Data Processing Agreement

Updated October 3, 2026

This Data Processing Agreement is part of our Terms of Service. It applies automatically to every XOXO account, with no signature needed, and covers the personal data we handle for you about your subscribers.

Roles

For subscriber data, you’re the controller and Supertape, LLC is your processor, in GDPR’s terms. Under US state privacy laws like the CCPA, you’re the business and we’re your service provider or processor. Words like “controller”, “processor”, “personal data”, and “data subject” mean what those laws say they mean.

We’re an independent controller, not your processor, for the data we need to run XOXO itself. That’s your account and billing details, and the limited records we keep to prevent abuse, like the hashed addresses that keep paused and banned senders from coming back. It also includes hashed addresses that bounced, so no sender on XOXO keeps mailing an address known to bounce. Our Privacy Policy covers that data.

If you use XOXO to handle data for someone else, as an agency might for a client, you’re their processor and we’re your subprocessor. You’re confirming you have their authority to give us the instructions in this agreement, and you stay our point of contact.

Details of processing

Subject matter and purpose. Providing XOXO to you: hosting your forms, storing, importing, and exporting your subscriber records, delivering your emails, recording delivery, engagement, and suppression events, support, and keeping the service secure and free of abuse.
Nature. Collecting, storing, organizing, transmitting, and deleting subscriber data as you use XOXO, mostly by automated means.
Data subjects. Your subscribers, anyone else you add to your audience, and people who submit your forms.
Categories of data. Email addresses, custom fields, tags, groups, source data, delivery and engagement timestamps, and the technical data recorded with form submissions, like IP address and browser details, for security and bot filtering. Our Privacy Policy has more detail.
Sensitive data. None. Our Terms of Service don’t allow sensitive personal information or data from children under 13 without our written approval, and any approval will set out how that data is handled.
Frequency. Continuous, while your account is active.
Duration. For as long as your account is active, then as described under End of service.

Your instructions

We process subscriber data, including international transfers, only to provide XOXO, follow your documented instructions, and protect the service. Your instructions are these terms and how you set up and use XOXO, including what you ask an AI agent you connect to do.

If the law requires other processing, or we believe an instruction breaks data protection law, we’ll tell you, unless the law prohibits that.

You’re responsible for having a lawful basis for the data you give us and for your instructions, as our Terms of Service describe.

What we won’t do

We never use subscriber data to advertise to your subscribers, or use your list for ourselves. As your service provider under US state privacy laws, we also won’t:

Sell or share subscriber data, including for cross-context behavioral advertising
Keep, use, or disclose it for any purpose other than providing XOXO to you, or outside our direct relationship with you
Combine it with personal data we get from anyone else, except where the law allows it, like to prevent fraud and abuse across the service

We’ll follow the obligations those laws place on us, provide the level of privacy protection they require, and tell you if we can no longer meet them. You can take reasonable steps to stop and fix any use of subscriber data that isn’t authorized.

Confidentiality and security

Everyone at XOXO with access to subscriber data is bound by confidentiality.

We protect subscriber data with technical and organizational measures appropriate to the risk. We update them as XOXO changes, and never in a way that lowers the overall protection. They currently include:

Encryption in transit. XOXO’s app, forms, and pages only accept HTTPS connections, and our connections to the database and our providers use TLS. Emails go to recipients’ mail servers over TLS whenever the server supports it.
Encryption at rest. Our database and its backups, the storage for imports and exports, and our email delivery providers all encrypt stored data. Addresses and answers from form signups waiting to be confirmed, and the credentials for platforms you connect, are also encrypted in our application.
Minimization. For opens and clicks, we store only timestamps, never the reader’s IP address or device. The technical details recorded with form signups are deleted after a short time. Addresses kept to stop re-adds after an unsubscribe, bounce, or complaint are stored only as one-way hashes.
Access control. Only XOXO’s co-founders have access to production systems and subscriber data, and only as their work needs it. We use multi-factor authentication on every provider account. XOXO has no passwords: people sign in with a one-time code sent by email, or with Google or Apple. Our admin tools are limited to staff accounts.
Devices. Computers used to work on XOXO have full-disk encryption and lock automatically.
Protecting the service. Sign-in and subscription forms have bot checks and rate limits. Every send is reviewed before it goes out.
Secure development. Code changes run automated tests and security scans before they ship, and dependencies get automated security updates.
Monitoring. We monitor errors, uptime, and sending health, and alerts page someone on call. We strip personal data from error reports.
Resilience. Our database is backed up automatically at least once a day, and the encrypted backups are stored in the same region as the database.
Incident response. We follow a written incident response process, with a named person on call and backups, and handle breaches as described under Breaches.
Subprocessors. We review a provider’s security before it handles subscriber data, and bind it to written data protection obligations, as described under Subprocessors.

Subprocessors

You give us general authorization to use the service providers named in our Privacy Policy as subprocessors when they handle subscriber data. They’re bound by written data protection obligations at least as protective as this agreement, and we remain responsible for their performance.

We’ll let you know by email or in the app at least 15 days before a new subprocessor starts handling subscriber data. If you object, you can close your account before the change takes effect. If we have to replace a provider urgently to keep XOXO running or secure, we’ll tell you as soon as we can instead.

An AI app you connect to your account works for you, not for us. Its provider isn’t our subprocessor, and its own terms govern what it does with the data, as our Terms of Service explain.

Helping you

Subscriber requests. We’ll help you respond when subscribers ask to access, correct, delete, or move their data, or object to its use. You can handle most of these yourself in the app, and if a subscriber contacts us directly, we’ll point them to you.
Assessments. We’ll give you reasonable help with data protection impact assessments and consultations with supervisory authorities, where you need our input.
Breaches. If we become aware of a breach affecting your subscribers’ data, we’ll notify you without undue delay, share what we know so you can meet your own obligations, and take reasonable steps to contain it.
Audits. We’ll provide the information you reasonably need to show this agreement is being followed. If that’s not enough, we’ll allow and contribute to an audit you run, up to once in any 12-month period, on at least 30 days’ notice, during business hours, under confidentiality, and at your expense. The frequency and notice limits don’t apply after a breach affecting your subscribers’ data, or when a supervisory authority requires the audit. An audit can’t reach other customers’ data or details that would weaken our security.

End of service

You can export your subscribers from the app at any time, which is how we return subscriber data to you. When your account closes, we delete subscriber data from live XOXO systems, as our Privacy Policy describes, so export anything you need first.

Copies can remain in backups and in our providers’ records until they expire on their normal schedules, and we keep anything the law requires us to. The abuse-prevention records we keep as an independent controller are covered by our Privacy Policy instead. Anything we keep stays covered by this agreement until it’s deleted.

International transfers

We’re based in the United States. If you or your subscribers are in the EEA, the UK, or Switzerland, the European Commission’s 2021 Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor, where you act for someone else) and the UK International Data Transfer Addendum are part of this agreement, for any transfer of subscriber data to us that needs them.

For those clauses:

You’re the data exporter and Supertape, LLC is the data importer. The parties and their contact details come from your XOXO account and the Who we are section of our Privacy Policy.
The optional docking clause (Clause 7) doesn’t apply.
Under Clause 9, we have general authorization to use subprocessors, with the 15 days’ notice described under Subprocessors.
The optional language in Clause 11 doesn’t apply.
Under Clause 13, the competent supervisory authority is the one the clause names for your situation.
Under Clauses 17 and 18, the clauses are governed by Irish law, and disputes under them go to the courts of Ireland.
Annex I is the Details of processing above, Annex II is the measures under Confidentiality and security, and Annex III is the subprocessor list in its Data sharing section.

For UK transfers, the Addendum’s tables are completed with the details above, and neither party may end the Addendum when it changes.

For Swiss transfers, the clauses apply with the changes Swiss data protection law requires. The Swiss Federal Data Protection and Information Commissioner is the competent authority, references to EU law include Swiss law, and subscribers in Switzerland can bring claims where they live.

How this fits with our terms

If this agreement conflicts with the rest of our Terms of Service on how we handle subscriber data, this agreement wins. If it conflicts with the Standard Contractual Clauses, the clauses win.

Otherwise, the Liability section of our terms covers this agreement too, except where the law or the clauses don’t allow it.

This agreement lasts as long as we handle subscriber data for you. Changes to it follow the notice rules in Changes to these terms.