# Data processing agreement

How Seleya Labs processes a company's mail on its behalf, for every company that owns addresses on Seleya Address.

This agreement is part of the [terms](https://address.seleya.ai/legal/terms/) for every company that owns addresses on Seleya Address ("the Customer"), from the moment the company is authorised. A company that wants a signed copy can ask at support@seleya.ai.

## 1. Roles

- The Customer is the controller (under POPIA, the responsible party) of the personal data in its mail and in its addresses' settings. Seleya Labs Inc. ("Seleya") is its processor (under POPIA, its operator).
- Seleya is itself responsible for account, billing, security and abuse data, and for the service's own observations described in the [privacy note](https://address.seleya.ai/legal/privacy/). This agreement doesn't cover those.

## 2. What Seleya does

- Seleya processes Customer personal data only to provide Seleya Address, on the Customer's documented instructions: the terms, the Customer's settings, and the calls its people, apps and agents make. Seleya tells the Customer if it believes an instruction breaks the law.
- Annex A sets out the processing.
- Seleya doesn't sell Customer personal data or train models on it, and no model reads stored mail on its side.
- Message content is never pooled. The service's own observations, with identifiers removed, may be pooled as the terms describe, and the Customer can stop future pooling at any time.

## 3. People and security

- Everyone at Seleya who can reach Customer personal data is bound to confidentiality in writing.
- Seleya keeps the measures in Annex C, and keeps them at least as strong as they are on the date of this agreement.

## 4. Sub-processors

- The Customer authorises the sub-processors in Annex B.
- Seleya gives the Customer 30 days' notice by email before adding or replacing one. The Customer may object on reasonable data protection grounds within that time. If no workable solution is found, the Customer may end the affected service and receive a refund of prepaid fees for the rest of the year.
- Seleya binds each sub-processor to data protection terms at least as protective as these, and remains responsible for them.

## 5. Help with rights and duties

Seleya helps the Customer answer people's requests to see, correct, export or delete their data, and helps with impact assessments and regulators' questions, as far as the service allows. Requests that reach Seleya about the Customer's mail are passed to the Customer.

## 6. Security incidents

Seleya tells the Customer without undue delay, and within 72 hours of becoming aware, of a security incident affecting Customer personal data; under POPIA, as soon as there are reasonable grounds to believe the data was accessed or acquired by someone unauthorised. The notice says what happened, which data and people are affected, and what Seleya is doing about it, and Seleya keeps the Customer informed.

## 7. Transfers

- Customer mail and the database are stored in the EU, in AWS's Frankfurt region. Seleya's team works in South Africa and Seleya Labs is a US company, so the data may be reached from both. Cloudflare's network carries web and API traffic worldwide.
- Transfers out of South Africa rely on binding agreements under POPIA section 72(1)(a). Where the GDPR applies to the data and a transfer is restricted, the parties sign the applicable module of the EU Standard Contractual Clauses, with the UK Addendum where UK law applies, before that processing begins.

## 8. Audits

Seleya gives the Customer the information needed to show it meets this agreement. Once a year, on 30 days' written notice, the Customer or an independent auditor bound to confidentiality may audit Seleya during business hours, and more often after a security incident or when a regulator requires it. Each party pays its own costs. Seleya holds no SOC 2 or ISO 27001 certification today.

## 9. When the agreement ends

- While the agreement runs, Seleya deletes specific Customer personal data within 30 days of the Customer's request.
- When it ends, the Customer may ask for an export within 30 days. Seleya then deletes the remaining Customer personal data within 30 days of delivering the export or of the window closing, unless the law requires it to keep some. Backups expire within 35 days.

## 10. Liability and law

Liability under this agreement is subject to the limits in the terms (section 10), including the higher limit for breaches of this agreement. This agreement follows the terms' governing law, except where signed Standard Contractual Clauses require otherwise. Where this agreement and the terms differ on personal data, this agreement governs.

## Annex A. The processing

| | |
|---|---|
| Subject matter | Providing Seleya Address to the Customer: addresses for its agents, and receiving, checking, storing, delivering and sending their mail |
| Duration | The agreement, then the deletion period in section 9 |
| Nature and purpose | Receiving, parsing, judging the sender, screening, storing, delivering to the Customer's agents and apps, sending, and keeping the records needed to do so |
| People concerned | People who correspond with the Customer's addresses, and the Customer's staff who hold addresses, administer them or approve actions |
| Personal data | Names and email addresses; message headers, text and attachments; contacts built from correspondence; sender checks and verdicts; settings and approvals |
| Special categories | Not intended. The Customer decides what its mail contains, and doesn't use the service for special categories of personal data unless the law allows it |

## Annex B. Sub-processors

| Sub-processor | What it does | Where |
|---|---|---|
| Amazon Web Services | Receiving, storing and sending mail; the database; the service's functions and queues | Frankfurt, Germany |
| Cloudflare, Inc. | DNS, the website, and the network that carries API and MCP traffic | Global network |
| Stripe | Payments and billing | USA and EU |
| Google (Google Workspace) | Support email, when the Customer writes to support@seleya.ai | USA and global |

## Annex C. Security measures

- Mail is stored encrypted (server-side encryption, AES-256) with public access blocked, and the database is encrypted at rest.
- Connections to the website, the API and the MCP server are encrypted. The mail domains publish MTA-STS and DNSSEC, and sign with DKIM under SPF and a DMARC policy of reject.
- The service runs in its own AWS account, with production and staging apart and least-privilege roles.
- Each company sends under its own sending tenant, so one company's reputation can't harm another's.
- People sign in by email link or passkey. Apps sign in by OAuth 2.1 with PKCE; access tokens last an hour and refresh tokens rotate. Keys, tokens and links are stored only as hashes.
- Loosening a protection takes a person's approval, never an agent's.
- The database is backed up daily, and backups are kept 35 days.
- Alarms watch for failures and unusual activity, and a daily reconciliation checks that no message is lost or doubled.
- Owners and cardholders are screened against the official sanctions lists.
- Everyone with access is bound to confidentiality.