser.
- The database is a managed PostgreSQL instance reachable only from the application, by an allowlist of trusted sources.
- Component embedding is deny-by-default. An instance renders only on the domains you explicitly allow; an embed key lifted from your page will not run elsewhere.
- Components mount inside a shadow root, so a component cannot read or be read by the page around it through ordinary DOM or style access.
- Component assets are served from a separate registrable domain that sits outside the scope of our session cookie, and no customer-uploaded file is ever served from it.
- Access to production systems is limited to personnel who need it.
Certifications. We do not hold a SOC 2 report or an ISO 27001 certificate, and we will not tell you otherwise on a questionnaire. If your procurement process requires one, say so early and we will tell you honestly whether we can meet it.
11. Personal data breach
We will notify you without undue delay after becoming aware of a personal data breach affecting personal data we process for you. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records involved so far as known, the likely consequences, and the measures taken or proposed. We will co-operate with you and provide the information you reasonably need to meet your own notification duties.
12. Data subject requests
Taking into account the nature of the processing, we will assist you in responding to requests to exercise data subject rights. Because the dashboard gives you direct access to your account data, your component configuration, and the submissions inside the retention window, most requests can be answered by you without our involvement.
If a data subject contacts us directly about data we process for you, we will not respond substantively; we will refer them to you and tell you that we have.
13. Retention, return and deletion
End-user submissions are deleted 7 days after they are received, by a job that runs daily. This is not a policy statement — it is a scheduled deletion in the platform, and it applies whether or not you have exported the data. Configure an email, webhook, or SharePoint destination if you need a permanent record.
On termination or expiry we will delete or return the personal data we process on your behalf within [TO BE COMPLETED], except where we are required to retain it by law. Billing records are retained for the period required by tax and accounting rules.
14. Audits and information
We will make available the information reasonably necessary to demonstrate compliance with this Addendum and will respond to security questionnaires. Terms for on-site or third-party audits, including scope, frequency, notice, and cost: [TO BE COMPLETED].
15. Precedence and execution
This Addendum forms part of, and is subject to, the Terms & conditions. Where this Addendum and those terms conflict on the processing of personal data, this Addendum prevails. Where this Addendum conflicts with an executed Standard Contractual Clauses annex, the Clauses prevail.
This page is the current version and applies to all customers. If you need a countersigned copy on your own paper, or a copy with the completed items above filled in, write to legal@wpintegrate.com.
16. Contact
Data protection enquiries: privacy@wpintegrate.com. Contract and DPA execution: legal@wpintegrate.com.
Whether a Data Protection Officer or an EU or UK Article 27 representative has been appointed: [TO BE COMPLETED]. We have not named one here because we will not invent one.