Data processing agreement

1. Definitions

"Personal Data", "processing", "controller", "processor", "data subject" and "supervisory authority" have the meanings given in the GDPR; "Data Fiduciary", "Data Processor", "Data Principal" and "Data Protection Board" have the meanings given in the DPDP Act. "Customer Data" means Personal Data that you, your Authors or your connected systems submit to PlugFlow, including data received through events and inbound webhooks.

2. Scope and details of processing

3. Your obligations

• You warrant that you have a lawful basis for the processing you instruct, including valid consent from Authors to publish their testimonials, and that your instructions comply with applicable law.
• You are responsible for the accuracy of Customer Data, for configuring consent text, and for responding to Data Principal / data subject requests relating to your workspace.
• You will provide any privacy notice required to Authors and customers receiving review requests.

4. Our obligations

• Process Customer Data only on your documented instructions (given through the dashboard, API, plugins or in writing), unless required by law, in which case we will inform you where permitted.
• Ensure staff with access are bound by confidentiality.
• Implement the technical and organisational measures in section 7.
• Assist you, taking into account the nature of processing, in fulfilling data subject requests and your obligations regarding security, breach notification and impact assessments.
• Delete or return Customer Data at the end of the service as set out in section 9.
• Make available the information necessary to demonstrate compliance and allow audits as set out in section 8.

5. Sub-processors

You authorise the sub-processors listed below, including those marked as not enabled yet. We keep this list up to date on this page when a sub-processor is added or replaced; you may object on reasonable data protection grounds, in which case either party may terminate the affected service. We remain liable for our sub-processors' performance.

Third-party services you connect under Automations (for example Slack, WhatsApp Business, HubSpot, Zoho CRM, Google Sheets, your own Razorpay account, Shopify, WooCommerce or any HTTP API) receive data only when your workflows send it. They act under your own agreement with them and are not our sub-processors.

6. International transfers

Customer Data is stored in data centres operated by our hosting sub-processor OVHcloud in Montreal, Canada, and passes through Cloudflare's global network for DNS, TLS and content delivery. The emails we send on your behalf (each recipient's address and the message) are processed by our email delivery sub-processor Resend, in its Tokyo (Japan) sending region and in the United States, where Resend does its primary processing, with Hostinger in the European Union as the backup path. For data subject to the GDPR or UK GDPR we rely on the EU Standard Contractual Clauses (Module 3, processor to processor, and Module 2 where we act as your processor) and the UK International Data Transfer Addendum, supplemented by encryption in transit and encryption of stored credentials. For Indian Data Principals, transfers are made only to countries not restricted by the Central Government under section 16 of the DPDP Act.

7. Security measures

• Encryption in transit (TLS 1.2+). Third-party access tokens, webhook secrets and connected-service credentials are encrypted with AES-256-GCM before storage; passwords are hashed with Argon2 and API keys are stored as hashes.
• Tenant isolation: every record carries a workspace identifier and all queries are scoped to the requesting workspace.
• Role-based access in the dashboard; short-lived access tokens with revocable refresh tokens; API keys with scopes.
• Secrets kept outside source control; secret-looking values redacted from workflow run logs; outbound requests from workflows restricted to public https hosts.
• Audit logging of administrative actions; revision history for every testimonial edit.
• Nightly database backups kept for 14 days on the hosting server, each verified to be restorable.
• Dependency vulnerability scanning on every build; production access limited to the operator over key-based SSH.

8. Audits

On written request no more than once per year (or following a confirmed breach) we will provide our current security documentation and answers to a reasonable security questionnaire. Where this is insufficient to demonstrate compliance, you may conduct an audit through an independent auditor bound by confidentiality, at your cost, on 30 days' notice and during business hours.

9. Breach notification, deletion and return

• We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach affecting Customer Data, and provide the information reasonably needed for your own notifications.
• You can export all Customer Data at any time from Settings → Danger zone (JSON) or via the API.
• On deletion of a workspace or account, Customer Data is erased from live systems after a 7-day restore window and from backups within a further 14 days, unless retention is required by law. Automation events are pruned after 30 days and workflow run logs after the plan's retention period (30 to 365 days) in any case.

10. Liability and precedence

Liability under this DPA is subject to the limitations in the terms of service. If there is a conflict between this DPA and the terms, this DPA prevails for matters of data protection.

11. Contact

Data protection enquiries, requests for a signed copy of this DPA or for the Standard Contractual Clauses: privacy@sedulousweb.com.