Messaging Data Processing Addendum (DPA)
End-customer review request and campaign messaging · Version 1.0 · Last updated: 25 May 2026
1. Introduction and relationship to other agreements
This Messaging Data Processing Addendum ("DPA") describes how Joyful Designs ("Reputify", "we", "us") processes end-customer personal data when you use Reputify to send review requests and related customer messages (email, WhatsApp, and other channels you enable).
This DPA supplements:
- The Reputify Terms of Service (including Section 7 — Customer Review Requests and Messaging)
- The Reputify Privacy Policy
If there is a conflict about end-customer messaging data, this DPA prevails over general Privacy Policy summaries for that data. Your Reputify subscription and account data remain governed by the Privacy Policy and Terms.
By using Review Requests, Campaigns, or related messaging features, you acknowledge this DPA applies to processing we perform on your instructions as Data Processor (and Data Processor under India's Digital Personal Data Protection Act, 2023 — "DPDP Act").
2. Roles under applicable law
- Data Fiduciary / Data controller — You (the Reputify business customer): your customers' contact details, messaging decisions, and lawful basis to contact them
- Data Processor — Joyful Designs (Reputify): sending, scheduling, tracking, opt-out enforcement, and compliance metadata storage only on your instructions
You are responsible for:
- Obtaining and documenting lawful consent or another valid legal basis before sends
- Providing appropriate privacy notices to your customers where required — see our end-customer privacy notice template
- Responding to end-customer rights requests as Data Fiduciary (access, correction, deletion, grievance)
We will assist you as Processor with reasonable technical measures where required by law and this DPA.
3. Scope of processing
We process end-customer personal data only to provide messaging features you configure, including:
- Review Requests — individual review requests (email or WhatsApp)
- Campaigns — bulk or batched review requests you initiate
- Scheduling and delivery — queueing, send-time opt-out checks, delivery/read status via provider webhooks
- Compliance tooling — consent attestation records, do-not-contact (opt-out) lists, inbound STOP handling where enabled
- Operational support — troubleshooting send failures you report
We do not use end-customer contact data for our own marketing or unrelated profiling.
4. Categories of personal data processed
- Contact identifiers: email address, phone number (E.164), optional customer name — to address and personalize review requests
- Send metadata: channel, template, schedule, status, failure reason, provider message IDs — to operate sends, analytics, and support
- Consent records: attestation timestamp, consent basis recorded at send/campaign creation — compliance audit trail
- Opt-out data: email or phone on do-not-contact list; source (unsubscribe, STOP, manual) — to honour opt-outs and prevent re-contact
- Inbound messages: WhatsApp STOP/unsubscribe text, provider message IDs (where webhooks enabled) — opt-out processing and support
We do not require you to upload government ID numbers or sensitive special-category data for review requests.
5. Data retention summary (customer-facing)
We retain end-customer messaging data only as long as needed for the purposes below. This summary is provided for your notices to customers and internal compliance records.
- Review request records (contact, send status, template, schedule, consent attestation): retained while your Reputify account is active — needed to operate sends, retries, scheduled messages, delivery tracking, and compliance records
- Opt-out / do-not-contact list: retained while your account is active, plus a limited period after account closure where needed — so opted-out individuals are not contacted again through Reputify; may be kept longer if required for legal defence or dispute resolution
- Campaign recipient rows: same as review request records — linked to parent campaign and individual send rows
- Inbound WhatsApp messages (e.g. STOP replies): while your account is active; operational logs may use shorter periods — used for opt-out processing and support; not used for marketing
- Provider webhook / delivery metadata: while your account is active; security logs may use shorter periods — required to update send/delivery status
After account termination or deletion request:
- We delete or anonymize end-customer messaging data subject to legal, contractual, and operational requirements
- Opt-out records may be retained for a limited period after closure where necessary to honour do-not-contact obligations and prevent accidental re-contact
- Aggregated, non-identifying statistics may be retained for service improvement where permitted
Trial workspaces: If your trial expires without a paid subscription, workspace data (including messaging data) is typically retained for approximately thirty (30) days (or as communicated in product emails) so you can subscribe and restore access; after that window, data may be permanently deleted.
You may export your account data via Privacy & Data Management in the product. End-customers should generally contact you first as Data Fiduciary; we assist Processor requests initiated by you.
6. Your instructions and restrictions
You instruct us to process end-customer data only when you:
- Submit a review request or campaign through the product
- Configure integrations (email, WhatsApp) and templates
- Maintain opt-out lists or approve sends after consent attestation
You must not instruct us to process data you do not have lawful authority to use. You must honour opt-outs promptly, including entries on your Reputify opt-out list and customer STOP/unsubscribe requests.
We may suspend messaging features if we reasonably believe processing violates law, platform terms, or this DPA.
7. Subprocessors
We use trusted service providers ("subprocessors") who process data on our behalf under appropriate agreements. Relevant categories for customer messaging include:
- Cloud hosting / infrastructure — application hosting, databases, backups
- Email delivery — sending review request emails (your SMTP or platform delivery)
- Meta / WhatsApp Business Platform — WhatsApp template messaging and delivery webhooks
- Payment processing — subscription billing (not end-customer messaging content)
A current list of material subprocessors is described in our Privacy Policy. We require subprocessors to protect personal data consistent with applicable law and our agreements.
We will notify you of material changes to subprocessors affecting messaging through product communications or policy updates where practicable.
8. Security measures
We implement appropriate technical and organizational measures, including:
- Encryption in transit (TLS/SSL) and encryption at rest where applicable
- Access controls, authentication, and tenant isolation between business workspaces
- Secure credential storage for integrations (e.g. encrypted tokens)
- Monitoring and logging for security and operational troubleshooting
Details are summarized in our Privacy Policy (Data Security). No method of transmission is 100% secure.
9. Assistance with data subject rights
When an end-customer exercises rights (access, correction, deletion, opt-out) regarding data processed through Reputify:
- The customer should contact you as Data Fiduciary in the first instance
- You may use product features (opt-out lists, export, account deletion) or contact support@reputify.app for Processor assistance
- We will respond to lawful, documented requests from you within a reasonable timeframe, subject to verification and legal limits
We do not adjudicate disputes between you and your customers.
10. Personal data breach notification
If we become aware of a personal data breach affecting end-customer messaging data we process on your behalf, we will notify you without undue delay after confirming the breach, providing information reasonably available to help you meet your obligations as Data Fiduciary.
Notification will be sent to your account contact email or support channel unless you designate another contact in writing.
11. Deletion and return of data
Upon termination of your Reputify subscription or written deletion request for your workspace:
- We will delete or return end-customer messaging data within a reasonable period, subject to retention in Section 5 and backup cycles
- Opt-out records may be retained as described in Section 5
- You should export data before closure where you need continued records as Data Fiduciary
Account deletion flows in the product initiate this process; contact support if you need confirmation.
12. International transfers
Reputify may store and process data on servers in India and/or other countries. Where data is transferred across borders, we use appropriate safeguards recognized by applicable law (including contractual protections with subprocessors where required).
13. Term and updates
This DPA remains in effect while you use Reputify messaging features. We may update this DPA to reflect legal, product, or security changes. Material updates will be posted at this page with an updated "Last updated" date. Continued use after notice constitutes acceptance where permitted by law.
14. Contact
Joyful Designs (Reputify)
Email: support@reputify.app
Website: https://reputify.app
For DPA or end-customer processing questions, contact us with your business name and Reputify account email. For grievances under the DPDP Act regarding your Reputify account data, see the Privacy Policy.
This document is provided for customer transparency and compliance support. It does not constitute legal advice. Consult qualified counsel for your jurisdiction and use case.