Data Processing Agreement
Last updated: 9 September 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between the business using Onebubbles (the "Customer", acting as data controller) and Onebubbles (the "Processor"). It governs the processing of personal data that Onebubbles carries out on the Customer's behalf when the Customer uses the service to communicate with its own end-users. It applies to the extent the GDPR (Regulation (EU) 2016/679) or an equivalent law applies to that processing.
1. Roles
For end-user conversation data, the Customer is the controller and Onebubbles is the processor. Onebubbles processes that data only on the Customer's documented instructions — which include the configuration choices made in the product and these terms — unless required otherwise by law, in which case Onebubbles will inform the Customer first (where legally permitted).
2. Subject matter, duration, nature & purpose
- Subject matter & duration: processing lasts for the term of the Customer's account, plus the short deletion window in section 8.
- Nature & purpose: receiving, routing, storing, displaying and helping reply to messages across the connected channels, including AI-assisted drafting and summaries, CRM context, and appointment booking.
3. Types of data & data subjects
- Data subjects: the Customer's end-users (customers, leads, contacts) and its own agents.
- Personal data: identifiers (name, email, phone, social handles), message content and attachments, and metadata (timestamps, channel, device/approximate location). The Customer must not send special-category data through the service.
4. Processor obligations
- Process personal data only on the Customer's documented instructions.
- Ensure people authorised to process the data are bound by confidentiality.
- Implement appropriate technical and organisational security measures (section 6).
- Assist the Customer, taking into account the nature of processing, with data-subject requests and with its obligations under Articles 32–36 GDPR.
- Not sell personal data and not use end-user message content to train third-party models.
5. Sub-processors
The Customer authorises Onebubbles to engage the sub-processors below, each bound by data-protection terms no less protective than this DPA. Onebubbles remains responsible for their performance and will give reasonable notice of any intended change, so the Customer can object on reasonable data-protection grounds.
| Sub-processor | Purpose | Region |
|---|---|---|
| Supabase | Database & authentication hosting | EU |
| Vercel | Application hosting & delivery | EU/US |
| Resend | Transactional & notification email | US |
| Stripe | Subscription billing | EU/US |
| Shopify | Store data sync & billing (if connected) | EU/US |
| Anthropic | AI-assisted replies & summaries | US |
| Meta Platforms | WhatsApp / Messenger / Instagram delivery (if connected) | EU/US |
| Telegram | Telegram message delivery (if connected) | International |
6. Security
Onebubbles maintains measures appropriate to the risk, including encryption in transit (TLS) and at rest, per-workspace isolation with row-level security, least-privilege and logged staff access, and an incident-response process. Onebubbles will notify the Customer without undue delay after becoming aware of a personal-data breach affecting the Customer's data, with the information the Customer needs to meet its own notification duties.
7. International transfers
Where a sub-processor processes personal data outside the EEA/Andorra, transfers are covered by an adequacy decision or the EU Standard Contractual Clauses (or equivalent safeguards). Andorra benefits from an EU adequacy decision.
8. Return & deletion
On termination the Customer may export its data from Settings → Account. Onebubbles then deletes or anonymises the personal data it processes for the Customer within 30 days, except where retention is required by law. Deleting the workspace triggers deletion across the underlying data stores.
9. Audit
Onebubbles will make available the information reasonably necessary to demonstrate compliance with this DPA and, on reasonable prior notice and subject to confidentiality, allow for and contribute to audits — satisfied where practicable through up-to-date documentation and third-party certifications of its sub-processors.
10. Governing law & contact
This DPA is governed by the law of the Principality of Andorra, consistent with the Terms of Service. Data-protection questions or requests: hola@onebubbles.com.
See also our Privacy Policy and Cookie Policy.