SendLit-1024.png
SendLit

Data Processing Agreement

DRAFT: review [TO CONFIRM] items and have counsel check before publishing

Last updated: [date of publishing]

About this agreement

This Data Processing Agreement ("DPA") is between CodeLit, a company based in India [TO CONFIRM: full legal entity name, company form and registered address] ("CodeLit", "we", the "Processor"), and the customer that uses the hosted SendLit service at app.sendlit.app ("you", the "Controller"). It forms part of the SendLit Terms of Service and applies when we process personal data on your behalf, as required by Article 28 of the EU General Data Protection Regulation (GDPR), the UK GDPR and similar laws.

If there's a conflict between this DPA and the Terms of Service about personal data, this DPA wins. Self-hosted SendLit installations aren't covered, because we don't process their data.

How you accept this DPA

This DPA applies automatically when you use the hosted Service to process personal data covered by data protection law. If you need a countersigned copy for your records, email hi@codelit.dev [TO CONFIRM: whether acceptance is by using the Service, by request for a signed copy, or both].

Scope and details of processing

  • Subject matter: providing the SendLit email marketing service: storing contacts, building and sending emails through the email provider you connect, tracking delivery, opens and clicks, and handling unsubscribes and suppressions.

  • Duration: for as long as you use the Service, plus the deletion period described below.

  • Nature and purpose: storage, organization, segmentation, retrieval, transmission to your email provider, tracking and deletion, only to provide the Service to you.

  • Data subjects: your contacts, subscribers and email recipients, and your team members.

  • Types of personal data: email addresses, names, tags, subscription status, custom fields you choose to add, email content, delivery, bounce and complaint events, open and click events, and unsubscribe and suppression records.

  • Special categories: you shouldn't upload special category data (such as health data) unless you have a lawful basis and it's necessary. The Service isn't designed for it.

Your instructions

We process personal data only on your documented instructions. These terms, your configuration of the Service and your use of the dashboard, API and MCP server are your instructions. We'll tell you if we believe an instruction breaks data protection law. You're responsible for having a lawful basis, and any consent needed, for the data you give us and the email you send.

Confidentiality

Everyone at CodeLit who can access your personal data is bound by confidentiality obligations and only accesses it as needed to provide, support or secure the Service.

Security measures

We maintain appropriate technical and organizational measures, including:

  • encryption in transit (HTTPS) for all access to the Service;

  • encryption at rest for your email provider passwords and secrets, and hashing of API keys and sign-in codes;

  • passwordless sign-in with one-time codes that expire after 5 minutes, with rate limits;

  • strict separation of each customer's data by team, and role-based access for team members;

  • automatic suppression of addresses that bounced, complained or unsubscribed;

  • retention limits for delivery data (raw provider webhook payloads after 30 days, delivery events after about 13 months);

  • backups and monitoring of our infrastructure [TO CONFIRM: backup frequency, encryption at rest for the database, and access controls for staff].

We may update these measures as long as the overall level of protection doesn't decrease.

Subprocessors

You authorize us to use the subprocessors listed below. We make sure each one is bound by data protection terms that are at least as protective as this DPA, and we remain responsible for them.

We'll give you notice of any new or replacement subprocessor by updating the list on this page and emailing account owners at least 30 days before the change [TO CONFIRM: notice method and period]. You can object on reasonable data protection grounds within that period. If we can't resolve your objection, you can stop using the affected part of the Service and cancel.

Your own email provider (for example Amazon SES, Mailgun, SendGrid, Postmark, Resend or your SMTP server) isn't our subprocessor. You choose and contract with it directly.

Helping with data subject requests

Taking into account the nature of the processing, we'll help you respond to requests from people exercising their rights, such as access, correction, deletion and objection. The Service lets you find, edit, export, unsubscribe and delete contacts yourself. If we receive a request directly about your data, we'll pass it to you and won't respond except to tell the person to contact you, unless the law requires otherwise.

We'll also reasonably help you with security, breach notifications, data protection impact assessments and consultations with authorities, as far as they relate to our processing.

Personal data breaches

If we become aware of a personal data breach affecting your data, we'll notify you without undue delay, and in any case within 72 hours. We'll tell you what we know about the nature of the breach, the data and people affected, the likely consequences and what we're doing about it, and update you as we learn more.

Deletion or return at the end

When you stop using the Service, you can export your contacts and data before closing your account. After your account or organization is closed, we'll delete your personal data within [TO CONFIRM: number of days], unless the law requires us to keep it. Backups are overwritten on their normal cycle [TO CONFIRM: backup retention period]. One-way hashes of suppressed addresses may be kept so they aren't emailed again.

Audits

We'll make available the information reasonably needed to show we comply with this DPA. If that isn't enough, you may audit our compliance, at your own cost, no more than once a year, with at least 30 days' written notice, during business hours and under confidentiality, or appoint an independent auditor to do so. We may instead provide recent third-party audit reports or certifications if we have them.

International transfers

CodeLit is based in India, and the Service is hosted mainly in the United States. When personal data from the EU, EEA, UK or Switzerland is transferred to a country without an adequacy decision, the European Commission's Standard Contractual Clauses (Module 2, controller to processor, and Module 3 where applicable), together with the UK International Data Transfer Addendum where relevant, are incorporated into this DPA by reference. We require the same safeguards from our subprocessors. [TO CONFIRM: SCC module choices, docking clause, governing law and supervisory authority elections]

Liability and term

Each party's liability under this DPA is subject to the limitation of liability in the Terms of Service, unless the law doesn't allow it. This DPA lasts as long as we process personal data for you.

Current subprocessors

  • Amazon Web Services, Inc. (United States, US East region): hosting for the SendLit application and API.

  • Database and queue hosting for PostgreSQL and Redis [TO CONFIRM: provider and region].

  • MediaLit, operated by CodeLit (hosted on AWS, US East region): storage and delivery of images uploaded to your media library.

  • PostHog, Inc. [TO CONFIRM: US or EU region]: product analytics, error tracking and logs. [TO CONFIRM: whether any contact data reaches PostHog; the code sends event IDs, not contact emails]

  • Sign-in email delivery [TO CONFIRM: provider]: sends sign-in codes and service emails to your team members, not to your contacts.

Dodo Payments processes billing data as part of our relationship with you, not your contact data, so it isn't listed as a subprocessor here.

Contact

Questions about this DPA: hi@codelit.dev CodeLit [TO CONFIRM: full legal entity name] [TO CONFIRM: registered address]

Data Processing Agreement | SendLit | SendLit