Legal
Effective date: August 28, 2026 · Version 2026-08-28.1
These Customer Data Processing Terms (the "Data Terms") form part of the Terms of Service whenever Lemonade Host processes Customer Personal Data on behalf of a customer through hosting, Forms, Bookings, Commerce, or another customer-configured feature. They are intended to provide a practical baseline allocation for United States privacy laws and, where applicable, general controller-processor requirements. They do not include jurisdiction-specific international transfer clauses unless Lemonade Host separately agrees to them in writing.
"Customer Personal Data" means personal information contained in Customer Content or Visitor Data that Lemonade Host processes on behalf of Customer to provide the Service, excluding information Lemonade Host processes for its independent account, billing, security, fraud-prevention, abuse-response, support, or legal purposes. "Data Protection Law" means a privacy or data-protection law applicable to the relevant processing. "Controller" includes a business or other person that determines the purpose and means of processing. "Processor" includes a service provider or contractor that processes personal information for a Controller.
If these Data Terms conflict with the Terms of Service concerning Customer Personal Data, these Data Terms control to the extent of the conflict. The Privacy Policy describes Lemonade Host's broader practices. Customer's configuration of the Service, deployment of content, feature selections, support requests, and other lawful instructions under the agreement constitute documented instructions.
Customer is the Controller of Customer Personal Data and determines the purposes of collection, fields requested, lawful basis, communications, disclosures, retention, and responses to individuals. Lemonade Host acts as Processor to the extent it processes Customer Personal Data solely to provide, secure, maintain, troubleshoot, and support the Service on Customer's documented instructions. Lemonade Host may act as an independent Controller for account, billing, security, fraud, abuse, legal, and operational information as described in the Privacy Policy.
Customer represents that its instructions comply with Data Protection Law; that it has provided required notices and obtained required consents or another lawful basis; that it will not direct Lemonade Host to process prohibited regulated or highly sensitive data; that it will respond to individual rights requests; and that it will use available settings to minimize and delete data. Customer is responsible for the accuracy, quality, and legality of Customer Personal Data and for determining whether the Service is appropriate for the intended use.
Lemonade Host will process Customer Personal Data only on documented instructions and for the limited purposes of providing the features Customer activates; hosting, transmitting, displaying, organizing, and making data available to Customer; sending customer-configured transactional communications; maintaining availability, security, and integrity; preventing fraud and abuse; providing support; enforcing the agreement; and complying with law. If Lemonade Host is legally required to process data contrary to an instruction, it may do so and will notify Customer before the processing unless law prohibits notice.
Lemonade Host will not sell Customer Personal Data, share it for cross-context behavioral advertising, use it to build unrelated advertising profiles, or retain, use, or disclose it outside the direct business relationship except as permitted by Data Protection Law and the agreement. Lemonade Host will not combine Customer Personal Data with personal information received from another person or from its own consumer interactions except as permitted for a service provider or contractor, needed for security or fraud prevention, directed by Customer, or otherwise allowed by law.
The subject matter is the hosting and operation of Customer's Sites and customer-configured managed features. Processing continues for the term of the Service and the limited deletion, backup, legal-hold, and security periods described in the Privacy Policy. The nature and purpose may include collection, receipt, organization, storage, retrieval, consultation, transmission, display, backup, deletion, and security analysis. Data subjects may include Site visitors, prospective customers, purchasers, appointment participants, Customer personnel, contractors, clients, and other people whose information Customer submits.
Data types may include contact details; form messages; booking details and notes; order, shipping, fulfillment, and transaction information; device, browser, and referring-page information; privacy-reduced anti-abuse identifiers; Customer-uploaded content; and other fields Customer configures. Customer must not use the Service for protected health information, full payment-card data, government identification numbers, financial credentials, biometric identifiers used for identification, children's regulated data, or other specialized sensitive data unless a signed feature-specific agreement expressly permits it.
Lemonade Host will limit access to Customer Personal Data to personnel and providers who reasonably need access to perform the Service, protect the platform, respond to Customer, or comply with law. Personnel authorized to process the data will be subject to confidentiality obligations or an appropriate statutory duty. Lemonade Host may use automated systems to process data without human review where reasonably appropriate.
Lemonade Host will maintain administrative, technical, and physical safeguards reasonably appropriate to the nature of Customer Personal Data and the Service. Measures may include access controls, network filtering, TLS in transit, encryption at rest for retrievable credentials, one-way hashing of issued tokens, scoped permissions, logging, backup practices, secret rotation, and monitoring. Customer acknowledges that no system is completely secure and that the Service is a low-cost platform not designed for regulated or mission-critical workloads unless expressly stated.
Customer remains responsible for account security, lawful configuration, independent backups, credential protection, Authorized Agents, and the security of code and third-party tools. Security measures do not create a warranty or service-level agreement beyond the Terms.
Customer grants general authorization for Lemonade Host to use subprocessors needed to provide the Service. Subprocessor categories are described in the Privacy Policy and may include network, content-delivery, security, payment, repository, email, monitoring, support, and backup providers. Lemonade Host will impose written obligations on a subprocessor that are appropriate to the services and substantially protective of Customer Personal Data. Lemonade Host remains responsible for the subprocessor's processing to the extent required by applicable law and the agreement.
We may add or replace subprocessors. Where Data Protection Law requires advance notice and an objection opportunity, we may provide notice through email, dashboard, or an updated provider list. Customer's remedy for a reasonable, unresolved objection is to stop using the affected feature and cancel it before the new subprocessor begins processing, unless the parties agree to another solution.
Taking into account the nature of processing, Lemonade Host will provide commercially reasonable assistance through available functionality or support so Customer can respond to verified requests to access, correct, delete, or obtain Customer Personal Data. If Lemonade Host receives a request directly and can identify the relevant customer, it may direct the requester to Customer, forward the request, or ask Customer for instructions. Lemonade Host will not independently respond on Customer's behalf unless Customer authorizes it or law requires direct action.
Customer is responsible for verifying the requester, deciding whether an exception applies, communicating with the requester, and meeting applicable deadlines. Assistance requiring custom engineering, restoration from backups, excessive searches, or work beyond standard functionality may be subject to reasonable fees where law permits and after notice to Customer.
If Lemonade Host confirms unauthorized access to or acquisition, destruction, loss, alteration, or disclosure of Customer Personal Data that constitutes a reportable personal-data breach under applicable law, it will notify Customer without undue delay after confirmation, taking into account the nature of the incident, law-enforcement restrictions, and information available. Notice may describe the nature of the incident, affected data and records where known, likely consequences, measures taken or proposed, and a contact for follow-up.
A notice is not an admission of fault or liability. Customer is responsible for determining whether notice to individuals, regulators, clients, insurers, or others is required, except for obligations Lemonade Host independently owes. Lemonade Host will provide commercially reasonable cooperation, subject to security, confidentiality, legal restrictions, and reasonable cost allocation.
Taking into account the nature of processing and information available, Lemonade Host will provide commercially reasonable information and assistance concerning security, breach response, deletion, and privacy-impact obligations applicable to the Service. We may satisfy audit and information requests through policies, security summaries, questionnaires, certifications if any, logs, or other documentation. On-site inspection or invasive testing is not permitted unless required by applicable law, necessary because of a confirmed material incident or noncompliance, and subject to reasonable notice, confidentiality, scope, timing, security, and cost conditions.
Customer may take reasonable and appropriate steps to help ensure that Lemonade Host uses Customer Personal Data consistently with applicable service-provider or contractor obligations. If either party determines it can no longer meet an applicable obligation, it will notify the other where required, and the parties will take reasonable steps to stop and remediate unauthorized processing. Customer may suspend the affected transfer or feature if a material issue cannot be remedied.
During an active term, Customer may access, export, or delete Customer Personal Data through available functionality. Customer is responsible for exporting data before cancellation or deletion. After a Site or feature is deleted or the Service ends, Lemonade Host will delete or render inaccessible Customer Personal Data from active systems within the ordinary periods in the Privacy Policy, unless law, security, fraud prevention, a dispute, or a legal hold permits or requires retention. Residual copies may remain until normal backup cycles expire and will remain subject to these Data Terms while retained.
Default maximum operational periods are 180 days for form submissions, 24 months after an appointment for booking records, and up to seven years for commerce order records, subject to Customer's earlier deletion, feature-specific terms, and lawful exceptions. Customer is responsible for deciding whether a shorter period is required for its purpose.
To the extent the California Consumer Privacy Act applies to Customer Personal Data, the parties intend Lemonade Host to act as a service provider or contractor. Customer discloses Customer Personal Data only for the limited and specified purposes in these Data Terms. Lemonade Host will comply with applicable obligations imposed on service providers or contractors, provide the same level of privacy protection required of such a recipient, notify Customer if it determines it can no longer meet those obligations, and permit Customer to take reasonable and appropriate steps to stop and remediate unauthorized use. Lemonade Host will not sell or share Customer Personal Data and will not retain, use, disclose, or combine it except as permitted by the agreement and applicable law.
Where Article 28-style processor requirements apply, the provisions above are intended to address documented instructions, confidentiality, security, subprocessors, individual rights assistance, breach and compliance assistance, deletion or return, and audit information. Customer acknowledges that these Data Terms do not include standard contractual clauses, a United Kingdom transfer addendum, or another international transfer mechanism. Customer must contact Lemonade Host before using the Service for processing that requires such an instrument. Lemonade Host may offer additional terms, require a different plan, or decline the workload.
Liability arising from these Data Terms is subject to the disclaimers, exclusions, and aggregate liability cap in the Terms of Service to the maximum extent permitted by law. These Data Terms end when Lemonade Host no longer processes Customer Personal Data, except provisions that by their nature apply to retained copies, confidentiality, security, liability, or legal compliance.
Questions or instructions concerning these Data Terms may be sent to [email protected].
Related
Billing, renewal, deployments, and what happens if something goes wrong.
What we collect, who we share it with, and how to ask us to delete it.
The limits and rules that keep a 99¢ site healthy for everyone.
The 30-day guarantee on a new site, and how billing disputes are handled.
Where to send a DMCA notice, what it must contain, and how counter-notices work.
Every plan, every interval, on one page.
Join the list and we'll email you just once — that's the only thing we use your address for.