Legal · DPA
Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the contract between AutoRetry, Inc. ("Processor") and you, the account holder ("Controller"), and governs the processing of personal data under the General Data Protection Regulation (GDPR) and UK GDPR.
This DPA is automatically incorporated into your agreement with AutoRetry by accepting our Terms of Service. No separate signature is required. If you require a countersigned DPA for your legal team, email privacy@pingdunn.com.
Last updated: August 18, 2026
Who is the Controller and who is the Processor?
You (the SaaS founder / AutoRetry customer) are the Data Controller — you determine what data is collected from your subscribers and why.
AutoRetry is the Data Processor — we process your subscribers' personal data only on your documented instructions (sending recovery emails, tracking opens, logging payment events) and for no other purpose.
1. Subject Matter and Duration
AutoRetry processes personal data on your behalf solely for the purpose of providing payment recovery services as described in the Terms of Service. This DPA is effective for the duration of your AutoRetry subscription and terminates upon account closure.
2. Nature and Purpose of Processing
| Attribute | Detail |
|---|---|
| Nature of processing | Collection, storage, transmission (email delivery), and deletion of personal data |
| Purpose | Automated failed payment recovery — sending branded dunning emails and providing a hosted card-update portal |
| Types of personal data | Email addresses, customer names, Stripe customer IDs, failed payment amounts and dates, email open/click events |
| Categories of data subjects | End-subscribers of the Controller's SaaS or subscription product |
| Retention period | 24 months from last recovery event, then automatically purged (see Privacy Policy) |
3. Processor Obligations
AutoRetry agrees to:
- Process personal data only on documented instructions from the Controller (i.e., only as required to deliver the payment recovery service).
- Ensure that persons authorised to process the data are committed to confidentiality.
- Implement appropriate technical and organisational security measures (AES-256 encryption at rest, TLS 1.3 in transit, access controls).
- Not engage sub-processors without informing the Controller. The current authorised sub-processors are listed in Section 5.
- Assist the Controller in fulfilling data subject rights requests (access, erasure, portability) within reasonable timeframes.
- Notify the Controller without undue delay (and within 72 hours where feasible) upon becoming aware of a personal data breach.
- Delete or return all personal data to the Controller upon termination of the service, and delete existing copies unless EU/Member State law requires further retention.
- Make available all information necessary to demonstrate compliance with GDPR Article 28 obligations upon reasonable request.
4. Security Measures
Encryption at rest
AES-256 for all sensitive credentials and tokens
Encryption in transit
TLS 1.3 for all network communication
Access control
Role-based access, Clerk authentication
Database
Neon PostgreSQL with connection pooling and network isolation
Secret management
Environment variables, never stored in source code
Breach response
72-hour notification policy, documented incident process
5. Authorised Sub-processors
AutoRetry uses the following sub-processors. By accepting these Terms, the Controller provides general authorisation for the use of sub-processors listed below. AutoRetry will inform the Controller of any intended changes to this list.
| Sub-processor | Role | Location | GDPR Basis |
|---|---|---|---|
| Vercel Inc. | Application hosting | US (EU edge available) | SCCs |
| Neon Inc. | Database storage | US (AWS us-east-1) | SCCs |
| Clerk Inc. | Authentication | US | SCCs |
| Resend Inc. | Email delivery | US | SCCs |
| Stripe Inc. | Payment data source | US / EU | SCCs |
| Microsoft (Clarity) | Analytics (anonymized) | US | SCCs / Adequacy |
SCCs = Standard Contractual Clauses (EU approved mechanism for international data transfers).
6. International Data Transfers
AutoRetry's infrastructure is primarily located in the United States. For EU/EEA/UK data subjects, transfers to the US are conducted under Standard Contractual Clauses (SCCs) as adopted by the European Commission (Decision 2021/914). By using AutoRetry, the Controller instructs AutoRetry to make these transfers as necessary to provide the service.
7. Controller Obligations
The Controller agrees to:
- Have a lawful basis for collecting and sharing subscriber personal data with AutoRetry (e.g., legitimate interest in recovering failed subscription payments).
- Provide adequate privacy notices to their own subscribers explaining that a third-party processor (AutoRetry) may send recovery communications.
- Promptly inform AutoRetry of any data subject rights requests that require processor involvement.
- Not instruct AutoRetry to process data in a way that violates applicable law.
Need a countersigned DPA?
If your legal or procurement team requires a manually signed copy, email us and we'll arrange it within 2 business days.
Contact
Questions about this DPA? Email privacy@pingdunn.com.
See also our Privacy Policy and Terms of Service.