Data Processing Agreement

You are the Controller and we are the Processor of the “Customer Personal Data” — the end-customer message content and identifiers processed through your connected channels. You are responsible for the lawfulness of your instructions and for having a valid basis (including any required consent) to message your customers.

• Subject matter: providing the HyperDM Service.
• Duration: the term of your subscription plus deletion periods below.
• Nature & purpose: receiving inbound messages; generating and sending replies; storing conversations and consent state; transcribing inbound voice messages to text so your agent can answer them; sending the email campaigns and flow emails you compose, through the email-provider account you connect, and recording their delivery outcomes, unsubscribes and link clicks; recording taps on your tracked links with their approximate location (country, region, city — never the IP address); recording comments on your Instagram posts (which post, the comment’s and the commenter’s IDs, the automation or flow that matched, and when — never the comment text); analytics for you.
• Data types: message content, platform-scoped identifiers, usernames/profile images, opt-in/opt-out state, and transcripts of inbound voice messages; email addresses your end-customers give you; their email permission and its evidence (method, date, the consent wording shown, or your team’s note); a per-message send record (state, timestamps, template version — not the rendered message); a one-way hash of each address that unsubscribed, bounced or complained; taps on your tracked links, with each tap’s approximate location (country, region, city); and a per-comment record for comments on your Instagram posts (post, comment ID, the commenter’s platform-scoped ID, the automation or flow that matched, time — not the text), kept 13 months.
• Data subjects: your end-customers who message your connected accounts, people who comment on your connected accounts’ posts, and people who give you their email address.
• Voice messages — transcribe and discard. When an end-customer sends a voice message, the audio is retrieved and converted to text in a single operation and is never written to storage; this is enforced in our database schema, not only by convention. Only the transcript is retained, as part of the conversation record and under the same retention and deletion terms as any other message (§9). We perform no voice or biometric identification, and no voice data is used to train any model.

• Process Customer Personal Data only on your documented instructions (including via the Service’s settings), unless legally required otherwise.
• Ensure personnel are bound by confidentiality.
• Implement the security measures in §6 (Art. 32).
• Assist you, taking account of the nature of processing, with data-subject requests and with your obligations under Art. 32–36 (security, breach notification, DPIAs).
• Not sell Customer Personal Data and not use it for our own purposes or to train third-party foundation models.

You authorize us to engage the sub-processors below. We impose data-protection terms on each and remain responsible for their performance. We will give notice of new sub-processors and a reasonable opportunity to object.

Your email provider for customer email. If you use customer email, you engage your own email provider (today, Resend) under your own agreement with it and connect it with your API key. It is your processor, not our sub-processor, and this section’s sub-processor terms do not cover it. You instruct us to transmit to that account, for each email, the recipient’s address, the message with its personalised values, your sender details and an unsubscribe link; to register and remove the delivery-report webhook there; to read your sending domain’s status; and to receive its delivery reports. We store your API key encrypted and use it only for those instructions. Disconnecting removes it from our systems; the key itself stays valid at your provider until you delete it there.

Recipients at your instruction

The recipient below is not our sub-processor. We send it Customer Personal Data only when you set that up in the Service and switch it on — your documented instruction under §3 — and it receives the data into your own account, under your own agreement with it. You can stop it at any time from the Service.

HyperDM is Australian-owned. Its application hosting and primary database are in the United States. Australian ownership does not mean Australian data residency. Other subprocessors may process data in additional locations, as listed below. Where we transfer Customer Personal Data outside the UK/EEA, we rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, which are incorporated by reference and available on request.

• Encryption in transit (TLS) and encryption of stored channel access tokens.
• Strict tenant isolation via database row-level security and an application scoping layer.
• Signed-webhook verification, least-privilege access, and audit logging of sends and policy checks.
• Ongoing monitoring and access controls appropriate to the risk.

We will promptly notify you of a data-subject request we receive relating to your data and assist you in responding. We will notify you without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data and provide the information you reasonably need to meet your notification obligations.

On termination or your instruction, we will delete or return Customer Personal Data and delete existing copies within a commercially reasonable period, except where retention is legally required. You may also delete data during the term via the Service. The one-way hash of an address that unsubscribed, bounced or complained, with its reason, is kept after the end-customer’s record is erased, so they are not emailed again, and deleted with your workspace. Your email provider keeps its own records under your agreement with it; deleting data here does not delete them there.

We will make available information reasonably necessary to demonstrate compliance with this DPA and allow for audits (including via third-party reports or a questionnaire) on reasonable notice, subject to confidentiality.

Data-protection contact: hello@hyperdm.app — Anthony Casauria (sole trader), St Helena, Victoria 3088 (full registered address available on request), Victoria, Australia.