Legal

Data processing agreement

The Article 28 contract for your contacts' data. It applies as soon as you accept the terms; no signature needed.

This is the contract Article 28 of the GDPR requires between a controller and its processor. You are the controller of your contacts' personal data. We are your processor. It applies from the moment you accept the terms of use and needs no signature; electronic form is enough under Article 28(9). You do not have to ask us for it, and we do not charge for it.

If your organisation needs a signed paper copy for its own records, write to hello@everyconvo.com and we will sign this text unchanged.

1. Who this is between

Processor: Tein Brouwer Camera, registered with the Dutch Chamber of Commerce (KvK) under number 54575583, VAT identification number {VAT_NUMBER}, at Oosteinderweg 53C, 1432 AD Aalsmeer, the Netherlands, trading as EveryConvo. Contact for anything in this agreement: hello@everyconvo.com.

Controller: the organisation or person that holds the EveryConvo workspace, as named on its billing details.

If you are yourself a processor for somebody else — an agency running a client's Instagram account, for instance — then you act on that client's instructions, this agreement makes us their sub-processor, and you confirm you have their permission to engage us. You pass on anything we tell you that they need to know.

2. Two sets of data, two roles

Contact data — we are your processor. Everything about the people who message you: their platform identity and username, their name where the platform gives it, the content of messages in both directions and any media in them, comments, tags, custom fields, notes your team writes, which flows they went through, their opt-in and opt-out record, and what an AI step sent about them and received back. You decide what happens to it. We carry that out.

Account data — we are the controller. Everything about you and your team: names, email addresses, password hashes, sessions, the audit log, the plan and the Stripe customer id. We decide why and how that is processed, and the privacy statement explains it. This agreement does not govern it.

We are not joint controllers with you for anything.

3. Our instructions are your product

We process contact data only on your documented instructions, including about transfers out of the EEA. Your instructions are:

• this agreement and the terms of use;
• what you build and switch on in the product — flows, triggers, sequences, broadcasts, the retention period, the AI steps, the outgoing webhooks, the API calls you make; and
• anything you ask us in writing that we agree to do.

We do not process contact data for any purpose of our own. We do not sell it, share it with advertisers, enrich it from outside the conversation, use it to build a product, or train a model on it — ours or anyone else's. No cross-workspace analysis is performed on it.

If an instruction of yours would in our view break data protection law, we tell you and may decline to carry it out until it is resolved. If a law requires us to process contact data other than on your instructions, we tell you before we do, unless that law forbids telling you.

4. Confidentiality

Everyone who can reach contact data is bound to keep it confidential, by contract and beyond the end of their engagement. Today that is one person: the owner of the company. If that changes, this clause already covers whoever comes next, and the sub-processor list records the companies involved.

Our operators cannot read your conversations. The admin tooling can say which workspace a platform id belongs to, so a deletion request can be routed to you, and it cannot show what was said. An operator's export of a workspace contains structure and counts and no message bodies, and taking one is written to your audit log.

5. Security

We keep the technical and organisational measures set out in Annex 2, which are the measures required by Article 32. We may change them, and we will not lower the overall level of protection. Annex 2 is what a security questionnaire should be answered from; if yours asks something it does not cover, ask us.

6. Sub-processors

You give us general authorisation to engage sub-processors. The current ones are published at everyconvo.com/subprocessors, with what each does, where it processes and the basis for any transfer.

Each sub-processor is bound by written terms that impose data protection obligations equivalent to these, and we remain fully liable to you for what they do.

Adding or replacing one. We publish the change on that page and email the workspace's address at least 30 days before the new sub-processor gets access to contact data. You have those 30 days to object on reasonable data protection grounds. Tell us what the objection is and we will try to solve it — a different vendor, a different region, or leaving the feature off for your workspace. If we cannot, you may terminate the affected part of the service, or the whole subscription, without penalty, and we refund the unused part of the period you have paid for. Saying nothing within the 30 days counts as agreement.

We may add a sub-processor at shorter notice only where security requires it immediately, and we tell you as soon as we have.

7. Transfers outside the EEA

The product's own data stays in the EU: the database in Frankfurt, the application servers in Amsterdam. Annex 3 lists every transfer out of the EEA, why it happens and what makes it lawful. In short: the European Commission's standard contractual clauses with each recipient, and for Switzerland the adequacy decision.

Telegram is the exception, and you should read this before connecting a Telegram bot. Telegram FZ-LLC is established in the United Arab Emirates, publishes no data processing agreement and offers none, and the UAE has no EU adequacy decision. We cannot contract with Telegram on your behalf and nobody else can either. We therefore do not present Telegram as our sub-processor: it is the transport you have chosen, acting as its own controller under its own terms, in the same way that posting a letter involves the post office. If you connect a Telegram bot, you accept that transfer as your own decision and as your own controller's responsibility. If that is not acceptable to your organisation, use Instagram or WhatsApp, and do not connect Telegram.

8. Helping you answer the people in your contact list

Most of this you can do yourself without asking us, which is the point:

• Access and portability. A contact's export returns everything about them in one file — the contact record, every message both ways, conversations, comments, flow runs with their saved answers, tags, fields, sequence memberships, the notes your team wrote about them, and every AI request and response that concerned them.
• Erasure. Erasing a contact removes all of it, including the media sent to them and the raw platform deliveries that mention them. A test checks afterwards that the person appears in no text column of any table. The only thing that survives is the opt-out record — the platform id and the date — because without it someone who asked you to stop would be greeted by your automation again. The privacy statement says so publicly.
• Rectification and restriction. Fields, tags and notes are editable, and a contact can be blocked so nothing further is sent.

Where a request reaches us instead of you, we do not answer it ourselves. We pass it to you without undue delay and help you answer it. If you need help we cannot give through the product, we give it and charge nothing for it.

9. If personal data is breached

We tell you within 24 hours of becoming aware of a personal data breach affecting your contact data. Not "without undue delay", not conditioned on how serious we judge it to be, and not limited to particular categories of data: 24 hours, from awareness, for every breach we become aware of.

The notice says what happened, when, which categories and roughly how many records and people are affected, what the likely consequences are, what we have done and what we suggest you do, and who to talk to. If we do not have all of it in 24 hours, you get what we have in 24 hours and the rest as it arrives.

You are the controller, so notifying the Autoriteit Persoonsgegevens or another supervisory authority within 72 hours, and notifying the people affected where the risk is high, is yours to do. We give you everything you need for it. Where the breach concerns our own account data, we make that report ourselves.

Repeated failed logins, blocked scans, rejected webhook signatures and similar noise are not a breach and we do not report them as one.

10. Helping with assessments

Taking account of what we know and what you can reasonably find out yourself, we help you with your obligations under Articles 32 to 36: securing the processing, handling a breach, carrying out a data protection impact assessment and consulting your supervisory authority if you have to.

In practice the material for a DPIA is already written down. The categories of data are in Annex 1 and in the privacy statement; the retention periods are in both; the sub-processors and transfers are in the list and in Annex 3; the security measures are in Annex 2. If your assessment needs something that is not in one of those, ask.

11. Deleting or returning the data at the end

You can export everything at any time during the subscription, and you should do it before you finish rather than after.

When the subscription ends, the workspace stays as it is until you delete it, so that a lapsed plan is not a data loss. When you delete the workspace, everything stops immediately and the data is purged 30 days later. Those 30 days exist so that a mistake can be undone; nothing runs during them.

If you would rather we returned the data than deleted it, ask within the 30 days and we will hand you the export. We keep nothing afterwards except what the law requires us to keep — invoices for seven years — and the opt-out records described in section 8, which contain no more than a platform id and a date.

12. Showing you that we comply

We make available to you everything you need to see that these obligations are met: this agreement, the privacy statement, the sub-processor list, Annex 2, and a written answer to any reasonable question you have about them.

We hold no ISO 27001 certificate and no SOC 2 report, and we do not pretend otherwise. What we offer instead of an audit report is an audit by documentation: send us your security questionnaire, once per calendar year, and we answer it in writing within 30 days. If a specific and reasonable concern is left standing after that, we will discuss an audit by you or by an independent auditor you appoint, at your cost, on 30 days' notice, at most once a year, at a time that does not disrupt the service, and under confidentiality. We will not refuse one you are entitled to under Article 28(3)(h); we would rather answer the question in writing first, because that is usually what the question actually needs.

We also do not run a penetration test or a bug bounty, and we say so on the privacy statement rather than leaving you to discover it.

13. Duration, liability, and how this fits with the rest

This agreement runs for as long as we process contact data for you, and the obligations that by their nature outlive it — confidentiality, deletion — do.

Liability under this agreement is subject to the limits in the terms of use, except where the GDPR does not allow that. Nothing here affects the rights of the people whose data it is, or a supervisory authority's powers. Neither of us pays the other's regulatory fine.

Dutch law applies, and the court named in the terms of use hears any dispute. Where this agreement and the terms disagree about personal data, this agreement wins.

---

Annex 1. Details of the processing

Subject matter and nature. Receiving, storing, routing and sending messages and comments on Instagram, Telegram and WhatsApp on the controller's behalf; running the controller's flows, sequences and broadcasts; providing a shared inbox; and, where the controller switches it on, generating replies and recognising intent with an AI model.

Purpose. Providing the EveryConvo service to the controller.

Duration. For the life of the subscription, plus the 30-day grace period after the workspace is deleted. Message history is pruned earlier according to the retention period the controller sets — 30, 90, 180, 365 or 730 days, with a workspace created from now on starting at 365. Raw platform deliveries are kept 90 days.

Categories of data subjects. People who send a message or write a comment to one of the controller's connected accounts, and people the controller imports into its contact list.

Categories of personal data. Platform identifiers and usernames; name, first and last name where the platform supplies it or the controller enters it; language and time zone; email address and telephone number where given; the content of messages in both directions and media in them; comments and the post they belong to; tags, custom fields and saved flow answers; notes written by the controller's staff; opt-in and opt-out records with their source and date; flow history; follow status; and the text sent to and received from the AI model where an AI step runs.

Special categories of data. None are collected on purpose, none are asked for, and the terms forbid the controller from deliberately entering them. A person may volunteer such a thing in a message; it is then held as ordinary message content and is not indexed, flagged or used.

Frequency. Continuous, as messages arrive.

Sub-processors. everyconvo.com/subprocessors.

Annex 2. Security measures

The Article 32 measures in force. They are specific on purpose, so that a buyer can check them rather than believe them.

Annex 3. Transfers out of the EEA

The database (Frankfurt) and the application servers (Amsterdam) are in the EU and no contact data is stored outside it.

Last updated: 24 September 2026.