Data Processing Agreement

Parties and acceptance

Controller (data user): the Customer (you), as identified in your Messo account.
Processor: Lifecycle Innovations Limited, operating Messo. Hong Kong (BR# 76545088), 144-151 Connaught Road West, Unit 4005, 40/F, Hong Kong.

This DPA forms part of our Terms of Service and applies automatically when you use the Messo send API. You accept it by creating an account or calling the API. For a countersigned copy or negotiated variations, contact [email protected].

1. Subject, duration, and instructions

The Processor processes Personal Data on behalf of the Controller solely to provide the Messo service described in the Terms of Service: linking the Controller's WhatsApp numbers, transmitting messages submitted through the API, delivering webhooks, and operating the developer console.

• The Controller's API calls and console actions are its documented instructions. The Processor processes Personal Data only on those instructions.
• If the Processor believes an instruction would breach applicable data-protection law, it will inform the Controller promptly and may suspend the affected processing until the instruction is clarified.
• Duration: while the service is active, plus the retention and deletion windows in our Privacy Policy.

2. Categories of data subjects and personal data

• Data subjects: (a) recipients of messages the Controller sends through the API; (b) senders of inbound messages to the Controller's linked numbers; (c) the Controller's own staff granted console access.
• Categories of personal data: phone numbers; message content (text and media, outbound and inbound); conversation metadata (timestamps, delivery receipts, error codes); encrypted WhatsApp session auth state for linked numbers.
• Special-category data: only if data subjects voluntarily include it in messages. The Controller is responsible for a lawful basis (GDPR Art. 9) and for complying with applicable restrictions.

3. Processor obligations

• Process Personal Data only on the Controller's documented instructions, and not for the Processor's own purposes. No content mining, profiling, or model training on Controller data.
• Ensure persons authorized to process the data are bound by confidentiality obligations.
• Implement appropriate technical and organizational measures (section 6), taking into account the state of the art, the costs, and the nature, scope, and risks of the processing.
• Not keep Personal Data longer than necessary for the purposes of processing, and take all practicable steps to prevent unauthorized or accidental access, processing, erasure, loss, or use — including by contractual terms imposed on sub-processors (PDPO DPP 2(3) and DPP 4(2)).
• Assist the Controller, by appropriate technical and organizational measures, in fulfilling data-subject requests and in meeting its obligations around security, breach notification, and data-protection impact assessments.

4. Sub-processors

The Controller gives general authorization for the Processor to engage the following sub-processors:

• Render — Frankfurt (EU) infrastructure hosting.
• Cloudflare — DNS, CDN, and edge caching.
• Clerk — authentication and account identity.
• Stripe — billing and payment processing (account and payment data only; no message data).
• Sentry — error monitoring, configured to scrub message bodies and phone numbers.
• Transactional email provider — service emails such as receipts and alerts.

We notify the Controller at least 30 days before adding or replacing a sub-processor that handles Personal Data. The Controller may object in writing on reasonable data-protection grounds; if the change is essential to the service and the objection is maintained, the Controller may cancel before the change takes effect.

5. International transfers

Controller data is stored in the EEA (Render Frankfurt). For transfers outside the EEA — including access from Hong Kong by Lifecycle Innovations Limited for support and account management — the parties rely on the European Commission's Standard Contractual Clauses (Commission Implementing Decision 2021/914):

• Module 2 (controller to processor) for Personal Data the Processor handles on the Controller's behalf;
• Module 1 (controller to controller) for account data where Messo acts as controller.

The clauses are incorporated into this DPA by reference, with the optional docking clause included. The parties will complete the annexes on request.

6. Security measures

• Encryption in transit (TLS) and at rest (Postgres; pgcrypto for session auth state).
• API keys stored hashed and never logged; per-endpoint webhook signing secrets.
• Tenant isolation: one Controller's sessions, messages, and keys are never visible to another.
• Role-based access controls; MFA-protected admin access.
• Log scrubbing: no message bodies or full phone numbers in application logs or error reports.
• Encrypted backups with defined retention; deletion propagates to backups within 30 days.

7. Breach notification

The Processor notifies the Controller without undue delay, and within 72 hours, of any confirmed personal-data breach affecting Controller data, providing the information reasonably necessary for the Controller's own notification duties (including GDPR Art. 33). Where the breach is likely to result in a real risk of harm, the Processor also supports notification to Hong Kong's Privacy Commissioner and affected individuals per the Commissioner's guidance.

8. Data subject rights

The Processor assists the Controller in fulfilling data-subject requests (access, correction/rectification, erasure, restriction, portability, objection) through tenant export and deletion tools in the console. Requests received directly from data subjects are forwarded to the Controller without undue delay; the Processor acts on its own copies as instructed.

9. Audit rights

The Controller may audit the Processor's compliance with this DPA once per calendar year, on 30 days' written notice, during business hours, at the Controller's cost, in a manner that does not unreasonably disrupt operations. Routine assurance is provided through our current security documentation and sub-processor list.

10. Return and deletion

On termination of the service, the Processor deletes Controller Personal Data within the windows in our Privacy Policy (message bodies 30 days; metadata 12 months), or returns it on the Controller's written request made within 30 days of termination — except where law requires longer retention (e.g. tax records).

11. Liability

Each party's liability under this DPA is subject to the limitation of liability in section 10 of the Terms of Service. Nothing here limits liability that cannot be limited under applicable law.

12. Contact

Data-protection questions: [email protected].