Between BetterClosure Inc., a Florida corporation d/b/a FlowClick, of 2125 Biscayne Blvd, Ste 204 #10484, Miami, Florida 33137, United States (“Processor”, “we”) and the customer identified in the account (“Controller”, “you”). If you need a countersigned copy for procurement, write to legal@solidifai.app.
1. Definitions
“Data Protection Law” means the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, and US state privacy laws including the CCPA/CPRA, as applicable. “Customer Personal Data” means personal data within Customer Data that we process on your behalf. “Controller”, “Processor”, “Data Subject”, “Personal Data Breach” and “Sub-processor” have the meanings given in the GDPR.
2. Roles
For Customer Personal Data, you are the Controller and we are the Processor. We process only on your documented instructions. We keep no cross-customer corpus: Customer Personal Data is used only for your workspace.
We are Controller for your account, billing and website data, governed by the Privacy Policy rather than this DPA. Protected health information is governed by the Business Associate Agreement, which prevails over this DPA for that information.
3. Your instructions
Your documented instructions are: this DPA, the Terms of Service, your workspace configuration (including its AI policy, retention settings and connected services) and your use of the service’s documented features. We will not process Customer Personal Data for any other purpose, and we will not use it to train models shared with other customers. If we believe an instruction breaches Data Protection Law, we will tell you and may suspend that processing.
You warrant that you have a lawful basis for the Customer Personal Data you submit, that you have given required notices and obtained required consents, and that your instructions will not cause us to breach Data Protection Law.
4. Confidentiality and personnel
Personnel authorised to process Customer Personal Data are bound by confidentiality obligations, receive data-protection training appropriate to their role, and are granted access only where needed to perform their duties.
5. Security
We implement appropriate technical and organisational measures as set out in Annex II, having regard to the state of the art, the costs, and the risk to data subjects.
6. Sub-processors
You give general authorisation for the Sub-processors listed in Annex III. We will give at least 30 days’ notice before adding or replacing one, by email to your billing contact. You may object on reasonable data-protection grounds within that period; if we cannot resolve the objection, you may terminate the affected service and receive a pro-rata refund of prepaid fees for the unused remainder of the period — including the unused part of an annual commitment.
Services you connect yourself — your own email, SMS or push provider, your own model keys, ad platforms and other tools — are engaged by you, not by us, and are not our Sub-processors. Data flows to them on your instruction.
We impose data-protection obligations on each Sub-processor no less protective than this DPA, and we remain fully liable for their performance.
7. Data-subject requests — self-service
You are the Controller and you hold the relationship with the Data Subject. The service is built so that you can satisfy a request yourself, without involving us: export a person’s profile and records, correct them, record an objection or withdrawal of consent, and erase them, from the console or the API.
These capabilities are the assistance. The parties agree that the self-service features above constitute the assistance contemplated by Article 28(3)(e). We are not obliged to execute a Data Subject request on your behalf, to decide whether a request is valid, to verify the identity of the requester, or to assess whether an exemption applies. Where a request genuinely cannot be satisfied through those features, we will provide reasonable assistance at your request, at our then-current professional-services rates and on a timeline agreed between us.
If a Data Subject contacts us directly about Customer Personal Data, we will not respond substantively. We will refer them to you and notify you promptly.
8. Personal Data Breach
We will notify you without undue delay, and in any event within 48 hours of becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact point. Where we cannot provide all of it at once we will provide it in phases without undue further delay. We will assist you with your own notification obligations.
9. AI processing
AI features process Customer Personal Data only as your workspace’s AI policy allows, and only with the model providers that policy allows (listed in Annex III) or with providers you connect using your own keys. Model providers we engage are bound not to use Customer Personal Data or prompts to train their models and to retain it only as long as needed to return a response and meet their abuse-monitoring obligations.
10. Retention, deletion and return
We keep Customer Personal Data for the retention period of your plan — Team 1 year, Organization 2 years, Regulated 7 years — unless you delete it sooner. On account closure we permanently remove your workspace data after a 30-day grace period during which the account can be restored and you can export everything. On the Regulated plan, data covered by the seven-year retention commitment is kept for that period unless you instruct us in writing to delete it sooner.
These survive closure, each for a stated reason:
- Billing and tax records — 7 years, under statutory obligation, kept only as financial records.
- Aggregate non-identifying usage counters — carrying no personal data.
11. Audit
We will make available the information reasonably necessary to demonstrate compliance with this DPA, and will respond to a reasonable security questionnaire once in any twelve-month period. Where that is insufficient for your regulator, you may audit on at least 30 days’ written notice, no more than once a year (unless required by a supervisory authority or following a Personal Data Breach), during business hours, without unreasonable disruption, subject to confidentiality, and at your cost. An audit must not grant access to another customer’s data.
12. International transfers
Where you transfer Customer Personal Data from the EEA to us, the Standard Contractual Clauses, Module Two (Controller to Processor), Commission Implementing Decision (EU) 2021/914, are incorporated into this DPA and completed as follows: Clause 7 (docking) applies; Clause 9 option 2 (general written authorisation) with a 30-day notice period; Clause 11 optional independent dispute resolution does not apply; Clause 17 is governed by the law of Ireland; Clause 18(b) selects the courts of Ireland. Annexes I, II and III below populate the SCC annexes.
For UK transfers, the UK International Data Transfer Addendum (version B1.0) is incorporated, with Tables 1–3 populated by this DPA and its annexes, and Table 4 selecting “neither party” as able to end the Addendum under Section 19. For Swiss transfers, references to the GDPR are read as references to the FADP and the Swiss Federal Data Protection and Information Commissioner is the competent authority.
Where a term of this DPA conflicts with the SCCs or the UK Addendum, the SCCs or Addendum prevail.
13. California and other US state laws
For CCPA/CPRA purposes we are a Service Provider. We do not sell or share Personal Information, and we do not retain, use or disclose it for any purpose other than performing the services, except as permitted by the CCPA. We certify that we understand and will comply with these restrictions. You may take reasonable steps to ensure we use Personal Information consistently with your obligations.
14. Liability and order of precedence
Each party’s liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Law does not permit that. In the event of conflict: the SCCs or UK Addendum first, then the Business Associate Agreement for protected health information, then this DPA, then the Terms of Service.
Annex I — Description of processing
A. Parties
Data exporter / Controller: the customer identified in the account; contact details as held in the account; role: Controller.
Data importer / Processor: BetterClosure Inc. d/b/a FlowClick, 2125 Biscayne Blvd, Ste 204 #10484, Miami, Florida 33137, United States; contact privacy@solidifai.app; role: Processor.
B. Description
Categories of data subjects: the Controller’s customers, prospects, leads, subscribers, loyalty members, website and app visitors, business contacts, and the Controller’s own users.
Categories of personal data: identifiers (name, email address, telephone number, postal address, device and customer ids); consent and preference records; events and behaviour on the Controller’s channels; purchases, deals, tickets and loyalty activity; messages and their delivery results; ad audiences and results; any custom fields the Controller chooses to include; and data we derive for the Controller — segments, scores, predictions, attribution and AI-generated content.
Special category data: not required. Where the Controller is on the Regulated plan and has accepted the Business Associate Agreement, protected health information may be processed under that agreement. Otherwise the Controller must not submit special category data or protected health information.
Frequency: continuous, on the Controller’s instruction.
Nature and purpose: storing and unifying customer data, segmentation, engagement and messaging, CRM, loyalty, paid-media audiences, analytics and AI assistance, as configured by the Controller.
Duration: for the term of the account, subject to clause 10.
C. Competent supervisory authority
Determined under SCC Clause 13 by the exporter’s establishment or its Article 27 representative; where neither applies, the supervisory authority of the Member State in which the relevant data subjects are located.
Annex II — Technical and organisational measures
- Encryption in transit for all service traffic and all outbound provider calls; encryption at rest for the application database, file storage and backups.
- Customer-held keys (Regulated plan): the data the plan protects is encrypted with keys held in the Controller’s own key service; revoking the key makes that data unreadable to us.
- Credential handling: passwords stored as salted hashes; API keys and access tokens stored as one-way hashes and displayed once; verification and checkout link tokens stored only as hashes and time-limited.
- Tenant isolation: every record is tenant-scoped; ownership is enforced on page, API, hook and job paths, and that enforcement is covered by tests.
- AI policy: per-workspace control of which AI features run, which model providers they may use and what data they may see.
- Access control: role-based access with named users; least-privilege access to production data; no shared accounts.
- Payment data minimisation: card numbers never reach our systems — capture occurs at the payment provider’s hosted checkout.
- Logging and monitoring: audit logging of changes and access, job records, webhook delivery history and automated health monitors.
- Change management: all production changes pass through a controlled pipeline with automated tests, staged promotion through development, QA and production, and a recorded audit trail per change.
- Deletion: deletion of workspace data on closure after a 30-day recoverable grace period, subject to the plan’s retention commitment.
- Resilience: managed platform hosting with provider-level redundancy, continuous database protection and point-in-time recovery.
We review these measures periodically and may update them, provided the level of protection is not reduced.
Annex III — Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Salesforce, Inc. (Heroku) — infrastructure of the FlowClick platform | Application hosting, compute, database, storage and backup for the FlowClick platform SolidifAi runs on | United States |
| Stripe, Inc. | Payment processing, subscription billing, card storage | United States |
| FlowClick’s managed email, SMS and push providers — only where you use the managed provider instead of connecting your own | Carrying the messages you send | As listed in the console when you enable the managed provider |
| AI model providers allowed by your workspace’s AI policy | Running the AI features you enable | As listed in the console’s AI policy |
FlowClick itself is operated by BetterClosure Inc., the same legal entity as SolidifAi, and is not a Sub-processor. Ad platforms, and email, SMS, push and model providers you connect with your own credentials, are engaged by you and are not our Sub-processors.
The current list is maintained on this page. Changes are notified under clause 6.
See also: Terms of Service · Privacy Policy · Acceptable Use Policy · Cookie Policy · Business Associate Agreement