Data processing addendum

Effective 11 November 2026

The short version

You are the controller of your customers’ data; Compenra is your processor and acts only on your instructions.
This addendum is part of our terms and applies automatically — there is nothing to sign. A countersigned copy is available on request.
We tell you about a personal data breach within 72 hours, and give 30 days’ notice before adding a sub-processor.

01Scope and definitions

This data processing addendum (“DPA”) forms part of the terms of service between you (“Customer”) and Fix Vise LLC (“Compenra”). It applies whenever Compenra processes personal data on your behalf in providing the service.

Data protection laws means the laws that apply to the processing of personal data under this DPA, including the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act (“CCPA”).
Customer personal data means personal data that Compenra processes on your behalf, as described in Annex I.
“Controller”, “processor”, “data subject”, “personal data”, “processing” and “personal data breach” have the meanings given in the GDPR, and include the equivalent terms in other data protection laws.

02Roles of the parties

You are the controller of Customer personal data (or a processor acting for your own clients), and Compenra is your processor (or sub-processor). You are responsible for having a lawful basis for the processing, for the notices you give to the people you message, and for the instructions you give us.

Compenra is a separate controller of the limited data described in our privacy policy, such as your account and billing details.

03Processing on your instructions

Compenra processes Customer personal data only on your documented instructions. Your instructions are the terms, this DPA, and the way you configure and use the service — the channels you connect, the knowledge you provide and the limits you set for your agents.

We will tell you if we believe an instruction breaks data protection law, and we may pause that processing until it is resolved. If the law requires us to process Customer personal data in another way, we will tell you first unless the law forbids it.

We will not:

sell Customer personal data, or share it for cross-context behavioural advertising;
keep, use or disclose it for any purpose other than providing the service to you;
combine it with personal data from other sources, except as needed to provide the service;
use it to train shared or general-purpose AI models.

04Confidentiality

Everyone at Compenra who is authorised to process Customer personal data is bound by a duty of confidentiality, and has access only to what they need for their role.

05Security

Compenra maintains the technical and organisational measures in Annex II to protect Customer personal data against accidental or unlawful destruction, loss, alteration, and unauthorised disclosure or access. We may update these measures, but never in a way that lowers the overall level of protection.

06Sub-processors

You give Compenra general authorisation to use sub-processors. The current list is on our sub-processors page.

We give at least 30 days’ notice before a new sub-processor starts processing Customer personal data, by updating that page and emailing account owners.
You may object on reasonable data protection grounds within that period. We will work with you to find a solution, and if we cannot, you may end the affected service and receive a refund for the unused part of the period.
We bind each sub-processor by a written contract with data protection obligations at least as protective as this DPA, and we remain responsible for what they do.

07Requests from individuals

The service lets you find, export, correct and delete Customer personal data yourself. If an individual sends a request about your data to Compenra directly, we will pass it to you without responding to it ourselves, unless the law requires otherwise, and give you reasonable help in answering it.

08Personal data breaches

Compenra will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer personal data. The notice will describe what happened, the data and people likely to be affected, and what we are doing about it — with updates as we learn more. We will take reasonable steps to contain and fix the breach and will help you meet your own notification duties.

09Assessments and regulators

Taking into account the nature of the processing and the information available to us, Compenra will give you reasonable help with data protection impact assessments and with consultations with regulators that relate to your use of the service.

10International transfers

Compenra may process Customer personal data in the United States and in other countries where it or its sub-processors operate. Where data protection law restricts a transfer, the following apply and are incorporated into this DPA:

EEA transfers: the European Commission’s Standard Contractual Clauses (Decision 2021/914), Module Two where you are a controller and Module Three where you are a processor. Clause 7 (docking) applies; Clause 9 uses general written authorisation with the notice period in this DPA; the optional wording in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of Ireland. Annexes I to III of this DPA complete the annexes to the Clauses.
UK transfers: the UK International Data Transfer Addendum to those Clauses, completed with the information in this DPA.
Swiss transfers: the same Clauses, read so that references to the GDPR include the Swiss Federal Act on Data Protection and the Swiss regulator is the competent authority.

If the Clauses and this DPA conflict, the Clauses take priority.

11Data from Meta, Google and TikTok

Data that reaches Compenra through a platform you connect is also subject to that platform’s rules. In particular, Compenra handles information received from Google APIs in line with the Google API Services User Data Policy, including its Limited Use requirements, and data received from Meta and TikTok in line with their platform terms. The details are in the privacy policy.

12Information and audits

Compenra will make available the information reasonably needed to show that it complies with this DPA, including answers to a written security questionnaire, no more than once a year.

Where that is not enough to meet your obligations under data protection law, you may carry out an audit, yourself or through an independent auditor bound by confidentiality, on at least 30 days’ written notice, during business hours, at your own cost, and without access to other customers’ data.

13Return and deletion

You can export or delete Customer personal data at any time through the service. For 30 days after your account ends, we will provide an export on request. We then delete Customer personal data from live systems within 30 days and from backups within 90 days, unless the law requires us to keep it — in which case we keep it isolated and protected.

14US state privacy laws

Where the CCPA or a similar US state law applies, Compenra acts as your service provider or processor. It processes Customer personal data only for the business purpose of providing the service, complies with the obligations those laws place on service providers, and will tell you if it can no longer meet them. You may take reasonable steps to stop and remedy any unauthorised use.

15Liability, priority and term

Liability. Each party’s liability under this DPA is subject to the limits in the terms of service, except where data protection law does not allow liability to an individual to be limited.
Priority. On data protection matters this DPA takes priority over the terms of service.
Term. This DPA applies for as long as Compenra processes Customer personal data.
Signed copy. This DPA applies automatically as part of the terms. For a countersigned copy, write to hello@compenra.com.

16Annex I — Details of the processing

Item	Description
Data exporter	The Customer, as identified in its account. Role: controller, or processor for its own clients.
Data importer	Fix Vise LLC (Compenra), 8765 Royalwood Dr, Fort Worth, TX 76131-3371, USA. Contact: hello@compenra.com. Role: processor.
Subject matter and purpose	Providing AI agents that read and reply to messages, book appointments and update connected tools on the Customer’s behalf.
Nature of the processing	Collection, storage, organisation, analysis by AI models, generation and transmission of replies, and deletion.
Data subjects	People who contact, or are contacted by, the Customer through a connected channel; the Customer’s team members.
Categories of personal data	Names, usernames and platform identifiers; phone numbers and email addresses; message content and attachments; appointment details; order details where a store or shop is connected; any other data a person chooses to send.
Special categories	None intended. The service is not designed for special categories of data, and the Customer agrees not to use it to collect them.
Frequency and duration	Continuous, for the term of the agreement and the deletion periods in this DPA.
Competent supervisory authority	The authority for the EU member state where the Customer is established; otherwise the Irish Data Protection Commission.

17Annex II — Security measures

Measure	What it means
Encryption everywhere	Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256.
Protected credentials	The access tokens that link your Meta, Google and TikTok accounts are encrypted separately, are never shown in the app, and are revoked and deleted when you disconnect.
Workspace isolation	Each customer’s data is logically separated, and every request is checked against the workspace it belongs to.
Least-privilege access	Only staff who need production access to do their job have it, with multi-factor authentication, and their access is logged and reviewed.
Minimal permissions	We request the narrowest platform permissions that a feature needs, and you choose which Pages, mailboxes, calendars and sheets are connected.
Monitoring and testing	We log security-relevant events, patch dependencies, and test our systems for vulnerabilities.
Backups and recovery	Data is backed up in encrypted form and restoration is tested.
Vetted providers and people	Sub-processors are assessed before we use them, and everyone with access to data is bound by confidentiality obligations.

Helping you with requests and incidents

The service includes search, export and deletion tools for Customer personal data, and Compenra maintains an incident response process that covers detection, containment, notification and review.

18Annex III — Sub-processors

The sub-processors authorised at the effective date are those listed on the sub-processors page, which is updated as described in this DPA.