Data Processing Addendum

Last updated: September 23, 2026

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between MeraFlow LLC (South Carolina, United States) (“we,” “us,” the “Processor” or “Service Provider”) and the subscribing business (“you,” the shop, the “Controller” or “Business”). It applies whenever we process personal information of your end customers on your behalf and is incorporated into the Terms by reference — no signature is required. It controls over the Terms in case of conflict regarding personal-information processing.

1. Roles and scope

For personal information of your customers (names, phone numbers, addresses, call recordings and transcripts, service-job details, messages), you are the business/controller and we are your service provider/processor under the California Consumer Privacy Act as amended (CCPA/CPRA) and similar US state privacy laws. For your own account data, our Privacy Policy applies and we act as a business/controller.

2. Our commitments as service provider

We certify that we will:

• process end-customer personal information only to provide and improve the contracted Service for you, per your documented instructions, and for no other commercial purpose;
• not sell or share end-customer personal information, and not retain, use, or disclose it outside the direct business relationship with you or for cross-context behavioral advertising;
• not combine end-customer personal information with data we hold in other capacities, except as permitted for service providers by applicable regulations;
• apply reasonable technical and organizational security measures: tenant isolation with row-level security, encryption in transit (TLS) and at rest for credentials, role-based access, audit logging, and least-privilege operator access;
• notify you without undue delay — and in any event within 72 hours where feasible — after becoming aware of a breach of security affecting your end-customer personal information, with the information reasonably needed for your own notification obligations;
• notify you promptly if we determine that we can no longer meet our obligations under applicable privacy law with respect to your end-customer personal information, in which case you may take reasonable and appropriate steps to stop and remediate any unauthorized use of that information;
• assist you, as reasonably necessary, in responding to verified consumer rights requests (access, deletion, correction, opt-out) received by you;
• delete or return end-customer personal information at termination, subject to the 60-day export window described in the Terms and retention required by law;
• make available information reasonably necessary to demonstrate compliance with this DPA, and permit reasonable assessments no more than once per 12 months, on 30 days’ notice, without disrupting other customers’ tenants.

3. Sub-processors

You authorize the sub-processors listed below. Before adding a materially new sub-processor we will update this page and notify active customers by email in advance where practicable; if you reasonably object on data-protection grounds, you may cancel the affected Service as described in the Terms (Section 13). Each sub-processor is bound by written terms no less protective than this DPA.

4. Your obligations

You are responsible for having a lawful basis to collect end-customer information, for your own privacy notices, for obtaining any required consents (including SMS/TCPA consent and call-recording disclosures, which the platform surfaces but you must not disable), and for the accuracy of instructions you give us through the Service’s settings.

5. Contact

Privacy questions and rights-request assistance: [email protected].