Data Processing Addendum

Maxon SDR DPA Summary

Engineering-authored policy draft pending the documented external legal review.

This summary describes the processor relationship and is not a substitute for the executed customer DPA.

Processing purpose

Maxon SDR processes customer-directed prospect, recipient, campaign, message, reply, suppression, and billing data to provide prospect search, reveal, sending infrastructure, scheduling, inbox, audit, and credit-metering services.

Sub-processors

• Stripe — payment processing and subscription billing
• Cloudflare — DNS, API delivery, and infrastructure protection
• Google Cloud — Cloud SQL prospect data hosting
• Contabo — VPS hosting for application and sending services
• Postal — outbound and inbound email delivery

Retention and deletion

• Campaign, message, and thread records: life of the workspace plus 30 days after deletion
• Revealed prospect access records: life of the workspace for billing reconciliation
• Suppression entries: 12 months after workspace deletion, then purged
• Stripe and Postal webhook event logs: 12 months
• Application logs: 30 days

Transfer mechanism

The executed DPA states the applicable international transfer mechanism and security commitments. EU customers should request the current DPA from support before production use.