Data Processing Agreement

The customer is the controller (or a processor acting for its own customers) and Quad Labs L.L.C. is the processor of Customer Personal Data: personal data the customer submits to Sooner or that Sooner generates while sending the customer's email. This DPA takes effect when the customer accepts the Terms, needs no signature, and prevails over the Terms for personal data.

We process Customer Personal Data only on the customer's documented instructions, which are the agreement and the customer's use and configuration of the service, unless law requires otherwise; in that case we inform the customer first unless the law forbids it. We tell the customer if we believe an instruction breaks data protection law. Everyone authorized to process the data is bound by confidentiality.

We maintain the technical and organizational measures in Annex B. Taking the nature of processing into account, we help the customer respond to data subject requests (largely through self-service tools: contact export, deletion, suppression), and with security, impact assessments and consultations with authorities.

We notify the customer without undue delay, and in any case within 48 hours of becoming aware of a breach affecting Customer Personal Data, with the information then available: nature of the breach, categories and approximate numbers affected, likely consequences, and measures taken or proposed. We update the notice as we learn more.

The customer gives general authorization for the subprocessors in Annex C and on the subprocessor page. We bind each one to data protection terms at least as protective as this DPA and remain responsible for them. Changes are announced at least 30 days in advance; the customer may object as described on that page.

Where Customer Personal Data subject to EU/EEA law is transferred to Quad Labs L.L.C. in Kosovo or onward to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Decision (EU) 2021/914 are incorporated by reference: Module 2 (controller to processor) or Module 3 (processor to processor), with clause 7 included, option 2 of clause 9 (general authorization, 30 days' notice), the optional wording in clause 11 omitted, and the governing law and courts of Ireland for clauses 17 and 18. The annexes of this DPA complete the clauses' annexes. For UK data the UK International Data Transfer Addendum applies, and for Swiss data the clauses apply with references read as the Swiss FADP.

We make available information needed to show compliance, including providers' certifications, and allow reasonable audits once a year with 30 days' notice, at the customer's cost, limited to information not covered by those reports.

When the agreement ends, or when the customer deletes a team, we delete Customer Personal Data as described in Annex D, unless law requires us to keep it.

• Data subjects: the customer's email recipients and contacts; the customer's users.
• Categories: email addresses and names; contact properties the customer defines; email content and attachments; delivery, bounce, complaint, open and click events including IP addresses and user agents; unsubscribe and topic preferences.
• Special categories: none intended. The customer must not send special-category data unless it has a lawful basis and appropriate safeguards.
• Nature and purpose: storing, transmitting and tracking email on the customer's behalf; managing contacts and preferences; reporting.
• Frequency: continuous for the term of the agreement.
• Duration and retention: email logs for the plan's retention period; other data until deleted by the customer or the agreement ends.

• Encryption in transit (TLS 1.2+) for the dashboard, API, webhooks and SMTP delivery where the receiving server supports it; encryption at rest by our infrastructure providers.
• API keys stored only as SHA-256 hashes; keys can be scoped to sending only and locked to one domain; webhook payloads are signed.
• Tenant isolation: every query checks team membership; each team sends through its own SES tenant and has its own suppression list.
• Access to production limited to named personnel, with multi-factor authentication on provider accounts.
• Rate limiting, abuse monitoring, and automatic suppression of bounced and complaining recipients.
• Automated retention: logs deleted after the plan's retention period; team deletion purges all team data.
• Managed, replicated infrastructure with provider backups; incident response with customer notification as in section 4.

• Amazon Web Services (Amazon SES, SNS) (Amazon Web Services, Inc. / Amazon Web Services EMEA SARL): Email sending and delivery events: message content, sender and recipient addresses, delivery, bounce, complaint, open and click data. United States (us-east-1 by default; other regions on request). EU Standard Contractual Clauses (AWS DPA); EU-US Data Privacy Framework.
• Convex (Convex, Inc.): Application database, backend functions, queues and file storage: all customer data, account data, logs. United States. EU Standard Contractual Clauses (Convex DPA).
• Vercel (Vercel Inc.): Hosting the dashboard and website; request logs including IP addresses. Global edge network; United States. EU Standard Contractual Clauses; EU-US Data Privacy Framework.
• Paddle (Paddle.com Market Limited): Merchant of record: checkout, payments, invoices, tax, refunds. Paddle acts as an independent controller for payment data.. United Kingdom; payment processors worldwide. UK adequacy decision; Paddle's own transfer safeguards.
• GitHub / Google (optional) (GitHub, Inc.; Google LLC): Sign-in, only if you choose that provider: name, email address, avatar. United States. EU-US Data Privacy Framework; Standard Contractual Clauses.

The customer can export contacts at any time from the dashboard or the API. Deleting a team in Settings immediately disables its API keys, then permanently deletes its projects, emails, events, contacts, segments, templates, broadcasts, webhooks, suppressions and domains, and removes its sending identities from AWS. Deleted data leaves provider backups within their backup cycle. Invoice records held by Paddle and our accounting records are kept as tax law requires.