Data Processing Agreement
Last updated November 9, 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Out of Box Solutions (“Processor”) and the customer that uses ReveIQ (“Customer”). It applies when we process personal data on the Customer's behalf, under laws including the EU and UK GDPR, Canada's PIPEDA and US state privacy laws.
1. Scope and roles
The Customer is the controller of personal data contained in the store data it connects to ReveIQ and in its team member records. Out of Box Solutions processes that data as a processor (service provider), only to provide ReveIQ.
2. Details of processing
| Subject matter | Providing ReveIQ analytics for the Customer's App Store and Google Play apps |
|---|---|
| Duration | For the term of the agreement, then until deletion under section 9 |
| Nature | Collection from Apple and Google, storage, aggregation, display, and posting review replies the Customer writes |
| Data subjects | People who review the Customer's apps; the Customer's team members |
| Personal data | Reviewer nicknames, countries, ratings and review text; team member names, email addresses and roles |
| Special categories | None intended. Review text is free text written by reviewers and may occasionally contain anything. |
Aggregated, non-personal metrics (download counts, crash rates and similar) are not personal data and are covered by the Terms of Service.
3. Instructions
We process personal data only on the Customer's documented instructions, which are these terms and the Customer's use of ReveIQ, unless the law requires otherwise. We will tell the Customer if we believe an instruction breaks applicable data protection law.
4. Confidentiality
Everyone at Out of Box Solutions with access to personal data is bound by confidentiality obligations.
5. Security measures
- Encryption in transit (TLS) for all traffic.
- Store credentials encrypted at rest in a secrets vault, readable only by server-side code.
- Database row-level security isolating each workspace's data.
- Role-based access in the product; only owners and admins can disconnect stores or delete data.
- Access to production systems limited to people who need it.
6. Sub-processors
The Customer authorizes these sub-processors. Each is bound by data protection terms at least as protective as this DPA. We will notify account owners by email at least 14 days before adding or replacing a sub-processor, and the Customer may object on reasonable data protection grounds by cancelling before the change takes effect.
| Provider | Purpose | Location | Data |
|---|---|---|---|
| Supabase | Database, sign-in, and encrypted storage of your App Store Connect and Google Play keys | Canada (ca-central-1) | All account, workspace and synced store data |
| Vercel | Hosting the application and running scheduled syncs | United States | Data passing through requests; server logs including IP address |
| Stripe | Subscription billing and payment processing | United States | Billing contact, payment method (held by Stripe), subscription status |
| Resend | Sending account and team-invitation email | United States | Recipient email address, email content |
| DeepSeek | Writing the daily AI summary (Pro plan only) | People's Republic of China | Aggregated app metrics only (counts, rates, averages). No names, email addresses, review text or credentials. |
Apple and Google are not our sub-processors: the Customer has its own agreements with them, and we access their services with the Customer's credentials.
7. International transfers
Personal data is stored in Canada and may be processed in the United States by the providers listed above. Where a transfer needs a legal mechanism, such as from the EU or UK, the parties rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), which are incorporated by reference. Personal data is not sent to DeepSeek; only aggregated metrics are.
8. Assistance and breaches
- We help the Customer respond to data subject requests, as far as the service allows.
- We notify the Customer without undue delay, and within 72 hours of confirming it, of a personal data breach affecting Customer data, with the information the Customer needs to meet its obligations.
- We provide information reasonably needed for data protection impact assessments.
9. Deletion
The Customer can delete store data at any time by disconnecting a store or using Delete all data. When the agreement ends, we delete Customer personal data within 30 days, except where the law requires us to keep it. Copies in encrypted backups are deleted when those backups expire.
10. Audits
On request, and no more than once a year unless required by a regulator or after a breach, we will answer reasonable written questions about our compliance with this DPA.
11. Order of precedence
If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA applies.