Data Processing Agreement

Version 2026-10-23. Effective 23 October 2026.

You are the controller. We are the processor. We process personal data only on your instructions, to provide the service. You are solely responsible for your own compliance with privacy and marketing laws, including legal basis, transparency, objections, and data subject requests for your campaigns.

Data is stored in Switzerland. Subprocessors are listed by category: cloud hosting and database, payment processor, AI writing provider, email infrastructure provider. A named list is available on request. We use ordinary access control, encryption of stored mailbox passwords and keys, and staff who access customer data only to run or support the service.

We notify the account email of a personal-data breach without undue delay. We do not contact your recipients. You handle notice to your audience or to authorities. We assist with data subject requests that you receive, so far as the service allows.

Data is kept while the account is active and deleted 30 days after it ends, unless you delete it sooner. You may export it before then. This addendum follows the terms. Governing law is Norway.