Data Processing Addendum

Status: draft outline.This page summarizes the data-processing terms we intend to offer. It is not yet an executed agreement and is subject to review by qualified counsel before the Inbox, Publish, and Launch modules are enabled. Where you require a signed Data Processing Addendum (“DPA”) — for example, to meet GDPR Article 28 obligations — contact us at privacy@floowzy.online. This addendum supplements and forms part of our Terms of Service and Privacy Policy.

1. Roles of the parties

For personal data of your audience and contacts that Floowzy processes on your behalf, you are the controller (or processor acting for your own customer) and Floowzy Labs LLC is the processor. Floowzy processes that data only on your documented instructions — which include your use and configuration of the product — except where law requires otherwise. For Floowzy's own account, billing, and security data, Floowzy acts as a controller as described in our Privacy Policy.

2. Subject matter, purpose, and scope

The subject matter is Floowzy's provision of the platform to you. The purpose of processing is to deliver the features you enable — in particular the Inbox, where Floowzy retrieves, displays, and helps you respond to messages, comments, and direct messages from your audience. Processing is limited to what is necessary to provide those features and to operate, secure, and support the service.

3. Categories of data subjects and personal data

• Data subjects: your audience and contacts — for example, people who message, comment on, or interact with the accounts and channels you connect.
• Personal data: the content of messages, comments, and direct messages; sender display names, handles, and platform-assigned identifiers; and associated metadata such as timestamps. You must not use Floowzy to process special categories of data unless lawful and appropriate safeguards are in place.

4. Where audience data lives

Inbox content originates at, and is stored by, the upstream platform or messaging provider you connect — it is not maintained in Floowzy's own database. Floowzy retrieves and processes that content through the provider's APIs to display it and to help you reply, subject to the permissions you grant and each platform's policies. Configuration, account, and audit data that Floowzy does store on your behalf is held in our infrastructure as described below.

5. Sub-processors

Floowzy engages sub-processors to help provide the service, under written terms that impose data-protection obligations consistent with this addendum. Categories include:

• Hosting and infrastructure — cloud hosting, database, and application-platform providers that run Floowzy and store the data we hold on your behalf.
• Connected platforms and messaging providers — the advertising platforms, publishing channels, and messaging surfaces you connect, which hold the source data and receive the actions you confirm.
• AI providers — model providers used to generate suggestions such as captions, ad copy, and reply drafts. AI providers are instructed not to train their models on your data where that option is available.
• Operational providers — for example, payment processing, error monitoring, and analytics used to operate and secure the service.

A current list of sub-processors is available on request at privacy@floowzy.online. We will give you a way to be notified of, and to object to, new sub-processors before they begin processing your data.

6. Data location and international transfers

Floowzy is operated from the United States, and the data we hold on your behalf may be processed in the United States and in other locations where our sub-processors operate. Where personal data is transferred across borders, we rely on an appropriate transfer mechanism (such as the EU Standard Contractual Clauses or an equivalent safeguard) where required by applicable law.

7. Retention and deletion

Floowzy processes audience data for as long as needed to provide the features you enable. Because Inbox content lives at the upstream provider, deleting it at the source — or disconnecting the account — removes Floowzy's ongoing access to it. For data Floowzy stores on your behalf, you can export or delete your account data at any time; on deletion we delete or anonymize that data within a reasonable period, except where we must retain limited records for legal, accounting, or security purposes. See our Data Deletion Instructions.

8. Security measures

Floowzy maintains technical and organizational measures appropriate to the risk, including encryption in transit, encryption of sensitive credentials, access controls and least-privilege access, network and application safeguards, logging and auditability, and ongoing review of our safeguards. See our Security & Data Use page for more detail.

9. Confidentiality and personnel

Floowzy ensures that personnel authorized to process personal data are bound by appropriate confidentiality obligations and access data only as needed to provide and support the service.

10. Assisting you with data-subject requests

Taking into account the nature of the processing, Floowzy will provide reasonable assistance to help you respond to requests from data subjects to exercise their rights (such as access, correction, deletion, restriction, objection, or portability). Because Inbox content is held at the upstream provider, some requests are fulfilled at the source platform; Floowzy's self-service export and deletion tools cover the data we hold. Requests can be directed to privacy@floowzy.online.

11. Personal data breach notification

Floowzy will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf, and will provide information reasonably available to help you meet your own notification obligations. Notifications will be sent to the account or contact details you provide.

12. Audits and compliance

On reasonable request and subject to confidentiality, Floowzy will make available information necessary to demonstrate compliance with this addendum and will allow for and contribute to audits as required by applicable data-protection law.

13. Return and deletion on termination

On termination of the service, and at your choice, Floowzy will delete or return the personal data it holds on your behalf and delete existing copies, except where retention is required by law.

14. Contact

Data protection: privacy@floowzy.online
Legal: legal@floowzy.online
Floowzy Labs LLC, 1209 Mountain Road PL NE, STE R, Albuquerque, NM 87110, United States