Data processing agreement

This agreement is between the customer that owns a Pozy workspace (the controller) and One Point Ventures LLC, a Florida limited liability company trading as Pozy (the processor). It forms part of the terms of service and applies when Pozy processes personal data on the customer's behalf in providing the service, for example the messages, comments, contacts and analytics of the accounts the customer connects.

Pozy processes customer personal data only on the customer's documented instructions, which include using the service as designed and the actions taken through the dashboard, API and MCP server.

People at Pozy who can access customer data are bound by confidentiality. Pozy maintains technical and organisational measures appropriate to the risk, including encryption of stored credentials and webhook secrets, hashed API keys, role-based access controls and logging.

The customer authorises Pozy to use the subprocessors listed on the subprocessors page, including any listed there by category. Pozy gives customers the name of every subprocessor on request, which the customer keeps confidential.

Pozy will give notice of a new subprocessor before it starts processing customer data, and the customer may object on reasonable grounds. Pozy imposes data protection terms on each subprocessor that are no less protective than this agreement.

Pozy will help the customer respond to data subject requests and with security, breach notification and impact assessment obligations, taking into account the nature of the processing.

Pozy will notify the customer without undue delay after becoming aware of a personal data breach affecting customer data, with the information the customer needs to meet its obligations.

When the service ends, the customer can export its data through the API first. When the workspace is closed, its logs, events, webhooks, API keys, sessions and support history are deleted within 30 days. Pozy keeps a minimal record of the profiles and accounts it had connected (names and identifiers) for as long as needed to keep them disconnected and out of other workspaces, and keeps billing records as the law requires. Backups expire within a further 30 days.

Pozy will make available the information needed to demonstrate compliance with this agreement and allow for reasonable audits.

Transfers outside the European Economic Area, the United Kingdom or Switzerland rely on adequacy decisions or the standard contractual clauses, which are incorporated by reference where needed.

This agreement applies automatically to every workspace, as part of the terms of service. Customers who need a signed copy can ask at support@pozy.ai.