Data Processing Agreement

This agreement is part of the Terms of Service. It applies when SendScripts.to, a sole proprietorship owned by David Sellers ("we", the processor) processes personal information on behalf of a studio ("you", the controller) through SendScripts.to. It meets Article 28 of the EU and UK GDPR and the "service provider" requirements of the California Consumer Privacy Act (CCPA).

1. What we process

2. Our commitments

We will:

1. Process the data only on your documented instructions, which are these terms and how you use SendScripts.to, unless the law requires otherwise (and then we'll tell you first, unless that's forbidden).
2. Make sure everyone who can access the data is bound by confidentiality.
3. Keep the data secure with the measures in the annex.
4. Use subprocessors only as set out in section 3.
5. Help you answer requests from people exercising their rights, mostly through features in SendScripts.to.
6. Help you with security, breach notifications, data protection impact assessments and consultations with authorities, as far as our role allows.
7. Delete or return the data when you leave, as set out in section 8.
8. Give you the information you need to show compliance, and allow audits as set out in section 7.

3. Subprocessors

You authorise the subprocessors listed on our Subprocessors page. We'll email you at least 30 days before adding or replacing one. If you object on reasonable data protection grounds, tell us within that time; if we can't resolve it, you may cancel and we'll refund any prepaid fees for the unused period. We bind each subprocessor to data protection terms at least as protective as these, and we remain responsible for them.

4. Breaches

We'll notify you without undue delay, and within 48 hours, after becoming aware of a breach affecting your data, with the information we have and what we're doing about it.

5. International transfers

Our subprocessors store data in the United States. Transfers from the EU, UK and Switzerland rely on the EU–US Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (module 2 or 3, as applicable) and the UK International Data Transfer Addendum, which are incorporated by reference.

6. California (CCPA)

We act as your service provider. We won't sell or share the personal information, use it for any purpose other than providing SendScripts.to to you, combine it with information from other sources except as the CCPA allows, or keep it outside our direct business relationship with you. We'll comply with the CCPA, tell you if we can no longer meet it, and let you take reasonable steps to stop unauthorised use.

7. Audits

We'll answer reasonable written questions about our compliance once a year, or after a breach. If that isn't enough, you may audit at your own cost, with 30 days' notice, during business hours, under confidentiality, and without access to other customers' data.

8. Deletion

You can delete data in SendScripts.to at any time. After a trial ends without a subscription, we delete the studio within 30 days. After a subscription ends, we delete uploaded files within 60 days and all other data within 90 days, unless you ask for earlier deletion or the law requires us to keep it (our own billing records of your subscription, for 7 years; they hold no personal information of your clients). Backups roll off within 7 days of deletion.

9. Precedence

If this agreement conflicts with the Terms of Service about personal information, this agreement wins. The limits of liability in the Terms of Service apply to it.

Annex: security measures

• Encryption in transit (TLS) for every page, API and email hand-off; storage encrypted at rest by our providers.
• Audio and attachments in private storage, reached only through download links that expire after 30 minutes.
• Passwords stored as strong hashes; optional two-factor authentication and passkeys; staff with platform access must use one of them.
• Staff access to studio data only for support, security or legal reasons, with every access written to an audit log.
• Every query scoped to the studio that owns the data, with automated tests for isolation between studios.
• Rate limits and spam traps on public forms; access codes hashed and valid for 10 minutes with 5 tries.
• Database backups with 7-day point-in-time recovery.
• Dependencies kept up to date and code checked by automated tests and static analysis on every change.