Legal

Data Processing Agreement

Last updated: October 10, 2026. This DPA applies when Valotrace processes personal data on behalf of a customer (the studio). It forms part of the Terms of Service and applies automatically to customers who accept them. To get a countersigned copy, email us at the address in section 12.

1. Definitions

"Data Protection Laws" means laws that apply to the processing of personal data under the Terms, including the GDPR, UK GDPR, and the CCPA/CPRA. "Controller", "processor", "personal data", "processing", "data subject", "personal data breach" and "service provider" have the meanings given in those laws. "Customer Personal Data" means personal data in Customer Data (mainly player device tokens, identifiers, message events, experiment assignments and any attributes the customer sends) that Valotrace processes for the customer. "Subprocessor" means a third party Valotrace engages to process Customer Personal Data.

2. Roles and scope

For Customer Personal Data, the customer is the controller (or processor for its own client) and Valotrace is the processor (or service provider). The subject matter, duration, nature, purpose, data types and data subjects are described in Annex I. This DPA does not cover data for which Valotrace is the controller, such as customer account data and website analytics, which the Privacy Policy covers.

3. Customer instructions

• Valotrace will process Customer Personal Data only on the customer's documented instructions, which are the Terms, this DPA, and the customer's use of the Service (dashboard, API and SDK settings).
• Valotrace will tell the customer if it believes an instruction violates Data Protection Laws, and may pause that processing until resolved.
• Valotrace will not sell Customer Personal Data, share it for cross-context behavioral advertising, retain or use it outside the direct business relationship, or combine it with other personal data, except as the law allows for a service provider.
• The customer is responsible for the lawfulness of its instructions, for providing notices, and for obtaining any consents needed to message players.

3a. Customer data is kept separate

Valotrace will not use one customer's Customer Personal Data to send messages for, or build models for, another customer.

4. Confidentiality and personnel

Valotrace ensures that people authorized to process Customer Personal Data are bound by confidentiality duties and access it only as needed to provide the Service.

5. Security

Valotrace maintains technical and organizational measures appropriate to the risk, including those in Annex II. Valotrace may update them if the overall level of protection is not reduced.

6. Subprocessors

• The customer gives general authorization to use the Subprocessors in Annex III.
• Valotrace will give customers at least 14 days' notice (by email or in the product) before adding or replacing a Subprocessor. The customer may object on reasonable data protection grounds within that period. If the parties cannot resolve it, the customer may stop using the affected part of the Service and terminate it without penalty.
• Valotrace will bind Subprocessors to data protection terms no less protective than this DPA and remains responsible for their performance.

7. Data subject requests and assistance

Valotrace will, taking into account the nature of the processing, help the customer respond to data subject requests (access, correction, deletion, export, objection). If Valotrace receives a request directly about Customer Personal Data, it will refer the person to the customer and not respond itself unless the law requires. Valotrace will also reasonably help with data protection impact assessments and consultations with regulators, at the customer's reasonable cost where the help goes beyond what is normally provided.

8. Personal data breaches

Valotrace will notify the customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, the nature of the breach, the data affected, likely consequences, and the steps taken or proposed. Valotrace will take reasonable steps to contain it and will keep the customer updated. Notice is not an admission of fault.

9. Return and deletion

On request during the term, Valotrace will let the customer export Customer Personal Data. After the agreement ends, or earlier on the customer's written request, Valotrace will delete Customer Personal Data within a reasonable period (and in any event within 90 days), except where the law requires retention. Copies in backups are deleted as backups expire on their normal schedule and are not used for any other purpose in the meantime.

10. Audits and information

Valotrace will make available the information reasonably needed to show it is complying with this DPA, and will answer reasonable security questionnaires. If that is not sufficient, or a regulator requires it, the customer may audit once a year on at least 30 days' written notice, during business hours, under confidentiality, without disrupting operations, and at the customer's cost. Audits will not extend to other customers' data.

11. International transfers

• The customer authorizes Valotrace to process Customer Personal Data in the United States and in the locations used by the Subprocessors in Annex III.
• Where Customer Personal Data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the parties agree to the European Commission's Standard Contractual Clauses (Module 2, customer to processor; Module 3 where the customer is itself a processor), which are incorporated by reference. For these clauses: Clause 7 (docking) applies; Clause 9(a) uses option 2 (general authorization) with the notice period in section 6; Clause 11 optional language does not apply; Clause 17 selects Irish law and Clause 18 the courts of Ireland; and Annexes I to III below serve as the clause annexes. For UK transfers the UK International Data Transfer Addendum applies, and for Swiss transfers the clauses apply with references adapted to Swiss law.
• If a transfer mechanism is invalidated, the parties will work in good faith to put in place an alternative.

12. General

This DPA lasts as long as Valotrace processes Customer Personal Data. If it conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails. Each party's liability under this DPA is subject to the limits in the Terms, except where the law (or the Standard Contractual Clauses) does not allow. Notices and requests: ishaan.verma@valotrace.com.

Annex I: Description of processing

• Data exporter (controller): the customer named in its account or order form.
• Data importer (processor): Valotrace, San Francisco, California, USA.
• Data subjects: the customer's players and app users.
• Categories of data: device tokens; player or device identifiers the customer supplies; message events (sent, delivered, opened, dismissed) and timestamps; experiment arm assignments and assignment probabilities; player attributes the customer chooses to send; IP addresses in request logs.
• Sensitive data: none intended. The customer must not send special-category data or data about children below the applicable age of consent without telling us first.
• Purpose: sending and measuring messages, running holdout experiments, reporting lift, and securing and supporting the Service.
• Frequency and duration: continuous, for the term of the agreement plus the deletion period in section 9.
• Competent supervisory authority: the authority of the EU member state where the customer is established (or its representative is, or its data subjects are), and the UK ICO for UK transfers.

Annex II: Security measures

• Encryption in transit (TLS) for the API and website.
• Provider credentials the customer stores (such as Apple Push keys) are encrypted at rest.
• Passwords hashed with argon2id; server-side sessions with HttpOnly cookies and a limited lifetime.
• Machine API keys must be scoped to a specific app, and requests for another customer's app are rejected.
• Databases (Redis, ClickHouse) are on an internal-only network, not exposed to the internet.
• No default credentials; services refuse to start without configured keys.
• Access to production is limited to staff who need it, and secrets are kept out of source control.
• Holdout and propensity records are logged for every send decision, giving an audit trail of what was sent and why.

Annex III: Subprocessors

• Hetzner Online GmbH: infrastructure hosting for the API and databases (all Customer Personal Data).
• Apple Inc. (APNs): delivery of push notifications to iOS devices (device tokens and message content), using credentials the customer provides.
• Google LLC (Gemini): generation of suggested message variants. Receives customer briefs and message text only. It does not receive player data.
• Vercel Inc.: hosts the static website and proxies API requests (request metadata).

Microsoft Clarity, Umami and Formspree handle website visitor and contact form data for Valotrace as controller. They are listed in the Privacy Policy and are not Subprocessors of Customer Personal Data.