Data processing agreement

This agreement is part of our terms. It covers the personal data of your customers that Aurient LLC ("we") processes for you ("you") when you use Rebeckon, including data that comes from a connected store such as Shopify. It applies automatically when you accept the terms; no signature is needed.

Roles

You are the controller of your customers' data: you decide what to collect and why. We are your processor: we handle it only to provide Rebeckon to you, following your instructions, which are these terms and the settings you choose in the product.

What we process

• People: your contacts, subscribers and store customers.
• Data: names, email addresses, consent and unsubscribe status, the properties and events you send us (such as orders and website activity), and email activity (deliveries, bounces, opens, clicks).
• Purpose: storing your audience, sending the emails you create, honouring unsubscribes, and showing you reports.
• Duration: while your workspace exists, then deleted as described below.

Our commitments

• We use your customers' data only for you. We don't sell it, use it for advertising, or combine it with other customers' data.
• Everyone who can access it is bound by confidentiality, and access is limited to the people who need it to run the service.
• We help you answer your customers' requests to see, correct, export or delete their data. Requests that reach us directly are passed to you.
• We tell you if we believe an instruction from you breaks data protection law.

Security

• Data is encrypted in transit (HTTPS) and at rest.
• Store access tokens are encrypted again by us, with a separate key.
• Every workspace's data is kept separate, and our tests check that one workspace can never read another's.
• Staff actions, billing and workspace changes are recorded in an audit log, and every sign-in session records its time and IP address.
• Production systems are separate from development and testing.

If something goes wrong

If we become aware of a breach affecting your customers' data, we will tell your workspace owners by email without undue delay, and within 72 hours, with what we know: what happened, which data is affected, what we've done, and what you may need to do. We'll keep you updated as we learn more and help you meet your own duties to notify regulators or your customers.

Who helps us

You allow us to use these subprocessors. Each is bound by a written data protection agreement at least as protective as this one.

• Railway: hosting, database and file storage.
• Resend: email delivery (processed in Tokyo, Japan).
• Stripe: payments for accounts that pay us directly.

We'll announce new subprocessors on this page and by email at least 30 days before they start. If you object for a good reason, you may close your account and we'll refund any prepaid fees for the unused period.

International transfers

Our providers may process data outside your country. Where the law requires it, transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

Deleting data

• When a store customer asks the store to erase their data, we delete them on the store's request.
• When you disconnect or uninstall a store, its data is deleted once the store asks us to (for Shopify, 48 hours after uninstall).
• When you delete a workspace, its contacts, events and emails are deleted with it.
• We keep only the addresses that bounced, complained or unsubscribed, so they are never emailed again.

Checks

On request, we'll give you the information you reasonably need to show that this agreement is being followed. Questions: hello@rebeckon.com, or write to us at 212 N. 2nd St. STE 100, Richmond, KY 40475.