1. Parties and scope
This Data Processing Addendum (“DPA”) is between the customer using FunnelLingo (“Customer”) and Moosh Works LLC, owner and operator of FunnelLingo (“Processor”). It applies when Processor handles personal data on Customer’s behalf in providing FunnelLingo. Capitalized terms not defined here have the meaning in the service agreement or applicable data-protection law.
2. Roles and instructions
Customer acts as controller or as a processor with authority from another controller. Processor acts as Customer’s processor or subprocessor. Processor will handle personal data only on Customer’s documented instructions, including the service agreement, product settings, authorized support requests, and law, unless law requires otherwise.
Customer is responsible for lawful instructions, notices, legal bases, permissions, data accuracy, and not submitting prohibited or unnecessary data.
3. Processing details
| Subject | Context-aware localization and publication of static authored website copy. |
|---|---|
| Duration | For the service term and the 30-day uninstall cleanup period, subject to documented legal and provider retention. |
| Nature and purpose | Collect, structure, host, transmit, translate, review, protect, publish, secure, support, and delete authorized content and account context. |
| People | Authorized account users and, only to a limited technical extent, visitors whose browsers request public assets or keep a local language preference. |
| Data | Account and installation identifiers, authorized-user identity and role, reduced business profile, authored page copy and context, projects, glossary, translations, review state, domains, publication data, usage and diagnostic metadata, and support messages. |
| Sensitive data | Not intended or permitted. Customer must not submit visitor form entries, contact records, credentials, payment-card, health, government-ID, biometric, precise-location, or other sensitive data. |
4. Confidentiality
Processor will limit access to people and providers who need it to operate or support the service and who are bound by confidentiality duties. Processor will not sell Customer personal data or use it for unrelated advertising.
5. Security measures
Processor maintains measures suited to the service risk, including encrypted OAuth tokens, TLS, short-lived signed sessions, tenant and role checks, least-privilege scopes, signed lifecycle events, registered-origin controls, rate limits, restrictive browser policies, dependency and secret scanning, redacted logs, backups available through the hosting platform, incident procedures, and deterministic guards before translation publication.
Customer understands that no measure removes all risk and must secure its connected accounts, users, source sites, and customer instructions.
6. Subprocessors
Customer authorizes the providers on the current Subprocessor List. Processor will require service terms designed to protect personal data and will remain responsible for its obligations under this DPA. Processor will update the list for a material new provider and handle reasonable objections in good faith.
7. Individual requests and compliance help
Taking account of the service and data available, Processor will reasonably help Customer respond to access, correction, deletion, restriction, objection, portability, and appeal requests. If Processor receives a request about Customer-controlled data, it may direct the requester to Customer unless law prevents it.
Processor will provide reasonable information needed for Customer’s data-protection assessment and regulatory duties, subject to confidentiality, security, and proportionate cost.
8. Security incidents
Processor will notify Customer without undue delay after confirming unauthorized access to Customer personal data for which notice is required. Notice will include available information about the nature, affected data, likely consequences, and mitigation. Notice is not an admission of fault or legal liability.
9. Return and deletion
During the service, Customer can delete projects and disconnect the account. On uninstall or disconnect, access stops and a 30-day cleanup period begins. Final cleanup deletes linked workspace data and tokens, except short-lived provider records, backups, de-identified aggregates, security evidence, or records law requires. See Data deletion.
10. International transfers
Customer authorizes processing in the United States and provider locations described on the Subprocessor List. If applicable law requires an additional transfer mechanism, the parties will work in good faith to put a valid mechanism in place before the affected processing. The current service does not promise customer-selected data residency.
11. Reviews and audits
On reasonable written request, Processor will provide available security and compliance information needed to show compliance with this DPA. If that is not enough, the parties may agree to a narrow independent review that protects other customers, confidential systems, and security. Customer bears its reasonable cost unless material noncompliance is found.
12. Order and termination
If this DPA conflicts with the service agreement on processing personal data, this DPA controls. The rest of the service agreement remains in effect. This DPA ends when Processor no longer holds Customer personal data, except terms that must survive to protect the data or enforce the agreement.
13. Contact
Privacy and DPA questions: [email protected].