Data Processing Agreement (DPA)

Last Updated: May 16, 2026

1. Roles and Responsibilities

This Data Processing Agreement ("DPA") supplements the Terms of Service between you ("Customer" or "Data Controller") and MsgOrb ("Service Provider" or "Data Processor"). By using MsgOrb's automated messaging or calling tools, you authorize us to process personal data on your behalf.

Under the General Data Protection Regulation (GDPR) and similar privacy frameworks:

  • You (the Customer) are the Data Controller. You determine why and how data is collected from your end-users and ensure you have the legal right (such as consent) to share it with us.
  • We (MsgOrb) are the Data Processor. We only process the personal data transmitted through our platform solely according to your instructions (i.e., routing your campaigns or calls).

2. Processing Details

Nature of Processing: MsgOrb provides a SaaS platform facilitating automated communications via WhatsApp and voice networks.
Categories of Data: End-user phone numbers, names, interaction logs, message content, and calling metadata.
Duration: Data is processed for the duration of your active subscription, or until you manually request deletion.

3. Sub-processors

You provide general authorization for MsgOrb to engage sub-processors to fulfill our service obligations. Our core sub-processors include:

  • Meta Platforms, Inc. (WhatsApp API delivery)
  • Supabase / AWS / GCP (Cloud hosting and database infrastructure)
  • Stripe (Payment processing)
  • Authorized telecom aggregators for voice call routing.

4. Security Measures

We commit to maintaining appropriate technical and organizational measures to ensure the security, confidentiality, and integrity of your data. This includes encryption of data in transit (TLS 1.2+) and at rest (AES-256), strict access controls, and regular vulnerability audits. In the event of a Personal Data Breach, we will notify you without undue delay after becoming aware of it.

5. Customer Assistance and Erasure

We will assist you, taking into account the nature of the processing, with fulfilling your obligations to respond to individuals' requests regarding their data rights (e.g., access or deletion requests). Upon termination of your account, we will delete or anonymize your data in accordance with our standard retention policies, except where legally required to store it.