Data Processing Agreement

1. Purpose

Clivo processes Customer Data solely to provide:

• AI email generation
• Figma → HTML conversion
• Storage and export of generated email templates

2. Types of Data Processed

Personal Data

• Name
• Email
• Password (hashed)
• Billing information

Design Data

• Uploaded Figma files
• Extracted images
• Generated HTML/MJML

Operational Data

• Cookies
• Usage analytics

3. Processing Instructions

We process data only:

• As instructed by the Customer
• To provide Clivo services
• To maintain platform performance

We do not use customer data for:

• AI model training
• Marketing without consent
• Selling to third parties

4. Subprocessors

We rely on the following third-party subprocessors to provide our services:

AWS (Amazon Web Services)

Purpose: Hosting & storage
Data processed: All customer data including files, templates, and account information

PayProGlobal

Purpose: Payment processing
Data processed: Billing information, payment details

Google Analytics

Purpose: Website analytics
Data processed: Usage data, cookies, browsing behavior

OpenAI & Anthropic

Purpose: AI model processing
Data processed: User prompts for email generation (not used for training)

5. Data Security

We implement the following security measures:

• Encryption in transit: HTTPS/TLS encryption for all data transmission
• Secure password storage: Industry-standard hashing algorithms
• Restricted data access: Role-based access controls for internal staff
• AWS security: Enterprise-grade physical and network protections
• Regular security reviews: Ongoing monitoring and updates

6. Data Retention & Deletion

Users may request deletion of:

• Account information
• Designs and templates
• Generated outputs
• Billing data (as allowed by law)

Deleted data will be removed within 30 days.

Retention Periods

• Active account data: Retained while account is active
• Generated content: Retained until user deletion or account closure
• Billing records: Retained for legal and tax compliance (up to 7 years)
• Logs and analytics: Retained for up to 90 days

7. International Transfers

Data may be stored in AWS regions including locations outside India. All international data transfers comply with applicable data protection laws.

We ensure that appropriate safeguards are in place for international transfers, including:

• Reliance on adequate service provider agreements
• Use of cloud providers with global compliance certifications
• Implementation of technical security measures

8. Data Subject Rights

We assist customers in fulfilling data subject rights requests, including:

• Right of access: Provide copies of personal data
• Right to rectification: Correct inaccurate data
• Right to erasure: Delete personal data upon request
• Right to data portability: Export data in machine-readable format
• Right to object: Stop processing for certain purposes

9. Audits & Compliance

We maintain logs and internal controls to ensure compliance with this DPA.

Upon reasonable request, we may provide high-level security documentation demonstrating our compliance measures. Full audits may be conducted subject to reasonable notice and confidentiality agreements.

10. Data Breach Notification

In the event of a data breach that affects customer data, we will:

• Notify affected customers without undue delay
• Provide details of the breach nature and scope
• Describe measures taken to address the breach
• Recommend steps customers should take

11. Liability

Our liability under this DPA is limited as per the Terms of Service. Maximum liability is capped at the amount paid by the customer in the last 30 days.

12. Term and Termination

This DPA remains in effect for as long as we process personal data on behalf of the customer. Upon termination of services:

• Customers may request data export
• Data will be deleted within 30 days unless required by law
• Backups will be deleted within 90 days