Data Processing Agreement (DPA)

1. Roles and scope

For personal data in Customer Content (captured emails, attachments, shares), the Customer is the controller and ANOTHER ("Mailclutch") is the processor. Details of the processing are in Annex A. The Customer warrants it has a lawful basis for the data it sends to the Service, and uses test data where it can.

2. Instructions

Mailclutch processes the data only on the Customer's documented instructions: the Terms, this agreement and the settings the Customer makes in the Service. It tells the Customer if an instruction seems to breach data protection law, and does not process the data for its own purposes, including AI model training.

3. Confidentiality

People authorized to process the data are bound by confidentiality, access it only when needed (support the Customer asked for, security, legal duty).

4. Security

Mailclutch implements the technical and organizational measures in Annex B and updates them without lowering their level.

5. Sub-processors

The Customer authorizes the sub-processors in Annex C. Mailclutch emails the Customer at least 30 days before adding or replacing one; the Customer may object on reasonable data protection grounds and, failing a solution, terminate at no cost. Each sub-processor is bound by contract to the same obligations; Mailclutch remains responsible for their compliance.

6. Assistance

The Service lets the Customer find, export and delete data to answer data subject requests. Mailclutch forwards any request it receives directly to the Customer without answering it, and helps where it can with impact assessments and consultations of the supervisory authority.

7. Data breaches

Mailclutch notifies the Customer of any personal data breach affecting it without undue delay and at the latest 48 hours after becoming aware of it, with the information listed in GDPR article 33(3) that it has, and keeps it informed of the measures taken.

8. End of processing

The Customer can export its data throughout the contract. When it deletes an organization, all of its data is erased after the 14-day restore window and leaves the backups at most 180 days later. Emails the Customer deletes one by one leave the Service after 30 days in the trash. The Customer can ask for its data to be erased at any time at privacy@mailclutch.com.

9. Audits

Mailclutch makes available to the Customer the information needed to show compliance with this agreement. The Customer may have an audit carried out once a year by an independent auditor bound by confidentiality, on 30 days' notice and at its own cost, except after a data breach or at an authority's request. An audit may not expose other customers' data or the security of the Service.

10. Location and transfers

Captured emails and attachments are stored in France. Mailclutch transfers data outside the European Economic Area only to the Annex C sub-processors that say so, with the GDPR article 46 safeguards shown.

11. Term and contact

This agreement lasts as long as Mailclutch processes data for the Customer. Liability is governed by the Terms. Contact: privacy@mailclutch.com — ANOTHER, 2 rue Le Bouteiller, 35000 Rennes, France.

A — Details of processing

Nature and purpose

Receive, store, index, analyze (spam, rendering, links) and display the Customer's test emails; share and pass them on (API, webhooks, MCP) according to its settings.

Data subjects

Recipients and senders of test emails (the Customer's end users, clients or staff), people mentioned in those emails.

Personal data

Anything the emails contain: names, email addresses, content, attachments, headers, sending server IP address. The Customer avoids putting special categories of data (GDPR art. 9) in them.

Duration

Per the Customer's plan or until it deletes them, then 30 days in the trash.

B — Security measures

• Infrastructure and captured emails hosted in France (Paris).
• Encryption in transit: TLS for SMTP, the API and the app.
• Encryption at rest of the database and attachment storage.
• Webhook secrets encrypted in the database; passwords hashed with bcrypt.
• No captured email is ever delivered to its recipient.
• SMTP credentials per project: a misconfigured environment cannot write into another customer's inbox.
• Spam analysis runs on our own servers; email content is never sent to an AI service.
• Remote images loaded through a proxy, so the reader's IP address is not exposed.
• Two-factor authentication (TOTP) with recovery codes; Google and GitHub sign-in.
• Email alert on every sign-in from a new device.
• Roles per organization and access per project; activity log on the plans that include it.
• API tokens scoped to one organization and, if needed, to specific projects; revocable.
• Rate limiting on sign-in, the API, shares and the sandbox.
• Random share links with expiry, optional password, view counter and revocation.
• Signed webhooks (HMAC) so you can verify where they come from.
• AI agent access (MCP) through OAuth, revocable at any time.
• Staff access to customer data limited to what is strictly needed (requested support, security).
• Error tracking configured not to send personal data.
• Retention periods set for each category of data; erasure on request.
• Encrypted backups stored in France, kept 180 days.

C — Sub-processors

Scaleway SAS

Infrastructure hosting (servers, database) — France

Amazon Web Services EMEA SARL

Attachment storage (S3) and delivery of our own emails (SES) — France (Paris, eu-west-3)

Cloudflare, Inc.

Custom domains for share pages (white label) — Global network, headquartered in the US
Transfer: EU-US Data Privacy Framework and Standard Contractual Clauses

Functional Software, Inc. (Sentry)

Application error tracking — EU or United States
Transfer: EU-US Data Privacy Framework and Standard Contractual Clauses

Laravel Holdings, Inc. (Nightwatch)

Performance monitoring — EU or United States
Transfer: European Commission Standard Contractual Clauses