Data Processing Addendum

1. Status of this draft

This is a draft addendum for Mailwright at https://mailwright.tech. It is not signed, it does not name the operator, and it is not an approved data-processing agreement. Publish it only as a draft until a lawyer fills the blanks.

Not stated in the product, and not filled in by this draft: the operator’s legal name, registered address, governing law, and court. A lawyer has to supply them. Do not treat this page as a signed contract.

2. Parties

One party is the customer: the person or organization that creates a Mailwright account and uploads leads. The other party is the operator of this Mailwright deployment. The operator’s legal name and address are blank.

3. Subject matter

The customer uses Mailwright to store leads, prepare and send email through mailboxes the customer connects, record replies and delivery signals, and run the related workspace tools (approvals, suppression, bookings, and optional model drafts). This addendum is about personal data in that work. Account login and, when used, Stripe billing may be the operator’s own purposes. A lawyer should split those roles in the final text.

4. Instructions

The customer’s instructions are the settings they save and the actions they take: importing a list, connecting a mailbox, launching a campaign, approving a draft, and requesting an export or deletion. The operator processes campaign data to provide those features. The product does not contain a separate “instructions” form.

5. Data and people

• People: the customer’s users, and the leads and recipients in campaigns and bookings.
• Identity and account data: name, email, public username, company name, sign-in method.
• Campaign data: addresses, names, companies, custom fields, message content, verification results, send logs, opens, clicks, replies, suppression reasons.
• Mailbox secrets: SMTP passwords, IMAP app passwords, and OAuth tokens, encrypted at rest, omitted from exports.
• Support and product data: feedback tickets, chat messages, AI memory, writing preferences.
• Billing metadata when Stripe is configured: account email and plan. Not card numbers.

6. Duration

Processing lasts while the customer uses the workspace and while copies remain. The product does not define a statutory retention calendar. Sessions and one-time codes expire as described in the Privacy Policy. A deletion request records a timestamp and waits for the operator; it is not an automatic erase.

7. Security

Measures the software actually implements are listed in the privacy draft: password hashing, hashed session tokens, httpOnly production session cookies, Fernet encryption of mailbox secrets and OAuth tokens (mw1 prefix, key from the server secret), hashed one-time codes, and audit records for privacy export and deletion requests. No SOC 2, ISO, or penetration-test report is claimed.

8. Subprocessors

Providers the code is built to call are listed at Subprocessors. The customer chooses the mailbox host by connecting it. Google and Microsoft are involved when the customer uses those sign-in or mailbox features. DeepSeek is the default model endpoint when a key is configured. Stripe is involved only when billing keys are configured. PostgreSQL and Redis run as part of this deployment; the hosting vendor’s legal name is not in the product.

This draft does not promise a specific number of days of notice before a provider changes. When the list changes, the page date should change. A final addendum should say how customers hear about that.

9. International transfers

The place where the database is hosted, and the places where Google, Microsoft, DeepSeek, Stripe, and Google Fonts process data, are not stated as a legal transfer mechanism in the product. This draft does not attach standard contractual clauses or name a country of establishment. A lawyer has to add that if the law requires it.

10. Assistance

The customer can download the JSON export and submit a deletion request as described in the privacy draft. The operator’s support address is the default configured in the product. This draft does not promise a helpdesk response time other than the deletion message already returned by the product, and that message is unverified as a legal deadline.

11. Audits

There is no contractual audit right, no penetration-test portal, and no compliance certificate in the product. A customer may ask support what the software does. A final addendum can add an audit clause. This draft does not invent one.

12. Google API data

Gmail sending uses gmail.send only. Sign-in uses identity scopes only. IMAP inbox access is a separate app password, not a Gmail read scope. The Limited Use statement in the Privacy Policy is the draft disclosure for Google API data. Optional Calendar and Postmaster connections are separate and start only when the customer connects them.

13. Contact

Questions about this draft: support@nxtfluencez.com.