Data Processing Addendum

Our Article 28 processor terms. This DPA forms part of the Terms of Service and applies automatically — you do not need to sign it separately. Last updated 7 October 2026.

Between BetterClosure Inc., a Florida corporation d/b/a FlowClick, of 2125 Biscayne Blvd, Ste 204 #10484, Miami, Florida 33137, United States (“Processor”, “we”) and the customer identified in the account (“Controller”, “you”). If you need a countersigned copy for procurement, write to legal@ratifai.app.

1. Definitions

“Data Protection Law” means the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, and US state privacy laws including the CCPA/CPRA, as applicable. “Customer Personal Data” means personal data within Customer Data that we process on your behalf. “Controller”, “Processor”, “Data Subject”, “Personal Data Breach” and “Sub-processor” have the meanings given in the GDPR.

2. Roles, and one carve-out stated up front

For Customer Personal Data, you are the Controller and we are the Processor. We process only on your documented instructions.

The carve-out. We are an independent Controller for the pseudonymised corpus described in clause 9 and for the suppression list in clause 10. These are our own purposes, not processing on your behalf, and we tell you so here rather than describing ourselves as a pure processor and hoping nobody reads clause 9.

We are also Controller for your account and billing data, governed by the Privacy Policy rather than this DPA.

3. Your instructions

Your documented instructions are: this DPA, the Terms of Service, and your use of the service’s documented features. We will not process Customer Personal Data for any other purpose. If we believe an instruction breaches Data Protection Law, we will tell you and may suspend that processing.

You warrant that you have a lawful basis for the Customer Personal Data you submit, that you have given required notices and obtained required consents, and that your instructions will not cause us to breach Data Protection Law.

4. Confidentiality and personnel

Personnel authorised to process Customer Personal Data are bound by confidentiality obligations, receive data-protection training appropriate to their role, and are granted access only where needed to perform their duties.

5. Security

We implement appropriate technical and organisational measures as set out in Annex II, having regard to the state of the art, the costs, and the risk to data subjects.

6. Sub-processors

You give general authorisation for the Sub-processors listed in Annex III. We will give at least 30 days’ notice before adding or replacing one, by email to your billing contact. You may object on reasonable data-protection grounds within that period; if we cannot resolve the objection, you may terminate the affected service and receive a pro-rata refund of prepaid fees for the unused remainder of the period — which is the one circumstance in which we refund.

We impose data-protection obligations on each Sub-processor no less protective than this DPA, and we remain fully liable for their performance.

7. Data-subject requests — self-service

You are the Controller and you hold the relationship with the Data Subject. The service is built so that you can satisfy a request yourself, immediately, at no cost, and without involving us:

• Access and portability — export everything your account owns as a single JSON archive, from Settings → Data & privacy or POST /v1/export. It excludes API-key material, password hashes and email message bodies.
• Erasure — erase one individual across every store, including the shared corpus, from Settings → Data & privacy or POST /v1/erasure. Immediate, irreversible, free, and limited to addresses your account submitted.
• Rectification — correct or re-submit a record at any time.

These capabilities are the assistance. The parties agree that the self-service features above constitute the assistance contemplated by Article 28(3)(e), taking into account the nature of the processing and the information available to us. We are not obliged to execute a Data Subject request on your behalf, to decide whether a request is valid, to verify the identity of the requester, or to assess whether an exemption applies. Those are Controller decisions, and the tools to act on them are in your hands at all times, including throughout any notice period or deletion grace period.

Where a request genuinely cannot be satisfied through those features, we will provide reasonable assistance at your request, at our then-current professional-services rates and on a timeline agreed between us.

If a Data Subject contacts us directly about Customer Personal Data, we will not respond substantively. We will refer them to you and notify you promptly, so that you can respond within your own statutory deadline.

8. Personal Data Breach

We will notify you without undue delay, and in any event within 48 hours of becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact point. Where we cannot provide all of it at once we will provide it in phases without undue further delay. We will assist you with your own notification obligations.

9. The pseudonymised corpus — what we keep and what we cannot undo

We derive and retain pseudonymised observations from checks run across all customers: a keyed HMAC-SHA256 of the address, plus domain-level intelligence. The corpus holds no plaintext address and no customer identifier. We act as independent Controller for it, on the basis of legitimate interests, as described in the Privacy Policy.

The consequences, stated so that your assessment can rely on them:

• Deleting your account does not remove your past contributions, because they carry no attribution to you and cannot be selected.
• An individual can nonetheless be erased from the corpus at any time by address, and that erasure works whether or not your account is still open.

If your own lawful basis assessment cannot accommodate this, do not submit data to the service — it is not a setting we can switch off for one customer, because the corpus has no customer dimension.

10. The suppression list

We retain hard bounces, complaints, spamtrap hits and abuse reports as one-way hashes with a reason category, as independent Controller, under legitimate interests in preventing harm to data subjects. These entries are retained through an erasure, because deleting them would make the address sendable again by anyone. They contain no plaintext address.

11. Deletion and return on termination

On account deletion we permanently remove every tenant-scoped store, verified table by table, after a 30-day grace period during which the account can be restored. You can export everything before you delete, and we recommend you do.

These survive, each for a stated reason:

• Billing and tax records — 7 years, under statutory obligation, detached from your account so that the tenant link is removed and only the financial record remains.
• Aggregate non-identifying usage counters — carrying no personal data.
• The pseudonymised corpus and suppression list — per clauses 9 and 10.

12. Audit

We will make available the information reasonably necessary to demonstrate compliance with this DPA, and will respond to a reasonable security questionnaire once in any twelve-month period. Where that is insufficient for your regulator, you may audit on at least 30 days’ written notice, no more than once a year (unless required by a supervisory authority or following a Personal Data Breach), during business hours, without unreasonable disruption, subject to confidentiality, and at your cost. An audit must not grant access to another customer’s data.

13. International transfers

Where you transfer Customer Personal Data from the EEA to us, the Standard Contractual Clauses, Module Two (Controller to Processor), Commission Implementing Decision (EU) 2021/914, are incorporated into this DPA and completed as follows: Clause 7 (docking) applies; Clause 9 option 2 (general written authorisation) with a 30-day notice period; Clause 11 optional independent dispute resolution does not apply; Clause 17 is governed by the law of Ireland; Clause 18(b) selects the courts of Ireland. Annexes I, II and III below populate the SCC annexes.

For UK transfers, the UK International Data Transfer Addendum (version B1.0) is incorporated, with Tables 1–3 populated by this DPA and its annexes, and Table 4 selecting “neither party” as able to end the Addendum under Section 19. For Swiss transfers, references to the GDPR are read as references to the FADP and the Swiss Federal Data Protection and Information Commissioner is the competent authority.

Where a term of this DPA conflicts with the SCCs or the UK Addendum, the SCCs or Addendum prevail.

14. California and other US state laws

For CCPA/CPRA purposes we are a Service Provider. We do not sell or share Personal Information, and we do not retain, use or disclose it for any purpose other than performing the services, except as permitted by the CCPA. We certify that we understand and will comply with these restrictions. You may take reasonable steps to ensure we use Personal Information consistently with your obligations. The corpus and suppression list in clauses 9 and 10 are deidentified data for these purposes; we commit to maintain them in deidentified form and not to attempt reidentification.

15. Liability and order of precedence

Each party’s liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Law does not permit that. In the event of conflict: the SCCs or UK Addendum first, then this DPA, then the Terms of Service.

Annex I — Description of processing

A. Parties

Data exporter / Controller: the customer identified in the account; contact details as held in the account; role: Controller.
Data importer / Processor: BetterClosure Inc. d/b/a FlowClick, 2125 Biscayne Blvd, Ste 204 #10484, Miami, Florida 33137, United States; contact privacy@ratifai.app; role: Processor.

B. Description

Categories of data subjects: the individuals whose contact details the Controller submits — typically business contacts, prospects, customers, subscribers and leads; and the Controller’s own users.

Categories of personal data: email address; optionally name, telephone number, employer or company, job title, website, postal address, and any passthrough columns the Controller chooses to include; and data we derive — validation verdicts, reasons, evidence, per-field provenance, enrichment values, duplicate-cluster membership, golden records and quality scores.

Special category data: none requested, none required, and the service is not designed to process it. The Controller must not submit it.

Frequency: continuous, on the Controller’s instruction, by upload, API or scheduled hygiene re-check.

Nature and purpose: verification of deliverability, enrichment, deduplication and ongoing list hygiene, so that the Controller can maintain accurate contact data — which is itself a data-protection obligation under Article 5(1)(d).

Duration: for the term of the account, subject to clause 11.

C. Competent supervisory authority

Determined under SCC Clause 13 by the exporter’s establishment or its Article 27 representative; where neither applies, the supervisory authority of the Member State in which the relevant data subjects are located.

Annex II — Technical and organisational measures

• Hosting posture: production runs in a Heroku Shield Private Space, which provides network isolation from the public runtime, encryption of data at rest, and enhanced audit logging.
• Encryption in transit for all service traffic and all outbound provider calls; encryption at rest for the application database and backups.
• Credential handling: passwords stored as salted hashes; API keys stored as one-way hashes and displayed once at creation; verification and password-reset tokens stored only as SHA-256 hashes, time-limited (24 hours and 45 minutes respectively) and single-use for reset.
• Pseudonymisation: corpus and suppression entries keyed with HMAC-SHA256 under a secret held separately from the data, with documented custody, versioning and rotation.
• Tenant isolation: every record is tenant-scoped; ownership is enforced on page, API and job paths, and that enforcement is covered by tests.
• Access control: role-based access with named seats; least-privilege access to production data; no shared accounts.
• Payment data minimisation: card numbers never reach our systems — capture occurs at the payment provider’s hosted checkout; we retain only brand, last four digits and expiry.
• Export minimisation: data exports exclude API-key material, password hashes, session and reset and verification tokens, and email message bodies.
• Logging and monitoring: request logging, job records, webhook delivery history and automated health monitors with alerting on state change.
• Change management: all production changes pass through a controlled pipeline with build, automated self-test, staged promotion through sandbox, development, QA and production, and a recorded audit trail per change.
• Deletion: cascading hard deletion verified table by table, with a 30-day recoverable grace period preceding it.
• Resilience: managed platform hosting with provider-level redundancy, continuous database protection and point-in-time recovery.

We review these measures periodically and may update them, provided the level of protection is not reduced.

Annex III — Sub-processors

Recipient mail providers contacted during verification are not sub-processors: we disclose the address to them in the course of a protocol exchange, exactly as any sender would, and they process it as independent controllers of their own mail systems.

The current list is maintained on this page. Changes are notified under clause 6.

See also: Terms of Service · Privacy Policy · Acceptable Use Policy · Data retention & privacy