Data Processing Addendum
Last updated: August 17, 2026
This Data Processing Addendum ("DPA") describes how flyclicks.io processes personal data on behalf of customers using the platform, and is incorporated into our Terms of Service and any applicable order form.
1. Scope and Roles
This DPA applies where flyclicks.io processes personal data on your behalf as a processor (or "service provider") in connection with your use of the platform, and you act as the controller of that data — for example, your customers' names and contact details collected through review-request campaigns, and reviewer information Google makes available through its Business Profile API. It applies regardless of where your organization operates, including within the EU/EEA and UK.
2. Processing Instructions
We process personal data only to provide, maintain, and support the platform in accordance with your configuration and our Terms of Service, and as otherwise required by law. We will not use personal data processed on your behalf for our own marketing purposes or to train third-party foundation models.
3. Confidentiality
We limit access to personal data to personnel and systems that need it to operate the platform, and require anyone with access to be bound by confidentiality obligations.
4. Security Measures
We maintain technical and organizational measures appropriate to the risk, including TLS encryption in transit, AES-256 encryption of tokens and secrets at rest, OAuth 2.0 authentication, role-based access control, per-organization data isolation, and audit logging. Details are on our Security page.
5. Sub-processors
We use the following categories of sub-processors to deliver the platform. We'll update this list as our vendors change and, on request, notify enterprise customers of material changes.
| Sub-processor | Purpose |
|---|---|
| Google (Business Profile API) | Syncing reviews, ratings, business profile data, and publishing replies/posts you authorize. |
| AI provider in use for your account (Anthropic, OpenAI, or Google Gemini) | Generating AI-drafted review replies and optimization suggestions. |
| Stripe / Razorpay | Subscription billing and payment processing. |
| Email delivery provider (or your own SMTP server, if configured) | Sending review-request campaigns and account notifications. |
| HubSpot | Only if you connect it — syncing CRM contact and outreach data. |
| Cloud infrastructure and hosting providers | Hosting the application, databases, and encrypted backups. |
6. Assistance With Data Subject Requests
Where required by applicable law, we will assist you in responding to requests from data subjects to access, correct, delete, or export their personal data, using the tools available in your dashboard or by contacting support@flyclicks.io.
7. Security Incident Notification
If we become aware of a security incident affecting your personal data, we will notify you without undue delay and provide information reasonably available to us to help you meet any of your own notification obligations.
8. International Transfers
Where personal data is transferred internationally in connection with the platform, we rely on appropriate safeguards recognized under applicable data protection law.
9. Deletion or Return of Data
On termination of your subscription, we will delete or anonymize personal data processed on your behalf within a reasonable period, except where retention is required by law.
10. Requesting a Signed Copy
This DPA is incorporated by reference into your Terms of Service. If your organization requires a separately executed copy — for example, for an internal vendor review — email support@flyclicks.io and we'll arrange it.