This Data Processing Agreement (DPA) is part of the OpenPromoter Terms of Service. It applies when you use OpenPromoter Cloud to process personal data. You accept it when you accept the Terms. No signature is needed.
Want a signed copy for your records? Email support@openpromoter.com and we will send one.
The parties
- You (the customer) are the controller.
- DevDiggers Technologies is the processor. Address: 548, Sector 12D, Awas Vikas Colony, Bodla, Agra, Uttar Pradesh, India, 282007.
What we process
| Item | Details |
|---|---|
| Subject matter | Running your affiliate or referral program on OpenPromoter Cloud |
| Duration | While your account is open, plus the deletion period below |
| Nature and purpose | Storing, tracking, attributing, calculating commissions, sending email and preparing payouts on your instructions |
| People concerned | Your partners and applicants, your customers, visitors to your website and your team members |
| Kinds of data | Names, email addresses, websites, social links, application answers and messages. Payout details and tax form data with tax IDs. Hashed IP addresses, browser type, country, landing pages and payment amounts. |
| Sensitive data | None by design. Do not upload special category data. |
Our duties
We will:
- Process personal data only on your written instructions. These Terms, your settings and your actions in the app are your instructions. We tell you if we think an instruction breaks the law.
- Make sure everyone who can reach the data is bound to keep it confidential.
- Keep the security measures listed below in place.
- Use only the subprocessors listed below and follow the rules for changes.
- Help you answer requests from people who use their data rights. The export and delete tools in the app cover most requests.
- Help you with security, breach notices and data protection impact assessments where you need our input.
- Delete or return the data when your account ends. The section "Deletion at the end" explains how.
- Give you the information you need to show that we keep this DPA.
Security measures
- HTTPS for all traffic
- Passwords stored as one-way hashes
- Encryption in the database for keys, tokens and tax IDs
- IP addresses stored only as hashes
- Two-factor sign-in for every founder and a fresh code for large payout batches
- Team roles with a read-only option
- An audit log of important actions
- Nightly database backups kept off the main server
- Server access limited to the people who run OpenPromoter
Subprocessors
You allow us to use these subprocessors.
| Company | Purpose | Location |
|---|---|---|
| Hostinger International | Server and database hosting | United States |
| Cloudflare | DNS, security and custom domains | Worldwide |
| Amazon Web Services | Email (SES) and backups (S3) | United States |
| Stripe | Stripe Connect payouts when you choose Stripe | United States |
| PayPal | Payouts when you choose PayPal | United States |
| Wise | Payouts when you choose Wise | United Kingdom and others |
| Anthropic | AI features, without tax IDs or payout details | United States |
Each subprocessor works under a written contract with data protection terms. We stay responsible for its work.
Changes: we update this list and email you at least 30 days before a new subprocessor starts. You can object by email in that time. If we cannot solve your objection, you may cancel and get a refund for the unused part of your plan.
Data breaches
If we learn of a breach of your personal data, we tell you without undue delay. We aim to do it within 48 hours. We share what happened, what data was affected and what we are doing about it.
International transfers
We process data in the United States and India. For personal data from the European Economic Area, the EU Standard Contractual Clauses (Commission Decision 2021/914) apply, Module 2 (controller to processor). They are part of this DPA by reference.
- The governing law for the clauses is the law of Ireland. Its courts settle disputes about them.
- For data from the United Kingdom, the UK International Data Transfer Addendum applies.
- For data from Switzerland, the clauses apply with the Swiss changes the FDPIC requires.
- If the clauses and this DPA ever conflict, the clauses win.
Deletion at the end
When you delete your account, we delete your program data from the live database right away. Backup copies roll off within 30 days. Export your data first under Settings > Account.
We keep only what the law requires us to keep. An example is invoices for your own plan.
Audits
We answer your written questions about how we keep this DPA within 30 days. If that is not enough, you may ask for an audit. You or an independent auditor bound by confidentiality may carry it out once a year, at your cost, with 30 days of notice.
Liability
The limits of liability in the Terms of Service apply to this DPA.
Contact
Data protection questions go to support@openpromoter.com.