Snapshot 244151
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Agreement Last updated: 5 November 2026. This version replaces all earlier versions. This Data Processing Agreement (“DPA”) is between OOPSpam LLC, 1118 6th St NE, Minneapolis, MN 55413, United States (“oopspam”, “we”), and the customer that uses the oopspam Services (“Customer”). It sets out how we process personal data on the Customer’s behalf under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and other Data Protection Laws. This DPA forms part of our Terms. It applies automatically to every account, including free accounts, whenever the Customer sends personal data to the Services. In the event of a conflict, the Standard Contractual Clauses (Section 9) prevail over this DPA, and this DPA prevails over the Terms. 1. Roles and definitions The Customer is the controller and oopspam is the processor of the personal data the Customer sends to the Services. Where the Customer is itself a processor, oopspam is its sub-processor. “Data Protection Laws” means the GDPR and the laws of the EU and EEA Member States implementing or supplementing it, and, where applicable, the UK GDPR and the Swiss Federal Act on Data Protection. “Services” means oopspam’s spam and fraud detection API and the plugins and integrations that call it. “Personal data”, “processing”, “data subject”, “personal data breach” and “supervisory authority” have the meaning given in the GDPR. “Sub-processor” means a processor engaged by oopspam to process Customer personal data. For data about the Customer itself (account, billing and support data), oopspam is a controller; see our Privacy Policy and GDPR page. 2. Description of the processing Data subjects: end users of the Customer’s websites, forms and applications whose submissions (contact forms, comments, registrations, orders and other text-based communications) are checked for spam and fraud. Personal data in spam checks: content of the submission (free text) and, where the Customer sends them, IP address and email address. IP addresses and email addresses are optional but recommended for accurate detection, and are used only for spam detection. Where the Customer uses our WordPress plugin, also technical data of the HTTP request that carried the submission (for example user agent, accepted languages, referrer, requested URI, client hints, X-Forwarded-For / X-Real-IP and, behind Cloudflare, the Cloudflare country and ray ID). The Customer may optionally send other parameters (for example a name or phone number); these are not required. Personal data in reports: only when the Customer marks a submission as spam or not spam: the IP address, email address and text of the submission with the label, and, for e-commerce orders, order details such as order status, totals, billing and shipping country, state and city, and product categories. Sensitive data: the Services are not designed for special categories of data or criminal-offence data, and do not ask for them. Nature and purpose: automated analysis of each submission to return a spam or fraud verdict to the Customer. Data from a Customer’s spam checks, and anything derived from it that could still identify a person, is used only to return the verdict to that Customer: it is not added to our network-wide block or allow lists and is not used for other customers. Checking requests against our existing lists is part of the Services. Reports: by using the report function, the Customer instructs us to apply the report to our network-wide block or allow lists, which protect all customers. The Customer can avoid this by not using the report function, and we will delete a report and reverse its effect on request. Duration: for as long as the Customer uses the Services, with the retention periods in Section 8. 3. Instructions We process personal data only on the Customer’s documented instructions. These are this DPA, the Customer’s API and plugin settings (for example whether logging is on) and any other written instructions to [email protected]. We will tell the Customer immediately if we cannot follow an instruction, or if we believe an instruction infringes Data Protection Laws. The Customer is responsible for having a lawful basis for sending personal data to the Services and for informing its end users. 4. Data subject requests We will forward to the Customer without undue delay any request we receive from a data subject, and will not answer it ourselves unless the Customer authorises us to. We will help the Customer answer data subject requests. Because spam-check data is not stored by default, there is normally nothing to access or erase; where logging is on, we will find, export or delete the entries for a given IP address or email address on the Customer’s instruction. 5. Personnel and confidentiality Only personnel who need access to provide the Services have access to personal data. They are bound by confidentiality obligations that survive the end of their engagement and are trained on their data protection responsibilities. Our data protection contact can be reached at [email protected]. 6. Sub-processors The Customer gives general authorisation for us to engage the sub-processors listed in Annex 1 below. We will inform the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If we cannot address the objection, the Customer may stop using the affected Services and terminate its subscription. We engage every sub-processor under a written contract with data protection obligations that are, in substance, the same as those in this DPA. We remain fully responsible to the Customer for our sub-processors. On request, we will provide a copy of a sub-processor agreement, which we may redact to protect confidential information. 7. Security and personal data breaches We implement appropriate technical and organisational measures under Article 32 GDPR, including: TLS 1.2 or higher for all API traffic; no storage of request bodies or request metadata by default; encryption at rest for stored logs; least-privilege access; unique, rotatable API keys per customer; security-event logging; and documented incident response. We take part in the CSA STAR registry and publish a security self-assessment (CAIQ). We will notify the Customer without undue delay after becoming aware of a personal data breach affecting its data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed, and a contact point. Where not all information is available at once, we will provide it in phases. We will help the Customer meet its obligations on security, breach notification, data protection impact assessments and prior consultation (Articles 32–36 GDPR), taking into account the nature of the processing and the information available to us. 8. Retention, deletion and audits Spam checks: processed in memory and not stored by default. API gateway metadata (request counts per API key and the IP address the API call comes from, normally the Customer’s server): 30 days, for rate limiting and abuse prevention. Request/response logs: stored only if the Customer switches logging on, for the period of its plan (Freelance 2 months, Agency 4 months, Scale 6 months), then deleted. Daily backups are kept in Frankfurt, Germany, for up to 7 days. Reports: stored in Frankfurt, Germany, and deleted 7 days after the report is resolved. Error reports (Sentry): where a request causes an error, technical details of it may be kept for up to 90 days. Deletion or return: at the Customer’s choice, we will delete or return its personal data during the subscription on written request, and at the end of the Services, and will confirm the deletion in writing with the date, unless the law requires us to keep it. The Customer can also delete its stored logs and reports itself from the Trust Center in its dashboard. Audits: we will make available all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, and will allow for and contribute to audits, including inspections, by the Customer or an independent auditor it mandates, at reasonable intervals or where there are indications of non-compliance, with reasonable notice. The Customer may take our CSA STAR entry and other certifications into account. 9. International transfers Personal data is processed in the countries listed in Annex 1, including the United States. oopspam is not certified under the EU-U.S. Data Privacy Framework. For transfers of personal data from the EEA to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this DPA by reference, with these options: Clause 7 (docking) included; Clause 9(a) Option 2 with 30 days’ notice; Clause 11 optional language not used; Clauses 17 and 18 the law and courts of Ireland. The Customer is the data exporter and oopspam the data importer; Section 2 of this DPA and Annex 1 complete Annexes I and III, Section 7 completes Annex II, and the competent supervisory authority is that of the Customer’s Member State of establishment. For transfers from the United Kingdom, the UK International Data Transfer Addendum to those Clauses applies; for transfers from Switzerland, the Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection. A signed copy of the Standard Contractual Clauses, with completed annexes, is available on request at [email protected]. If a public authority asks us for Customer personal data, we will review the request’s legality, challenge it where there are grounds to do so, disclose only the minimum required and, where the law allows, notify the Customer. 10. Governing law This DPA is governed by the laws of Ireland, and the courts of Ireland have jurisdiction, as for the Standard Contractual Clauses. This does not affect the rights of data subjects under Data Protection Laws. 11. Term and changes This DPA applies from the time the Customer first uses the Services and for as long as we process personal data on its behalf. We may update this DPA to reflect changes in law or in the Services. We will not reduce the protection it gives without telling the Customer in advance by email. Annex 1: Sub-processors Sub-processor Location Purpose and data Fly.io, Inc. Nearest region: Frankfurt (Germany), London (UK), Secaucus NJ and San Jose CA (US), São Paulo (Brazil), Sydney (Australia). EU requests are normally served in Frankfurt; on failover, another region, including the US, may be used. API servers and our own detection models. Processes IP addresses, email addresses, submission content and request metadata in memory, without storing them. Cloudflare, Inc. Global network Network security, DDoS protection and proxying of API traffic. Processes API requests in transit. DigitalOcean, LLC United States API gateway and rate limiting. Stores request counts per API key and the originating IP address of API calls for 30 days. Hetzner Online GmbH Germany and United States Spam-detection microservices, user statistics and automation. Processes IP addresses and email addresses in real time, without storing them; may process customer account metadata. Supabase, Inc. European Union (Frankfurt, Germany) Request/response logs, only where the Customer switches logging on, and their backups (up to 7 days). Functional Software, Inc. (Sentry) United States Error monitoring. Receives technical details of requests that cause an error; kept up to 90 days. OpenRouter, Inc. United States Contextual detection only. Receives the submission content only (no IP address or email address), under a zero-data-retention setting. Have Questions? If you have questions about GDPR compliant or anything else about oopspam, please don't hesitate to contact us: OOPSpam LLC 1118 6th St NE, MINNEAPOLIS, MN USA Contact us © 2017–2026 OOPSpam LLCTermsPrivacyGDPRDPA