Data Processing Agreement (DPA)

Last updated: 9/26/2026

1. Definitions and Roles

This Data Processing Agreement ("DPA") governs the processing of personal data by MailVoy ("Data Processor") on behalf of our customers ("Data Controller"). By using MailVoy's services, you agree to these terms, which act as a supplement to our Terms of Service to ensure strict compliance with the General Data Protection Regulation (GDPR) and other applicable privacy frameworks.

2. Categories of Data Processed

In the course of providing our email orchestration services, MailVoy may process the following types of personal data on behalf of the Data Controller:

• Contact Data: Email addresses, first names, last names, and custom CRM fields mapped by the Controller.
• Analytics Data: IP addresses, User-Agent strings (device types, operating systems), and engagement metrics (open rates, click rates) collected via pixel tracking.

3. Authorized Sub-processors

MailVoy engages the following enterprise-grade sub-processors to securely manage and orchestrate data. All sub-processors are bound by strict confidentiality and data protection obligations:

• Vercel Inc. - Global Edge computing and API routing.
• MongoDB Atlas - Primary encrypted database storage (AES-256 at rest).
• Upstash (Redis) - Global edge caching and high-throughput rate-limiting queues.
• Trigger.dev - Background worker isolation and automation job execution queues.
• Axiom - Secure, isolated system telemetry and error logging.
• Connected SMTP Providers - By utilizing the Bring-Your-Own-SMTP (BYO-SMTP) architecture, the Controller authorizes the specific transmission endpoints (e.g., SendGrid, AWS SES, Google Workspace) configured within their MailVoy environment.

4. Technical and Organizational Measures (TOMs)

MailVoy implements rigorous security measures to protect Controller data:

• Encryption in Transit: All API communication and edge routing is strictly enforced over TLS 1.3.
• Encryption at Rest: All database clusters (MongoDB) are encrypted via AES-256 standard protocols.
• Access Control: Strict authentication boundaries and session management are enforced on all admin and user interfaces.

5. Data Retention and Deletion

MailVoy strictly adheres to the Controller's right to erasure. When a contact initiates an unsubscribe action, or when the Controller terminates their MailVoy account, MailVoy executes a complete destruction cascade. Data is permanently wiped from the MongoDB cluster and flushed from Redis queues within 30 days.

6. Incident Management and Breach Notification

In the event of a verified security breach impacting the Data Controller's personal data, MailVoy commits to notifying the primary administrative contact within 72 hours of incident confirmation, accompanied by a full remediation plan based on Axiom infrastructure telemetry.