Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Collectly Terms of Service between you ("Controller") and Collectly, Inc. ("Processor"). It applies to the extent that Collectly processes Personal Data on your behalf when you use the A/R automation service.

Collectly processes two categories of data: (a) Customer Data — invoices, customer contact information, payment history, and dunning messages you provide or authorize us to pull from connected accounting systems; and (b) Service Data — telemetry, account information, and audit logs needed to operate the service.

Collectly processes Customer Data only on your documented instructions, including:

• Syncing invoices, customers, and payments from connected systems (QuickBooks, Xero, Stripe, Square, Plaid).
• Generating dunning messages and cash-flow forecasts using AI providers under strict no-retention terms.
• Sending emails and SMS on your behalf through Resend and Twilio.
• Storing Customer Data encrypted at rest for as long as your account is active.

Collectly uses the following sub-processors. You can subscribe to changes at dpa@getcollectly.app.

• Vercel — application hosting (US, EU region available).
• Neon / Supabase — managed Postgres (US, EU region available).
• Clerk — authentication and identity.
• Resend — transactional email delivery.
• Twilio — SMS delivery.
• OpenAI, Anthropic — AI message generation under no-retention API terms.
• PostHog — product analytics (no customer data sent).

You may select a data residency region (US or EU) at signup. For transfers from the EEA, UK, or Switzerland to a third country, Collectly relies on the European Commission's 2021 Standard Contractual Clauses (Module 2: Controller-to-Processor) and the UK International Data Transfer Addendum. A copy of the executed SCCs is available on request.

Collectly implements technical and organizational measures to protect Customer Data, including: TLS 1.2+ in transit, AES-256 at rest, org-scoped queries, role-based access via Clerk, audit logging of all state changes, and quarterly access reviews. The current security posture is published on our Security page.

Collectly will assist you in responding to data-subject requests (access, rectification, deletion, portability, objection) within 10 business days. You can also export or delete your data at any time from Settings → Data, and we provide a one-click full-account deletion that purges all Customer Data within 30 days (90-day soft-delete window for backup rotation).

Collectly will notify affected Controllers without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data breach affecting Customer Data. Notification will include the information required by GDPR Article 33(3) to the extent available.

On termination of your account, Collectly will delete all Customer Data within 30 days, except where retention is required by law (e.g. tax records, AML logs). Backups rotate on a 30-day cycle.