Data Processing Agreement

1. Roles

Your agency is the controller of its contacts' and clients' data. Bindloops is its processor (or "service provider"): it processes the data only to provide the service and according to your instructions, which are the Terms, the settings you configure in Bindloops, and any written instructions you give us.

2. Data and purpose

During the beta, the following are not permitted: Social Security numbers, medical information, or other protected health information (PHI). Bindloops does not yet sign HIPAA business associate agreements (BAAs); do not upload PHI until one has been signed with you.

3. Bindloops commitments

• It does not sell the data or share it for targeted advertising, and does not use it for its own purposes.
• It does not combine it with data from other agencies or other sources, except as needed to provide the service.
• It gives access only to personnel who need it for the service and who are bound by confidentiality.
• It tells you if it believes an instruction from you violates the law.
• It complies with the U.S. privacy laws that apply to it as a service provider, including the Texas privacy law.

4. Security

Bindloops maintains reasonable technical and organizational measures: encryption in transit, per-agency and per-user data isolation in the database, role-based access control, sign-in attempt limits, anti-bot verification, backups, and error logging without personal data.

5. Subprocessors

You authorize Bindloops to use the subprocessors listed in the Privacy Policy, each under a contract that requires it to protect the data. We will notify you by email or in the app at least 30 days before adding a new one; if you have a reasonable objection, you may tell us, and if we cannot find a solution, you may cancel without penalty.

6. Help with individuals' requests

If a person asks us to access, correct, or delete their data, we refer them to you. Bindloops gives you tools to handle those requests (exporting, editing, and deleting contacts) and helps you when you cannot do it yourself.

7. Data breaches

If we confirm a breach affecting your agency's data, we notify you without undue delay, with what we know: what happened, which data and people may be affected, and what we are doing. We help you with the information you need to notify individuals and authorities.

8. End of service

When the account is closed, you can export your data: contacts to CSV from the CRM, and available consents, documents, recordings, and transcripts on request to hello@bindloops.com. We keep your client records (documents and call recordings) for 90 days after cancellation and then delete them from active systems, and from backups within 90 more days at most, except what the law requires us to keep.

9. Verification

On your written request, once a year, we provide reasonable information to show that we comply with this agreement, such as answers to security questionnaires.

10. Where data is processed

Data is stored and processed in the United States.