Data Processing Addendum

What this addendum is

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you (the "Customer") and [Company legal name: not set (LEGAL_COMPANY_NAME)] ("we"). It applies when we process personal data on your behalf in providing Open Motives ("Customer Personal Data"), under the EU General Data Protection Regulation, the UK GDPR, the Swiss FADP and similar laws. If the Terms and this DPA conflict about personal data, this DPA wins.

[Owner: say how customers accept it, for example "It applies automatically when you accept the Terms. If you need a countersigned copy, write to [Contact email: not set (LEGAL_CONTACT_EMAIL)]."]

Roles

• You are the controller of Customer Personal Data (or a processor acting for your own clients, in which case we are your sub-processor).
• We are your processor and process Customer Personal Data only to provide the Service.
• For personal data about your members as users of Open Motives (accounts, sign-ins, billing), we are a controller under our Privacy Policy.

Details of the processing

Our obligations

We will:

• process Customer Personal Data only on your documented instructions, which are the Terms, this DPA and what you configure in the Service (connecting accounts, sending messages, switching on AI, setting retention). We tell you if we think an instruction breaks data protection law;
• make sure people who can access it are bound by confidentiality, and limit access to those who need it;
• apply the security measures below;
• use subprocessors only as described below;
• help you answer data subjects' requests and meet your obligations on security, breach notification, impact assessments and consultations, taking into account the nature of the processing;
• delete or return Customer Personal Data at the end of the Service as described below;
• give you the information reasonably needed to show compliance with this DPA, and allow audits as described below.

Your tools for data subjects' requests

The Service lets you answer most requests yourself:

• Access and portability: export a contact's data (JSON or CSV) from the contact's page; export conversations, posts and the whole organization (organization owners).
• Erasure: erase a contact, which blanks their details and the content of their messages, replies, internal notes, email contents and website chat visitor records and deletes their attachments, keeping only what's needed to honour an opt-out.
• Objection to marketing: contacts' opt-outs are recorded per channel and enforced on every send (including SMS STOP keywords).
• Retention: choose how long conversations, unused media, inactive contacts, workflow runs and AI usage are kept (see below).

If a data subject contacts us directly about Customer Personal Data, we pass the request to you without undue delay and don't answer it ourselves unless you ask us to.

Security measures

• Encryption: HTTPS for all traffic; platform access tokens, AI provider keys, email mailbox passwords and two-factor secrets encrypted at rest with AES-256-GCM; passwords stored only as salted hashes; backups encrypted before they leave the server.
• Access control: role-based permissions per organization and workspace, per-account access for team members, two-factor sign-in that owners can require, re-authentication before sensitive changes, session and device management, automatic sign-out of other sessions after a password or email change.
• Tenant isolation: every customer record is scoped to its organization and workspace in the database layer; every page, API route and MCP tool is tested on every change for access by other organizations and lower roles.
• Our staff: access on a need-to-know basis. Support access to a customer account is time-limited (at most an hour), needs a stated reason, emails the member, is recorded in the customer's activity log, can't touch passwords, two-factor, API keys, members, security settings or exports, and can be switched off by the organization's owners.
• Application security: protection against cross-site scripting, request forgery and server-side request forgery, checked uploads, signed webhooks, rate limits and abuse caps, dependency pinning by hash, regular security reviews.
• AI safeguards: customer and end-user text goes to AI models only as data, never as instructions; actions that change data wait for a person's approval unless you allow them; AI web search strips email addresses and phone and card numbers from queries.
• Resilience and monitoring: nightly encrypted off-site backups with restore tests, health monitoring, error monitoring that scrubs personal data, request IDs in logs without message content.
• Activity log: organization owners and admins see who did what, including support access.

[Owner / lawyer: attach this list as the technical and organizational measures annex, and add hosting and physical security details from the hosting provider.]

Subprocessors

You give general authorization for us to use subprocessors. The current list, with what each does, what data and where, is at /legal/subprocessors/. We impose data protection obligations on each subprocessor that are at least as protective as this DPA and remain responsible for them.

We will tell you about new or replaced subprocessors at least [30] days before they start processing Customer Personal Data, by updating the list and [by email to organization owners who asked for notice at [Contact email: not set (LEGAL_CONTACT_EMAIL)]]. You can object on reasonable data protection grounds within that period; if we can't resolve it, you may end the affected part of the Service and get a refund of prepaid fees for it.

Platforms you connect yourself (such as Meta, Google, TikTok, X, LinkedIn or your own Twilio account), AI providers you bring your own key for, and apps or MCP servers you connect to AI agents are not our subprocessors: you choose them and use them under your own agreements, and we send data to them on your instruction.

Personal data breaches

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Personal Data, we will notify you without undue delay and at the latest within [48] hours, with what we know (what happened, the data and people likely affected, likely consequences, what we are doing) and update you as we learn more. We will notify the organization's owners by email. Notifying us does not mean we accept fault.

International transfers

Where Customer Personal Data is transferred out of the EU/EEA, the UK or Switzerland to a country without an adequacy decision, the European Commission's Standard Contractual Clauses (module two, controller to processor, or module three, processor to processor) are incorporated into this DPA, with the UK addendum and Swiss amendments where they apply. [Lawyer: fill the SCC options (docking clause, governing law, supervisory authority) and annexes.]

How long we keep data, deletion and return

By default, Open Motives keeps your organization's conversations, contacts, media files, workflow history and AI usage records for as long as your account exists. Organization owners and admins can choose shorter periods under Organization → Data retention: inbox conversations for 3 months to 3 years, unused media files for 6 months to 2 years, inactive contacts for 6 months to 3 years, workflow run history for 7 or 14 days, and AI usage details for 3 months to 2 years. A daily job then permanently deletes data older than the chosen period, including attachments. To honour unsubscribe requests, we keep a minimal record (phone number, email address, channel identifiers and consent history) of contacts who opted out. We always keep the current and previous month's conversations and AI usage, because they are needed for billing and usage statements; for older months we keep only monthly totals. Billing records and the security activity log follow their own retention periods. Deleted data can't be recovered from the app; it disappears from our encrypted backups as those backups expire.

When you delete a connected account, its stored tokens, messages and analytics are deleted with it. When an organization is deleted, its data is removed after a 14-day grace period in which its owners can cancel. Before you leave, organization owners can export the whole organization. After the Service ends, we delete remaining Customer Personal Data within [30] days, except copies in encrypted backups, which expire within [backup rotation: owner to fill] days, and data we must keep by law.

Audits

We will answer reasonable security questionnaires once a year and provide relevant summaries of our security measures and reviews. If that isn't enough to show compliance, or a supervisory authority requires it, you may audit our processing of Customer Personal Data with [30] days' notice, at your cost, during business hours, under confidentiality, without access to other customers' data. [Lawyer: confirm.]

Liability

Each party's liability under this DPA is subject to the limits in the Terms, except where the law doesn't allow limits.

Contact

Data protection questions and requests: [Contact email: not set (LEGAL_CONTACT_EMAIL)]. [Company legal name: not set (LEGAL_COMPANY_NAME)], [Registered address: not set (LEGAL_COMPANY_ADDRESS)].