Data Processing Agreement

Pending counsel review. Placeholder. The binding DPA ships post-counsel as a new revision with effective_at set forward and a customer notice. Customers requiring a signed DPA today should email legal@theapp.com.

Roles

For the personal data the customer puts into the Service, the customer is the controller and TheApp is the processor.

Subject matter and duration

TheApp processes personal data for the duration of the customer's subscription, and for the additional period required to deliver the Service (backups, audit logs, legally mandated retention).

Categories of data and data subjects

Categories: identifiers, contact information, transaction information, and operational metadata. Data subjects: the customer's end customers, the customer's staff, and any other individuals whose data the customer chooses to process through the Service.

Sub-processors

Listed at /legal/sub-processors. Customers are notified before a new sub-processor is engaged on a critical path.

International transfers

Where personal data is transferred outside the customer's jurisdiction, the transfer relies on appropriate safeguards (Standard Contractual Clauses or equivalent), included in the post-counsel binding text.

Security

TheApp implements the technical and organisational measures described on the trust page (/trust). The binding measures schedule ships with the post-counsel revision.

Contact

dpa@theapp.com.