# Data processing agreement

> The GDPR Article 28 agreement for the feedback data Camelus processes for you: roles, security measures, subprocessors, breaches and deletion.

This data processing agreement (DPA) is part of the [terms of service](/legal/terms). It applies when you use Camelus to process personal data of the people who send feedback about your products, as required by Article 28 of the GDPR. You accept it by using Camelus; no signature is needed. If you need a signed copy, write to [hello@camelus.si](mailto:hello@camelus.si).

## 1. Roles

You (the customer) are the **controller** of the feedback data. Camelus is the **processor**: it processes that data only to provide the service to you, on your documented instructions. Your instructions are the terms, this DPA, and what you configure in the app (sources, destinations, loop messages, integrations).

## 2. The processing

- **Subject matter and purpose:** collecting, storing, summarizing, translating, classifying and grouping feedback about your products; showing it to your workspace; sending summaries to the destinations you configure; emailing the people who asked to hear back.
- **Data subjects:** people who send feedback to your products, and your customers if you connect Polar.
- **Personal data:** names, email addresses, user ids, page URLs, metadata your integration sends, the content of feedback messages, and (with Polar) plan, revenue and cancellation reasons.
- **Special categories:** none are intended. Don't send them; if feedback contains them, it's processed like any other text.
- **Duration:** while your workspace exists, then as described in section 8.

## 3. Our obligations

Camelus will:

- process the data only on your instructions, and tell you if an instruction seems to break data protection law;
- make sure everyone who can access it is bound to confidentiality;
- protect it with the measures in section 6;
- help you answer requests from data subjects (the app lets you export, correct and delete a person's data) and with data protection impact assessments, where reasonable;
- tell you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your data, with what we know about it;
- make available the information needed to show compliance with this DPA, and allow audits by you or an auditor you appoint, with 30 days' notice, at most once a year unless a breach or an authority requires it.

## 4. Subprocessors

You authorize the subprocessors on the [subprocessors page](/legal/subprocessors). We give each one data protection obligations no weaker than this DPA, and we're responsible for them. We'll announce a new subprocessor that receives feedback data at least 30 days in advance; you can object, and if we can't address the objection, you can end the agreement and get a refund of prepaid fees for the remaining period.

## 5. International transfers

Where subprocessors process data outside the EU/EEA, transfers rely on an adequacy decision (including the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.

## 6. Security measures

- Encryption in transit (TLS) for every connection, and at rest for stored data. Third-party tokens and secrets are additionally encrypted with AES-GCM; API keys and invite tokens are stored only as hashes.
- Strict separation between workspaces: every request is checked against the workspace of the signed-in user or API key.
- Feedback text is treated as untrusted: it's never executed, and it's never rendered as HTML.
- Only PII-free summaries leave the app through the API, MCP and destinations, unless an owner turns on personal data for a destination; that choice is recorded in the activity log.
- Outbound requests are protected against server-side request forgery; inbound webhooks are signature-checked.
- Logs don't contain feedback text, emails or tokens.
- Daily backups, with restores tested.
- An activity log of changes to members, keys, integrations, destinations, billing and exports.

## 7. Data subject requests

If a data subject contacts Camelus directly about your data, we'll forward the request to you and won't answer it ourselves unless you ask us to.

## 8. Deletion and return

You can export your workspace at any time (**Settings → Workspace → Export**). When you delete a workspace, its data is deleted within minutes; backups that contain it expire within 30 days. Feedback older than your plan's retention period is anonymized automatically, as described in the [privacy policy](/legal/privacy).

## 9. Liability and precedence

Liability under this DPA follows the terms of service. If this DPA and the terms conflict about personal data, this DPA wins.