JDSquid
Log in Join waitlist
Legal

Data Processing Agreement

Last updated: October 10, 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between JDSQUID LLC (“JDSquid”) and the customer who uses the Service (“Customer”). It applies whenever JDSquid processes personal data on Customer’s behalf, and is accepted by accepting the Terms.

1. Roles

For personal data of Customer’s buyers and visitors processed in the Service, Customer is the controller and JDSquid is the processor, within the meaning of the EU General Data Protection Regulation (“GDPR”) and the UK GDPR.

The payment processor that Customer connects, such as Stripe or Inflowpay, acts under its own agreement with Customer and is not a sub-processor of JDSquid.

2. Details of processing

  • Subject matter: provision of the JDSquid Service to Customer.
  • Duration: the term of the Terms, plus the deletion period in section 8.
  • Nature and purpose: hosting and running Customer’s conversion flows, recording the steps visitors complete, selecting among offers Customer has approved, sending follow-ups configured by Customer, analytics, and pre-launch compliance review.
  • Data subjects: Customer’s buyers and the visitors of Customer’s conversion flows.
  • Categories of data: identification and contact data (name, email address), order data (products, amounts, status, but never full card numbers), technical data (IP address, device, browser) and interaction data (traffic source, steps completed, time on page).
  • Special categories: none. Customer must not submit special categories of personal data to the Service.

3. JDSquid’s obligations

JDSquid will:

  • process personal data only on Customer’s documented instructions, which are the Terms, this DPA and Customer’s configuration of the Service, and inform Customer if it believes an instruction infringes the law;
  • ensure that everyone authorized to process the data is bound by confidentiality;
  • implement the security measures described in section 4;
  • help Customer respond to requests from data subjects exercising their rights, and with data protection impact assessments and prior consultations where required;
  • notify Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer’s data, with the information Customer needs to meet its own obligations;
  • make available the information needed to demonstrate compliance with this DPA, and allow one audit per year on 30 days’ written notice, at Customer’s cost, or provide an equivalent third-party report where available.

4. Security measures

  • Encryption of data in transit (TLS) and at rest.
  • Access restricted to authorized personnel on a least-privilege basis, with multi-factor authentication.
  • Logging and monitoring of access to production systems.
  • Regular backups and tested restoration procedures.
  • Vulnerability management and timely security updates.
  • A documented incident response procedure.

5. Sub-processors

Customer authorizes JDSquid to use sub-processors. The current sub-processors are Cloudflare, Inc. (hosting and content delivery, United States), Amazon Web Services, Inc. (email delivery through Amazon SES, United States) and Anthropic, PBC (AI models, United States).

JDSquid will notify Customer at least 30 days before adding or replacing a sub-processor. Customer may object on reasonable data protection grounds; if the parties cannot resolve the objection, Customer may terminate the affected part of the Service. JDSquid imposes data protection obligations on each sub-processor equivalent to this DPA and remains liable for their performance.

6. International transfers

JDSquid is established in the United States. Transfers of personal data from the European Economic Area, the United Kingdom or Switzerland are governed by the Standard Contractual Clauses adopted by the European Commission (Module 2, controller to processor, and Module 3, processor to processor, as applicable), with the UK International Data Transfer Addendum and the Swiss amendments where relevant. These clauses are incorporated by reference, with Customer as data exporter and JDSquid as data importer.

7. Customer’s obligations

Customer is responsible for having a lawful basis for the processing, for giving buyers and visitors the information required by law, including a privacy notice and any cookie consent in its flows, and for ensuring that its instructions comply with applicable law.

8. End of processing

When the Terms end, Customer can export its data for 30 days. After that period, JDSquid deletes Customer’s personal data, including copies, unless the law requires it to keep them.

9. Liability and order of precedence

Each party’s liability under this DPA is subject to the limitations in the Terms, to the extent permitted by law. In case of conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Terms on data protection matters.

10. Contact

JDSQUID LLC, 125 S King Street, Suite 2A, Jackson, WY 83001, United States · [email protected]. A countersigned copy of this DPA is available on request.