Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the RightMessage Terms of Service and any other written agreement between RightMessage Inc, a Delaware C Corporation (“RightMessage”), and the customer that uses the RightMessage service (the “Customer”) (together, the “Agreement”). It applies whenever RightMessage processes Customer Personal Data on the Customer’s behalf.

The Customer accepts this DPA by accepting the Terms of Service or by using the Service. No signature is needed. A countersigned copy is available on request from support@rightmessage.com.

1. Definitions

• “Data Protection Law” means all laws on privacy and the processing of personal data that apply to the processing under this DPA, including the EU General Data Protection Regulation 2016/679 (“GDPR”); the UK GDPR and the UK Data Protection Act 2018 (“UK Data Protection Law”); the Swiss Federal Act on Data Protection (“FADP”); and US state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (“CCPA”), in each case as amended or replaced.
• “Customer Personal Data” means personal data that RightMessage processes on the Customer’s behalf in providing the Service, as described in Schedule 1.
• “Service” means the RightMessage service described in the Terms of Service, including the RightMessage script, dashboard, integration API, hosted pages, APIs, MCP server and AI-assisted features.
• “Subprocessor” means a third party that RightMessage engages to process Customer Personal Data.
• “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• “SCCs” means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (version B1.0, or any later version that replaces it).
• “Controller”, “processor”, “data subject”, “personal data”, “processing” and “supervisory authority” have the meanings given in Data Protection Law. Under the CCPA, “business”, “service provider”, “contractor”, “consumer”, “sell” and “share” have their CCPA meanings, and “controller” and “processor” include “business” and “service provider” respectively.

2. Roles and scope

2.1 The Customer is the controller of Customer Personal Data, or a processor acting for its own controller. RightMessage is the Customer’s processor, or its subprocessor where the Customer is a processor. Where the Customer is a processor, it confirms that its controller has authorized its instructions and the appointment of RightMessage.

2.2 RightMessage is an independent controller, and this DPA does not apply, for personal data it processes for its own purposes: account administration, billing, support, security and fraud prevention, its own marketing, and visitors to RightMessage’s own websites. Our Privacy Policy describes that processing.

2.3 The details of the processing (subject matter, duration, nature, purpose, types of personal data and categories of data subjects) are in Schedule 1.

3. Customer responsibilities

3.1 The Customer is responsible for having a lawful basis for the processing and for giving any notices and obtaining any consents required, including for cookies and similar technologies on its websites. The Service includes a consent-wait setting (TCF v2.2, Google Consent Mode, or a manual consent call). When it is on, the script stores nothing and sends no analytics until the visitor consents. The Customer decides whether to use it.

3.2 The Customer’s instructions must comply with Data Protection Law. The Customer decides which optional features collect more data. These include Email Watcher (which picks up email addresses typed into other forms on the Customer’s site and is off by default), connected email platforms and CRMs, lead alerts and AI-assisted features.

3.3 The Service is not designed to process special categories of personal data, data about children, or data about criminal convictions. The Customer will not configure the Service to collect that data unless it has determined it may lawfully do so.

4. Processing on instructions

4.1 RightMessage will process Customer Personal Data only on the Customer’s documented instructions, including about international transfers, unless law requires otherwise. In that case RightMessage will tell the Customer about the legal requirement before processing, unless the law prohibits it.

4.2 The Agreement, this DPA, and the Customer’s configuration and use of the Service are the Customer’s complete instructions. Additional instructions need written agreement.

4.3 RightMessage will tell the Customer promptly if it believes an instruction infringes Data Protection Law, and may suspend the affected processing until the instruction is confirmed or changed.

5. Personnel and confidentiality

RightMessage will limit access to Customer Personal Data to personnel and contractors who need it to provide, support or secure the Service. Each of them is bound by written confidentiality obligations or a statutory duty of confidentiality.

6. Subprocessors

6.1 The Customer gives RightMessage general written authorization to engage Subprocessors. The current Subprocessors are listed at rightmessage.com/subprocessors, which forms Schedule 3.

6.2 RightMessage will (a) carry out reasonable due diligence on each Subprocessor’s security and privacy practices before engaging it; (b) bind each Subprocessor by written contract to data protection obligations at least as protective as this DPA; (c) restrict each Subprocessor’s access to what it needs to provide its part of the Service; and (d) remain responsible to the Customer for each Subprocessor’s performance.

6.3 RightMessage will update Schedule 3 at least 30 days before a new Subprocessor starts processing Customer Personal Data, and will email Customers who have joined the subprocessor update list. To join it, email support@rightmessage.com.

6.4 The Customer may object to a new Subprocessor on reasonable data protection grounds by writing to support@rightmessage.com within that 30-day period. The parties will discuss the objection in good faith. RightMessage may offer a change to the Service or the Customer’s configuration that avoids the new Subprocessor. If the parties cannot resolve the objection within 30 days of receiving it, the Customer may terminate the affected part of the Service by written notice, and RightMessage will refund any prepaid fees for the unused period. This is the Customer’s sole remedy for an objection.

6.5 Where a Subprocessor must be replaced urgently for security or continuity reasons, RightMessage may make the change at once and give notice as soon as possible. The objection right in section 6.4 still applies.

7. Security

7.1 RightMessage will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as Article 32 GDPR requires. Schedule 2 describes the current measures.

7.2 RightMessage may update its measures, provided the overall level of protection is not reduced.

7.3 RightMessage does not currently hold a SOC 2 or ISO 27001 report. It maintains documented security policies and controls, described in Schedule 2, and will answer reasonable security questionnaires (section 10).

8. Security Incidents

8.1 RightMessage will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident.

8.2 The notice will describe, as far as then known: the nature of the incident; the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it; and a contact for more information. RightMessage will send further information as it becomes available.

8.3 RightMessage will take reasonable steps to contain, investigate and remediate the incident, and will reasonably help the Customer meet its own obligations to notify supervisory authorities and data subjects.

8.4 Notice will go to the Customer account owner’s email address. Notice is not an admission of fault or liability.

9. Assistance and data subject requests

9.1 Taking into account the nature of the processing and the information available to it, RightMessage will provide reasonable assistance to the Customer (a) through appropriate technical and organizational measures, as far as possible, in responding to requests from data subjects to exercise their rights; and (b) with the Customer’s obligations on security, Security Incident notification, data protection impact assessments and prior consultation with supervisory authorities.

9.2 If a data subject contacts RightMessage directly about Customer Personal Data, RightMessage will forward the request to the Customer without undue delay and will not respond itself, except to direct the data subject to the Customer or where law requires.

9.3 RightMessage may charge a reasonable fee for assistance that goes beyond the Service’s standard features, unless the assistance is needed because of RightMessage’s own breach of this DPA.

10. Information and audits

10.1 RightMessage will make available the information reasonably needed to demonstrate compliance with this DPA and Article 28 GDPR.

10.2 RightMessage will first meet audit requests by answering a written security and privacy questionnaire (for example, CAIQ Lite or SIG Lite), providing relevant policies and its architecture and data-flow description, and, where it has them, independent reports, all under confidentiality. RightMessage will answer a reasonable questionnaire within 30 days.

10.3 If that information is not enough to demonstrate compliance, or a supervisory authority requires it, the Customer (or an independent auditor it appoints, who is bound by confidentiality and is not a competitor of RightMessage) may audit, including by inspection. The audit must take place on at least 30 days’ written notice, no more than once in any 12-month period (unless a supervisory authority requires otherwise or after a Security Incident), during normal business hours, under an agreed scope, and in a way that protects other customers’ data and RightMessage’s security. Each party bears its own costs, unless the audit reveals a material breach of this DPA by RightMessage.

11. Deletion and return

11.1 During the Agreement, the Customer can ask RightMessage to delete Customer Personal Data by writing to support@rightmessage.com from the account owner’s email address.

11.2 After the Agreement ends, on the Customer’s written request, RightMessage will delete Customer Personal Data or, where reasonably practicable, return a copy of it in a commonly used format, at the Customer’s choice.

11.3 Production database snapshots are kept for 7 days, and Customer Personal Data in them is removed as they expire. RightMessage also retains a copy of its database from before its September 2026 move to Laravel Cloud, with backups of that copy (see Schedule 3). Customer Personal Data in backups and retained copies stays protected by this DPA until it is deleted.

11.4 RightMessage may keep Customer Personal Data where law requires it, and will keep protecting it under this DPA. On request, RightMessage will confirm in writing what it has deleted.

12. AI-assisted features

12.1 Some features (for example, the Righty assistant, summaries, lead alerts and page generation) send Customer Personal Data to model providers through the Subprocessors listed in Schedule 3. This happens only to perform the feature the Customer uses.

12.2 RightMessage will not use Customer Personal Data to train, fine-tune or improve AI models, and will not let its Subprocessors do so. RightMessage’s OpenRouter account has prompt logging turned off and Zero Data Retention routing turned on, so requests are routed only to model provider endpoints that do not retain them.

12.3 RightMessage may record metadata about AI feature use (such as model, tokens, cost and latency, and truncated inputs and outputs for quality and debugging) under this DPA.

13. US state privacy laws (CCPA and similar)

13.1 Where the CCPA or a similar US state law applies, RightMessage acts as the Customer’s service provider, contractor or processor. The Customer discloses Customer Personal Data to RightMessage only for the limited and specific business purposes in Schedule 1 (providing website personalization, segmentation, forms, flows, analytics, integrations and the related features the Customer uses).

13.2 RightMessage will not: (a) sell or share Customer Personal Data; (b) retain, use or disclose it for any purpose other than those business purposes, including any commercial purpose, except as the CCPA permits; (c) retain, use or disclose it outside the direct business relationship with the Customer; or (d) combine it with personal data RightMessage receives from other sources or collects from its own interactions with the consumer, except as the CCPA permits.

13.3 RightMessage will comply with the CCPA’s obligations that apply to it and give the same level of privacy protection the CCPA requires of businesses. That includes reasonable security under California Civil Code section 1798.81.5 and helping the Customer respond to consumer requests.

13.4 The Customer may take reasonable and appropriate steps to make sure RightMessage uses Customer Personal Data consistently with the Customer’s CCPA obligations (including the questionnaires and audits in section 10). On notice, the Customer may also take reasonable steps to stop and remediate unauthorized use.

13.5 RightMessage will tell the Customer if it decides it can no longer meet its obligations under the CCPA. RightMessage certifies that it understands and will comply with this section 13.

14. International transfers

14.1 RightMessage and its Subprocessors process Customer Personal Data mainly in the United States. Content delivery and edge processing take place at the Cloudflare location nearest each visitor. Schedule 3 gives each Subprocessor’s location.

14.2 Where Customer Personal Data subject to the GDPR, UK Data Protection Law or the FADP is transferred to RightMessage in a country without an adequacy decision, the following are incorporated into this DPA by reference:

• EU transfers: the SCCs. Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) where it is a processor. The Customer is the data exporter and RightMessage the data importer. The Clause 7 docking clause applies. For Clause 9, Option 2 (general written authorization) applies, with the notice period in section 6.3. The optional wording in Clause 11 does not apply. For Clauses 17 and 18, the SCCs are governed by Irish law and disputes go to the courts of Ireland. The competent supervisory authority under Clause 13 is determined by the Customer’s establishment or representative. Schedules 1, 2 and 3 complete Annexes I, II and III.
• UK transfers: the SCCs as amended by the UK Addendum. Table 1 is completed with the party details in Schedule 1; Table 2 with the modules and options above; Table 3 by Schedules 1, 2 and 3. For Table 4, either party may end the UK Addendum as its Section 19 allows. The UK Addendum is governed by the laws of England and Wales.
• Swiss transfers: the SCCs as above, with references to the GDPR read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority; and “member state” not read to stop data subjects in Switzerland from bringing claims where they habitually reside.

14.3 RightMessage will put appropriate safeguards (such as the SCCs, the UK Addendum, or an adequacy mechanism such as the EU-US Data Privacy Framework where the recipient is certified) in place for onward transfers to Subprocessors.

14.4 If a transfer mechanism is invalidated or suspended, the parties will cooperate to put a valid alternative in place.

15. Government and law enforcement requests

If a public authority asks RightMessage for access to Customer Personal Data, RightMessage will (a) redirect the authority to the Customer where possible; (b) notify the Customer promptly unless the law prohibits it; (c) review the request’s legality and challenge it where it reasonably concludes there are grounds to; and (d) disclose only the minimum the request lawfully requires. RightMessage will handle requests covered by the SCCs as Clause 15 of the SCCs requires.

16. Aggregated and de-identified data

RightMessage may create aggregated or de-identified data from its provision of the Service, as the Privacy Policy describes, only if that data does not identify, and cannot reasonably be used to identify, any individual, the Customer or the Customer’s websites. RightMessage will take reasonable measures to keep it de-identified, will publicly commit not to re-identify it, and will not try to. Such data is not Customer Personal Data.

17. General terms

17.1 Term. This DPA lasts as long as RightMessage processes Customer Personal Data for the Customer.

17.2 Order of precedence. If this DPA conflicts with the Terms of Service or Privacy Policy about Customer Personal Data, this DPA prevails. If it conflicts with the SCCs or UK Addendum, those prevail.

17.3 Liability. Each party’s liability under this DPA is subject to the limitations of liability in the Terms of Service, as far as Data Protection Law and the SCCs allow.

17.4 Changes. RightMessage may update this DPA to reflect changes in law, the Service or its Subprocessors, provided updates do not reduce the overall protection of Customer Personal Data. RightMessage will post the new version here with its date and a summary in the version history below, and will keep earlier versions available on request. Material changes will be announced to account owners by email at least 30 days in advance, unless the law requires a faster change.

17.5 Governing law. Except where the SCCs, the UK Addendum or Data Protection Law require otherwise, this DPA is governed by the laws of the State of Delaware.

Schedule 1: Details of processing

Parties

• Data exporter (controller or processor): the Customer, as identified in its RightMessage account. Contact: the account owner’s email address. Activities: using the Service to personalize, test and measure its websites and marketing.
• Data importer (processor): RightMessage Inc, a Delaware C Corporation with its registered agent in Delaware. Contact for privacy matters: support@rightmessage.com. Activities: providing the Service.

Subject matter, duration and frequency

• Subject matter: providing the Service to the Customer under the Agreement.
• Duration: the term of the Agreement, then until deletion under section 11.
• Frequency: continuous, for as long as the Customer uses the Service.

Categories of data subjects

• Visitors to Customer websites and hosted pages where the RightMessage script or hosted pages are used.
• People who submit RightMessage forms, flows, quizzes, surveys or other widgets on Customer websites.
• The Customer’s subscribers, contacts, leads and customers whose records are looked up in, or synced with, email platforms, CRMs or other services the Customer connects.
• The Customer’s own users of the RightMessage dashboard, to the extent their data is processed for the Customer rather than for RightMessage’s own purposes.

Categories of personal data

• Online identifiers: RightMessage visitor identifiers stored in first-party cookies or browser storage on the Customer’s domain, and IP addresses.
• Device and browser information, and approximate location derived from IP address (country, region, city).
• Website activity: pages viewed, referrers, campaign and UTM parameters, the campaign or test version shown, widget and form interactions, and conversions.
• Contact details and identifiers: email address, name, and contact or subscriber IDs from connected platforms, captured after an identification event (a RightMessage form submission, a supported third-party form, a click on an identifying email link, or an email URL parameter).
• Form, flow, quiz and survey responses, including free-text answers.
• Data from connected platforms the Customer enables: tags, custom fields, segments and purchase data.
• Segment assignments, scores and lead-alert assessments derived from the above.
• Content the Customer submits to AI-assisted features.
• Integration request logs: what was sent to a connected platform, its response, status and timing (these contain what visitors submitted).

Special categories of data

None intended (section 3.3).

Nature and purpose of processing

Collecting, storing, combining and analyzing the data above to provide the Service on the Customer’s instructions. That covers: recognizing returning visitors after an identification event; segmenting visitors; personalizing and A/B testing website content; running forms, flows, quizzes and surveys; looking up and syncing contacts with platforms the Customer connects; lead alerts; reporting and analytics; AI-assisted features; and support, security, troubleshooting and service maintenance.

Retention (current defaults)

Competent supervisory authority

As Clause 13 of the SCCs determines; the UK Information Commissioner for UK transfers; the Swiss Federal Data Protection and Information Commissioner for Swiss transfers.

Schedule 2: Technical and organizational security measures

RightMessage does not currently hold a SOC 2 or ISO 27001 report. The measures below are in place and documented in RightMessage’s written security policies (Information Security, Access Control and Termination, Data Classification, Incident Response, Business Continuity and Disaster Recovery, Change Management, Key Management, Personnel Security and Vendor Management).

Architecture and hosting

• The Service runs on managed cloud infrastructure (Laravel Cloud on AWS in the US East region, and Cloudflare). The providers’ physical, network and infrastructure controls apply.
• The integration API (form submissions and contact lookups) runs in a separate environment from the dashboard, public API and background workers. Both use a managed MySQL database and Valkey cache on a private network. The database is not publicly accessible.
• Published scripts are compiled per project and stored as immutable revisions in Cloudflare R2. Cloudflare Workers deliver them, separately from the application.
• The Customer’s own web pages are never proxied through RightMessage in the standard installation.

Encryption

• All traffic between browsers, the Service and connected platforms uses HTTPS (TLS 1.2 or higher).
• Workstations used to access production use full-disk encryption and system passwords.

Access control

• Access to production systems and Customer Personal Data is limited to personnel and contractors who need it, on a least-privilege basis, and is removed when no longer needed.
• Multi-factor authentication is required for administrative access to the production platform, company email, version control and cloud infrastructure.
• Shared credentials are kept in a company password manager. Production secrets are stored encrypted (SOPS) or in the hosting providers’ environment configuration, never in source code.
• Customer email platform and CRM credentials are stored on RightMessage’s servers. They are never included in the script that visitors download.
• Customers control who can access and publish in their own account.

Application security and change management

• All code changes go through version control with review. Production releases run only after automated checks pass for the release commit: linting, type checks, static analysis, and front-end, browser and back-end test suites.
• GitHub provides dependency and code scanning. Vulnerability scans are run and findings remediated.
• Both production environments are deployed from the same commit. Database migrations are written to stay backward-compatible during a release.
• Secret keys are scrubbed from error reports before they leave the application.
• Abuse controls include rate limits, bot protection on registration (Cloudflare Turnstile) and alerting on suspicious invitation activity.

Monitoring and incident response

• Error, performance and uptime monitoring (Sentry, Laravel Nightwatch and uptime checks) with alerting.
• A written incident response policy covers detection, triage, containment, root-cause analysis, notification (section 8) and post-incident review.

Backup and continuity

• The production database has automated scheduled snapshots, kept for 7 days. A written business continuity and disaster recovery policy covers restoration.
• If the application or database is unavailable, published scripts keep loading from Cloudflare storage, and visitors’ pages still render.

Data minimization and customer controls

• Visitors become known only after an identification event. Another device stays anonymous until it is identified too.
• Customers can make the script wait for cookie consent (TCF v2.2, Google Consent Mode, or a manual consent call). Until then it stores nothing and sends no analytics.
• Email Watcher (capture of email addresses typed into other forms) is off by default.
• Analytics data expires on the retention schedule in Schedule 1.

Vendor management

• Subprocessors are reviewed before onboarding (including their SOC 2 reports and DPAs, where available) and are bound by written data protection terms (section 6).

People

• Personnel and contractors with access to Customer Personal Data are bound by confidentiality obligations (section 5).

Schedule 3: Subprocessors

The current list of Subprocessors, with what each one does and where it processes data, is at rightmessage.com/subprocessors.

Version history

• Version 2 (November 4, 2026): Subprocessor notice extended to 30 days with an opt-in email list; subprocessor list moved to its own page and completed (adding Elastic, DigitalOcean, SnapShooter, Anthropic, Google, OpenAI, Bento, Laravel Nightwatch, Stripe and Google Workspace); new US state privacy law (CCPA), AI features and retention terms; more detailed security measures; and governing law set to the laws of the State of Delaware.
• Version 1 (October 1, 2026): First published version.

Version: November 4, 2026