Data Processing Agreement

Last Updated: June 28, 2026

Version: 1.1

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service or other written or electronic agreement between Revuloop LLC ("Processor", "we", "us", or "our") and you, the customer ("Controller", "you", or "your"), for the use of the Revuloop platform and services (the "Agreement").

This DPA applies to the extent that Revuloop processes Personal Data on your behalf as a Data Processor in the course of providing the Services. This DPA is designed to ensure compliance with the requirements of Article 28 of the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection (FADP), and other applicable data protection laws.

For the purposes of this DPA, the terms "Personal Data", "Data Subject", "Processing", "Controller", "Processor", and "Supervisory Authority" have the meanings given to them in the GDPR, unless otherwise defined herein.

2. Scope and Roles

2.1 Controller

You (the customer) are the Controller. You determine the purposes and means of processing Personal Data when you use Revuloop to create surveys, collect responses, manage contacts, and analyze results.

2.2 Processor

Revuloop LLC is the Processor. We process Personal Data solely on your behalf and in accordance with your documented instructions as provided through the Services and this DPA.

2.3 Revuloop as Controller

Revuloop acts as an independent Controller for: (a) account registration and authentication data; (b) billing and payment data; (c) usage analytics for platform improvement; (d) error monitoring and debugging data; and (e) website visitor analytics. Such processing is governed by our Privacy Policy.

3. Categories of Data Subjects

Personal Data processed under this DPA may relate to the following categories of Data Subjects:

Survey Respondents: Individuals who respond to surveys you create using the Revuloop platform
Contacts: Individuals whose information you upload or manage in your Revuloop contact lists for survey distribution
End Users: Members of your organization who access and use the Revuloop platform under your account
Smart Survey Participants: Individuals who participate in AI-powered conversational surveys
Directory / HRIS Respondents: Individuals (such as your employees or customers) whose directory records you upload or synchronize for survey targeting and account-level reporting. Customer-experience cases and account health metrics may relate to these identified individuals

4. Types of Personal Data Processed

4.1 Survey Response Data

Responses to survey questions (text, ratings, selections)
IP address (anonymized via SHA-256 hashing for anonymous surveys)
Device type, operating system, browser name and version
Browser language preference
Time to complete the survey and per-question timing
Sentiment scores and engagement metrics
UTM parameters, referrer information, and distribution channel data

4.2 Contact Data

Email address
First name and last name
Consent status and timestamps
Subscription status (active, unsubscribed, bounced)
Custom properties you define
Department membership information

4.3 Smart Survey Session Data

Complete conversation history (questions asked and responses provided)
Sentiment journey analysis across the conversation
Conversation quality scores
Keywords and themes extracted from responses
Engagement metrics (response times, completion rates)

4.4 Organization Member Data

Names and email addresses of your team members
Organization membership roles (Owner, Admin, Member, Viewer, Responder)
SSO attributes (SAML/OIDC claims) when enterprise SSO is configured

4.5 Webhook Delivery Data

When you configure webhooks, response data (including respondent PII if you enable the includeRespondentPII option) is delivered to your specified endpoints. PII fields are explicitly opt-in per webhook subscription.

4.6 Respondent / Directory Data

Name and email address
Organizational attributes (department, team, location, job title, job level, manager)
Employment type and status
External identifier and account association you assign for linking and account-level reporting
Custom attributes you provide

4.7 Customer Experience (Case, Alert, and Account) Data

Case records including the linked response context, optional AI-generated summary, status, priority, and assigned team member
Alert records and the recipients you configure for alert notifications
Account-level metrics aggregated from responses (such as composite health scores and related indicators)

5. Purpose and Nature of Processing

Revuloop processes Personal Data solely for the purpose of providing the Services as described in the Agreement, including:

Collecting, storing, and managing survey responses on your behalf
Distributing surveys to your contacts via email
Generating analytics, reports, and insights from survey data
AI-powered survey generation, Smart Survey question generation, and analytics (via OpenAI)
Exporting survey data in PDF, CSV, and Excel formats
Delivering webhook notifications to your configured endpoints
Providing embed SDK functionality for surveys on your websites
Managing your contact lists and survey invitations
Processing background analytics jobs for large-scale survey analysis
Powering customer-experience workflows: creating and managing follow-up cases, evaluating alert rules, and computing account health metrics from responses
Delivering survey and response data to the native integrations you connect, at your direction
Importing historical responses you migrate from legacy survey platforms
Synchronizing respondent and directory (HRIS) records for survey targeting

6. Processor Obligations

6.1 Documented Instructions

Revuloop will process Personal Data only on your documented instructions, including with regard to transfers of Personal Data to a third country or international organization. Your use of the Services and configuration of surveys, contacts, and integrations constitute your instructions.

6.2 Confidentiality

All Revuloop personnel authorized to process Personal Data are bound by obligations of confidentiality.

6.3 Security Measures

Revuloop implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

Encryption of data in transit (HTTPS/TLS for all connections)
Encryption of data at rest (AES-256 via Supabase/AWS infrastructure)
Password hashing using bcrypt for credential-based authentication
SHA-256 hashing of IP addresses for anonymous survey responses
JWT-based session management with secure token handling
Role-based access control (RBAC) with five permission levels across organizations
API key authentication with scoped permissions and environment separation (LIVE/TEST)
HMAC signature verification for webhook deliveries
Input validation and sanitization using Zod schema validation
Security headers: HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
Database connection pooling with configurable timeouts and statement limits
Automated daily database backups (7-day retention via Supabase)
Rate limiting per subscription tier to prevent abuse

6.4 Sub-Processors

You provide general authorization for Revuloop to engage the sub-processors listed in Annex II. Revuloop will notify you of any intended additions or replacements of sub-processors, giving you the opportunity to object. If you object on reasonable grounds related to data protection, and Revuloop cannot reasonably accommodate the objection, either party may terminate the affected portion of the Services.

6.5 Data Subject Rights

Revuloop will assist you in fulfilling your obligations to respond to Data Subject requests under GDPR Articles 15-22 (access, rectification, erasure, restriction, portability, objection). If Revuloop receives a request directly from a Data Subject, we will promptly redirect them to you unless legally required to respond directly.

6.6 Data Protection Impact Assessments

Revuloop will provide reasonable assistance to you with data protection impact assessments and prior consultations with supervisory authorities, to the extent required under GDPR Articles 35 and 36.

7. Personal Data Breach Notification

Revuloop will notify you without undue delay (and in any event within 72 hours) after becoming aware of a Personal Data Breach affecting your data. The notification will include:

A description of the nature of the breach, including categories and approximate number of Data Subjects and records concerned
The name and contact details of the point of contact for more information
A description of the likely consequences of the breach
A description of the measures taken or proposed to address the breach, including measures to mitigate possible adverse effects

8. International Data Transfers

8.1 Transfer Mechanisms

The Services are hosted in the United States. When Personal Data originating from the European Economic Area (EEA), United Kingdom, or Switzerland is transferred to the United States, such transfers are protected by:

Standard Contractual Clauses (SCCs) as approved by the European Commission (Decision 2021/914), incorporated by reference as Annex III to this DPA. The SCCs serve as the primary legal mechanism for international data transfers
EU-US Data Privacy Framework (DPF), UK Extension to the DPF, and Swiss-US DPF, if and when Revuloop obtains certification under the applicable framework. Revuloop will update this DPA to reflect any such certification

8.2 Standard Contractual Clauses

Where SCCs apply, the parties agree to Module 2 (Controller to Processor). The governing law shall be that of the EU Member State in which the Controller is established. The competent supervisory authority shall be determined in accordance with Clause 13 of the SCCs.

8.3 Data Localization

All primary data storage is in the United States:

Database: Supabase (managed PostgreSQL) hosted on AWS in the United States
Application: Vercel serverless functions deployed in the United States
File Storage: Cloudflare R2 with automatic region selection (may store data in regions closest to the uploader)

9. Data Retention and Deletion

9.1 During the Agreement

Revuloop retains Personal Data for as long as necessary to provide the Services. Specific retention periods:

Survey responses: Retained for the lifetime of the survey or until deleted by you
Contact data: Retained until you delete contacts or close your account
Smart Survey sessions: Retained for the lifetime of the survey
AI analytics cache: 10-minute TTL for smart survey analytics, regenerated on demand
Export files: Stored temporarily in Cloudflare R2, deleted after download or 24 hours
Unsubscribed contact data: Retained for 180 days after unsubscription, then deleted
Audit logs: Retained for 3 years
Expired sessions and tokens: Deleted 30 days after expiry

9.2 Upon Termination

Upon termination of the Agreement, Revuloop will, at your choice, delete or return all Personal Data processed on your behalf within 30 days, and delete existing copies unless applicable law requires storage. You may export your data (responses, contacts, analytics) at any time before termination via the platform's export functionality or the API.

10. Audit Rights

Revuloop will make available to you all information necessary to demonstrate compliance with Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you. Such audits shall be subject to reasonable prior notice (minimum 30 days), conducted during normal business hours, and shall not unreasonably interfere with Revuloop's operations. You shall bear the cost of any audit. Revuloop may satisfy audit requests by providing relevant certifications, audit reports, or summaries from independent third-party assessments.

11. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Agreement. In no event shall either party's aggregate liability for all claims under this DPA exceed the amounts paid or payable by you to Revuloop in the 12 months preceding the claim.

12. Term and Termination

This DPA takes effect on the date you accept the Agreement (or, if applicable, when you first use the Services) and remains in effect until the Agreement terminates or expires. Sections relating to data deletion, liability, and audit rights survive termination.

Annex I: Details of Processing

Controller	You, the customer who uses Revuloop to create surveys and collect data
Processor	Revuloop LLC, 701 Tillery Street Unit 12, 3285, Austin, TX 78702, United States
Contact	support@revuloop.com
Subject Matter	Provision of the Revuloop survey platform and associated services
Duration	For the term of the Agreement between Controller and Processor
Nature of Processing	Collection, storage, retrieval, analysis, AI processing, customer-experience workflow processing, delivery to customer-connected integrations, export, and deletion of survey-related Personal Data
Purpose	To enable the Controller to create, distribute, and analyze surveys, manage contacts, and generate AI-powered insights
Data Subjects	Survey respondents, contacts/invitees, organization members, Smart Survey participants
Personal Data Types	Email, name, survey responses, IP address (hashed for anonymous), device/browser info, language, sentiment scores, conversation transcripts, SSO attributes, consent records, directory/HRIS attributes (department, job level, manager, external identifier), and customer-experience case and account data

Annex II: Authorized Sub-Processors

The following sub-processors are authorized to process Personal Data on behalf of the Controller:

Sub-Processor	Purpose	Location	Data Processed
Supabase (AWS)	Managed PostgreSQL database for all platform data	United States (AWS us-east-1)	All Personal Data stored in the platform
Vercel	Application hosting, serverless functions, edge network	United States (primary), global edge	All data in transit; transient request data
OpenAI	AI survey generation, Smart Survey conversations, AI analytics	United States	Survey prompts, response text, conversation history for AI processing
Stripe	Payment processing, subscription management, invoicing	United States	Billing email, customer ID, subscription details (no card numbers stored by Revuloop)
Resend	Transactional email delivery (SMTP) for survey invitations and notifications	United States	Recipient email addresses, email content
Cloudflare	R2 object storage for file uploads, exports, and partner branding assets	Global (auto-selected regions)	Uploaded files, exported reports (PDF/CSV/XLSX)
PostHog	Product analytics, session recordings, feature flags	United States (us.i.posthog.com)	Usage events, page views, anonymized user interactions
Rollbar	Error monitoring and exception tracking	United States	Error context (may include request metadata, user IDs)
Sanity	Content management system for marketing pages and help content	United States / EU	No customer Personal Data (marketing content only)
Inngest	Background job orchestration for analytics processing	United States	Job metadata, survey IDs, analytics processing events
Upstash	Redis for caching, rate limiting, and queueing	United States	Transient cache entries, rate-limit counters, queued job metadata

Native integrations that you choose to connect (such as HubSpot, Salesforce, Zendesk, Slack, Segment, Google Sheets, and Shopify) are not Revuloop sub-processors. When you enable an integration, data is transmitted to that third party as a controller-directed onward transfer, and the receiving platform acts under its own agreement with you.

Annex III: Standard Contractual Clauses

For transfers of Personal Data from the EEA, UK, or Switzerland to the United States, the parties incorporate by reference the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021.

Module 2 (Controller to Processor) applies. The following selections are made:

Clause 7: The optional docking clause IS included, allowing additional parties to accede to the SCCs.
Clause 9(a): OPTION 2 (General written authorization) is selected. The Processor shall inform the Controller of any intended changes to sub-processors with a minimum notice period of 30 days.
Clause 11: The optional language on independent dispute resolution IS NOT included.
Clause 13: The supervisory authority of the EU Member State in which the Controller is established shall act as competent supervisory authority. For UK transfers, the Information Commissioner's Office (ICO) is the competent authority. For Swiss transfers, the Federal Data Protection and Information Commissioner (FDPIC) is the competent authority.
Clause 17: OPTION 1 is selected. The SCCs shall be governed by the law of the EU Member State in which the Controller is established.
Clause 18(b): Disputes shall be resolved before the courts of the EU Member State in which the Controller is established.

For transfers from the United Kingdom, the International Data Transfer Addendum to the EU SCCs (issued by the ICO under Section 119A of the UK Data Protection Act 2018) is incorporated by reference.

For transfers from Switzerland, the SCCs apply with the modifications required by the FDPIC, including that references to the GDPR are understood as references to the FADP.

Annex IV: Technical and Organizational Security Measures

Access Control

Role-based access control (RBAC) with five levels: Owner, Admin, Member, Viewer, Responder
API key authentication with granular scoped permissions
Environment separation: LIVE and TEST API keys
Enterprise SSO support (SAML 2.0, OIDC) with JIT user provisioning
JWT-based session management
OAuth 2.0 integration (Google, GitHub)

Encryption

TLS/HTTPS for all data in transit
AES-256 encryption at rest (AWS/Supabase infrastructure)
bcrypt password hashing
SHA-256 hashing of IP addresses for anonymous surveys
HMAC-SHA256 webhook signature verification

Input Validation

Zod schema validation on all API inputs
Content sanitization to prevent XSS and injection attacks
Rate limiting per subscription tier (FREE: 60/min, PRO: 300/min, BUSINESS: 1,000/min)

Infrastructure Security

Security headers: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy
Database connection pooling with configurable timeouts
Automated daily backups with 7-day retention
Error monitoring via Rollbar (server and client)

Data Minimization

Anonymous survey responses (enabled by default): IP addresses hashed via SHA-256, browser details generalized to family name only, OS details removed, UTM/referrer data excluded. Survey administrators may disable anonymous mode per survey, in which case full metadata is retained
Webhook PII delivery is opt-in per subscription with explicit field selection
Expired sessions, tokens, and unsubscribed contacts subject to automated GDPR retention cleanup
AI analytics cache uses 10-minute TTL

Contact

For questions about this DPA or to exercise any rights under this agreement, please contact us at:

Email: support@revuloop.com

Address: Revuloop LLC, 701 Tillery Street Unit 12, 3285, Austin, TX 78702, United States