Data processing agreement

1. Parties and scope

This agreement supplements the terms of use where MAXKEN, at Bureau 3, 34 place du Général de Gaulle, 59800 Lille, France, processes personal data for the customer identified by the account or its organisation. The customer is the controller or an authorised processor acting for its client; MAXKEN is its processor or subprocessor. These provisions take precedence on customer-data processing.

Account administration, billing, security and public-site analytics are separate controller activities described in the privacy policy. This agreement is not a certification or a guarantee that every customer use is lawful.

2. What we process and for how long

• Purpose and operations: receive, store, organise, search, display and delete project messages; send replies and the notifications or assistant responses the customer enables.
• People: website visitors, email correspondents, customers, prospects, client contacts and authorised inbox members.
• Data: names, contact details, message subjects and content, conversation identifiers, timestamps, read and delivery status, and the form fields the customer supplies.
• Duration: while the service is used, subject to the plan’s retention period, deletion instructions and the end-of-service provisions below. Processing is continuous or repeated as messages and requests arrive.

The service is intended for ordinary contact and support correspondence. It is not designed for collecting special-category data, criminal records, payment-card details, passwords or regulated health records. Do not deliberately configure those uses without a separate assessment and an appropriate written agreement.

3. Customer instructions

The agreement and the customer’s settings, requests and deletion actions are documented instructions. We process customer data only on those instructions, including transfers, unless applicable EU or Member State law requires otherwise. We inform the customer of such a requirement before processing unless the law prohibits this. We promptly flag an instruction we consider unlawful.

We do not sell customer message data or use it for our own advertising or AI-model training.

The customer establishes its legal basis, informs correspondents, answers their requests and is authorised to supply the data and appoint processors. It controls forms, shared access, notification recipients and assistant permissions. Additional instructions can be sent to Show email address ; material changes to the service require a separate agreement.

Enabling Slack, Discord, a webhook or an MCP assistant instructs us to transmit the relevant data to that recipient. The customer must assess that provider, access rights and any international transfer. Revocation stops future access or deliveries where technically possible; it does not recall completed transfers or replies already being sent.

4. Confidentiality and security

People authorised to access customer data must be bound by confidentiality and limited to their duties. We apply measures appropriate to the risk under GDPR Article 32 and review them as the service changes.

• HTTPS on public application endpoints, password hashing and email verification.
• Authenticated workspace access, server-side ownership and role checks, and permission checks for assistant tools.
• Request limits, notification-destination checks and administrative audit records.
• Restricted infrastructure access and encrypted off-site Postal backups, with recovery procedures.

These measures do not provide end-to-end encryption, guaranteed email delivery or a contractual uptime level. We remain responsible for the security obligations that apply to us.

5. Subprocessors and transfers

The customer gives general written authorisation for these service providers to perform the described processing, subject to equivalent data-protection obligations. MAXKEN remains responsible for its subprocessors’ performance under this agreement.

• OVH SAS, France: application, database and mail infrastructure hosting. Postal is software operated on that infrastructure, not a separate recipient company.
• Cloudflare: HTTPS proxying for the application, including form submissions and inbox requests, DNS and CDN delivery of public assets; routing incoming project emails and their contents through Email Routing. APIs and private pages bypass shared caching.
• Scaleway SAS, France: storage of encrypted off-site Postal backups.

Provider country identifies the company, not an assurance that all access occurs there. Provider contacts and privacy information are linked in the provider list. We provide information about relevant entities, processing locations and safeguards on request. A transfer outside the EEA requires an applicable adequacy decision or appropriate GDPR Chapter V safeguards; this agreement alone is not a transfer mechanism.

We give at least 30 days’ written notice before adding or replacing a subprocessor. The customer may object on reasonable data-protection grounds before the change. We seek a resolution; if none is available, the affected processing must end before that provider receives the customer’s data, with reimbursement of prepaid unused affected service.

Customer-selected notification and assistant providers are the customer’s recipients. Stripe and Google provide separate account or billing services; their presence does not authorise them to receive project message content.

6. Requests, incidents and assistance

Taking account of the processing and available information, we assist with data-subject requests, security obligations, impact assessments and prior consultation. Requests concerning customer content are relayed to the customer; we do not answer on its behalf without instructions unless required by law.

After becoming aware of a personal-data breach affecting customer data, we notify the customer without undue delay. We provide available information about the incident, affected data and people, likely effects, mitigation and a contact, with updates as the investigation progresses. The customer decides on notifications to authorities and individuals; we assist with the information we hold.

7. Information and audit

We make available the information needed to demonstrate these obligations and allow and contribute to audits, including inspections by the customer or its mandated auditor. Contact Show email address to agree proportionate arrangements that protect other customers, confidentiality and service security. These arrangements do not prevent an audit required by law or a competent authority.

8. Return and deletion

At the end of processing, the customer chooses return or deletion of its personal data, and deletion of existing copies, unless EU or Member State law requires storage. Request return before deleting the account or before the plan’s automatic expiry: we assist with a copy in a usable electronic form. This does not promise a self-service export feature.

Free inbox messages follow the 30-day retention and paid-to-Free grace period explained in the retention policy. Postal transport records have separate seven-day content and 30-day metadata limits. Billing or claims records retained on a separate legal basis are restricted to that purpose.

Backup copies may remain for up to two years under the current backup policy. They must remain isolated from ordinary use, limited to authorised recovery, and expire within that maximum period. If a backup is restored, prior deletion instructions must be reapplied. We assess earlier erasure requests under applicable law; the backup policy does not override mandatory deletion rights.

Ending access does not remove copies already transmitted to customer-selected recipients. The customer handles those copies under its own agreements.