Data processing agreement

This data processing agreement is between you, the customer (the controller), and TBD (owner): legal entity name (DealToaster, the processor). It applies when DealToaster processes personal data for you in the service, mainly your contacts and the emails sent to them, and is part of the terms of service.

Subject matter

Running DealToaster for you: storing your contacts and sequences, sending your emails from your mailboxes, and detecting replies, bounces and unsubscribes.

Duration

While your account exists, then until the data is deleted as described below.

Nature and purpose

Storage, sending email on your instructions, and reading replies and bounces to the emails DealToaster sent, so that follow-ups stop.

Data subjects

Your contacts: the people you send sequences to, and the people who reply from their addresses.

Personal data

Email addresses, names, companies, titles and other fields you import, and the report of skipped import rows; the emails you write to them; snippets of their replies (at most 200 characters); unsubscribe records with keyed hashes of browser data.

DealToaster processes the personal data only on your documented instructions: these terms, this agreement and how you use the service, unless the law requires otherwise. We tell you if we think an instruction breaks the law.

Everyone at DealToaster who can access the personal data is bound to keep it confidential.

• Every connection uses HTTPS.
• Mailbox credentials are encrypted at rest with AES-256-GCM, under data keys that are themselves encrypted with a master key kept outside the database.
• Passwords are stored as salted hashes.
• Every request reads and writes only the data of the account that owns it.
• Incoming emails are kept as snippets of at most 200 characters, never in full.
• An address kept after a contact is deleted is stored as a keyed one-way hash.
• Logs carry ids, never email bodies, passwords or tokens.
• TBD (M3-05, #51): encrypted backups

You authorise the subprocessors listed on the subprocessors page. Each is bound by data protection terms at least as protective as these. TBD (owner): how and how early you hear about a new subprocessor, and how to object

We help you answer requests from your contacts, for example by deleting a contact while keeping only a keyed hash of an address that must not be emailed again. We also help with security, breach notifications, impact assessments and consultations with authorities, as Article 28 of the GDPR requires.

We tell you without undue delay after we learn of a breach that affects your data. TBD (owner): the notification deadline

You can delete contacts at any time. In Settings, Data you can export all your data as CSV and JSON files and delete your account, which deletes all of it at once. Deleted data stays in encrypted backups until they expire: TBD (M3-05, #51): backup retention, planned at most 6 months.

We make available the information needed to show that we meet Article 28 of the GDPR. TBD (owner): audit rights and how audits work

TBD (owner): where the data is processed, and the safeguards for transfers outside the EEA

Liability is as in the terms of service. Governing law: TBD (owner): governing law and courts. Questions: TBD (owner): support address.