Data Processing Agreement

Last updated: 20 October 2026

This agreement forms part of the Terms of Service and applies to the customer emails a business forwards to Airmailer.

Parties and scope

This agreement is between the business (the controller) and Airmailer B.V. (the processor). It covers the personal data the business puts into Airmailer, or has forwarded to it, to use the service. It meets the requirements of article 28 of the General Data Protection Regulation (GDPR).

• Airmailer B.V.: a private limited company registered in the Netherlands
• Postal address: TBC
• Chamber of Commerce (KvK) number: TBC
• Email: support@airmailer.app

If this agreement and the Terms of Service disagree about personal data, this agreement applies.

What Airmailer processes, and why (Annex 1)

• Purpose: receiving the business's customer emails, drafting and checking replies with AI, sending replies, and keeping the conversation history the business needs.
• Data subjects: the business's customers and prospects who email it, and people named in the business's documents.
• Personal data: names, email addresses, the content of emails and attachments, order and product details in the business's documents, the team's notes about a customer, and customer ratings of replies.
• Special categories: not intended. They are processed only when a customer includes them in an email.
• Duration: for as long as the agreement runs, then until deletion as in "End of processing".
• Instructions: the business's use of the service and its settings (for example retention and Automatic sending) are its instructions, together with this agreement.

Airmailer's obligations

Airmailer:

1. processes the personal data only on the business's documented instructions, unless EU or Dutch law requires otherwise, and then tells the business first unless the law forbids it;
2. tells the business if it believes an instruction breaks data protection law;
3. makes sure everyone who can access the data is bound to confidentiality;
4. takes the security measures in Annex 3;
5. uses subprocessors only as set out under Subprocessors;
6. helps the business answer requests from individuals and meet its obligations on security, breaches and impact assessments;
7. deletes or returns the data when the agreement ends, as set out under End of processing;
8. gives the business the information it needs to show compliance, and allows audits as set out below;
9. does not use the data for its own purposes, including training AI models.

Subprocessors (Annex 2)

The business authorises Airmailer to use the subprocessors listed in the Privacy policy under "Who else processes the data": Vercel (with the AI providers listed there, reached through its AI Gateway: Anthropic, Amazon Web Services, Google Cloud, OpenAI, Microsoft and TypeSafe), Neon, Resend and Sentry.

• Airmailer gives each subprocessor data protection obligations at least as strict as these, and remains responsible to the business for its work.
• Airmailer emails the owners at least 30 days before adding or replacing a subprocessor. A business that objects on reasonable data protection grounds may end the agreement before the change, and gets back any fees paid for the time after it.

Security measures (Annex 3)

• Encryption: TLS for every connection; the database and file storage encrypted at rest.
• Isolation: every request is limited to the signed-in person's own business, and for most requests the database's row-level security enforces this.
• Access: sign-in by one-time code; owner and member roles in each business; production access limited to the people who run Airmailer.
• Inbound integrity: email and payment webhooks accepted only with a valid signature.
• Minimal logging: error reports exclude request data, email content, prompts and user details, and have database values and email addresses removed.
• Resilience: the database can be restored to an earlier point in time from its backups.
• Retention controls: the business sets how long conversations are kept, and can delete everything about one customer at once. What Pip's workflow holds while it writes a reply is deleted as soon as its run ends.

Personal data breaches

Airmailer tells the business without undue delay, and within 48 hours of becoming aware of a breach of the business's personal data. The notice says what happened, which data and people are affected as far as known, the likely consequences, and what Airmailer has done and will do. Airmailer then keeps the business informed and helps it notify the authority or the people affected where needed.

Helping with requests and assessments

The business can download or delete everything about one customer in Airmailer itself. If an individual asks Airmailer directly, Airmailer passes the request to the business without answering it, unless the business asks it to. Airmailer also gives the business the information it reasonably needs for a data protection impact assessment or a prior consultation with the authority.

Transfers outside the EEA

The database, the app, Pip's workflow and error reports stay in the EU. Some processing happens outside the EU: email delivery at Resend, in the US, and the AI models through Vercel's AI Gateway, mostly in the US. Each of these transfers is covered by the EU-US Data Privacy Framework where the recipient is certified, and by the Standard Contractual Clauses in each subprocessor's agreement. For the UK, the UK addendum to those clauses applies. Airmailer makes no other transfer without telling the business first, as for a new subprocessor.

End of processing, audits and liability

• End of processing: when the agreement ends, the business can download its customers' data, and an owner closes the business in Settings. Airmailer deletes the data 30 days after it is closed, and from backups within 7 days after that, unless the law requires it to keep it.
• Audits: Airmailer gives the business the information it reasonably asks for about how the data is protected. Where that isn't enough, an independent auditor bound to confidentiality may audit Airmailer once a year, at the business's cost, with 30 days' notice.
• Liability: the liability rules in the Terms of Service apply to this agreement.