Data Processing Agreement (DPA)

This Agreement forms part of the Terms of Service and the Author Terms, and applies whenever an author processes personal data of their subscribers using Condely.

1. Parties and roles

The controller is the author (platform user) who builds the funnel and collects subscribers. They decide whom to collect, what data to request and what to send.

The processor is AFFIMIX LLC, Folsom, California, USA, trading as Condely. We process subscriber data only on the author's instructions and only to provide the service.

Note: for the author's own data (their account, platform subscription) we are the controller — see the Privacy Policy.

2. Subject matter and nature of processing

• Subject matter: providing a platform for content auto-funnels delivered via Telegram, Web and Email.
• Duration: while the author's account is active, plus the retention period in section 8.
• Categories of data subjects: the author's subscribers and buyers of their products.
• Categories of data: email, Telegram id and username, poll and quiz answers, tags and variables defined by the author, delivery and open history, payment status. Card data is never processed by us — it stays with Stripe.
• Special categories (health, biometrics, beliefs and similar) must not be processed through the platform. If an author collects them via custom fields, they do so at their own risk and outside this Agreement.

3. Our obligations as processor

• Process data only on the author's documented instructions.
• Ensure confidentiality: access is limited to staff and contractors bound by confidentiality obligations.
• Apply technical and organisational security measures (section 5).
• Assist the author with data subject requests and with obligations regarding security, breach notification and impact assessments.
• Notify the author of a personal data breach without undue delay after becoming aware of it.
• Delete or return the data at the end of the relationship, at the author's choice.
• Make available the information needed to demonstrate compliance with Art. 28 GDPR.

4. The author's obligations

• Have a lawful basis for collecting subscribers and messaging them (consent or otherwise), and be able to demonstrate it.
• Tell subscribers who they are, what data is collected and why.
• Handle their subscribers' access, correction and deletion requests in time — the platform provides the tools for this.
• Not upload data they have no right to process.

5. Security measures

• Encryption in transit (TLS) and encrypted backups.
• Access control: staff access follows the least-privilege principle.
• Secrets kept outside the codebase; key rotation on incidents.
• Activity logging and error monitoring.
• Regular database backups.

6. Subprocessors

The author gives general authorisation to engage subprocessors. The current list is in the "Subprocessors" section of the Privacy Policy: Stripe, Telegram, Resend, Sentry, analytics providers, hosting. We bind them to terms no less protective than this Agreement and remain responsible to the author for their acts.

We give prior notice when adding or replacing a subprocessor. If the author objects and we cannot offer a reasonable alternative, the author may stop using the service.

7. International transfers

Data may be processed outside the EEA, including in the United States. Transfers rely on the standard contractual clauses of the respective providers and applicable adequacy mechanisms.

8. Deletion

The author can delete subscribers and their data from the studio at any time. After an author's account is deleted we remove their subscribers' data within 30 days, except what we must retain by law (for example transaction records for tax and accounting).

9. Liability and precedence

For matters of personal data processing this Agreement prevails over the Terms of Service. In all other respects the Terms and the Author Terms apply.

10. Contact

Data protection questions, data subject requests and breach reports: support@condely.com.