Draft for legal review. This is our plain-English draft and may change before it's final.
Data processing agreement
Last updated 11 November 2026
This agreement forms part of our terms of service. It covers your customers' personal data, which [Company name] processes for you when you use Yeply, as UK GDPR Article 28 requires.
1. Roles
You (the business) are the controller. [Company name] is the processor. We process your customers' data only on your documented instructions, which are: these terms, and how you set up and use Yeply.
2. What we process
- Who: your customers and potential customers.
- What: names, mobile numbers, email addresses, job type and price, invoice details, the messages sent, and their replies.
- Why: to send follow-ups and reminders you set up, forward replies to you, and show you what happened.
- How long: while your account is open, then deleted within 12 months of it closing, or sooner if you ask. Opt-out records (just the number or email) are kept so the person is never contacted again.
- No special category data. Please don't put health or similar information in notes.
3. Our commitments
- Act only on your instructions, and tell you if we think an instruction breaks the law.
- Make sure everyone with access is bound by confidentiality.
- Keep the data secure: stored in London, encrypted in transit and at rest, each account walled off from every other, and access limited and logged.
- Help you answer requests from your customers to see, correct or delete their data.
- Tell you without undue delay, and within 48 hours, if we become aware of a breach affecting your data.
- Help you with data protection impact assessments and the ICO if you need it.
- Delete or return the data when you close your account, unless the law requires us to keep it.
- Give you the information you need to show we meet these commitments, and allow a reasonable audit once a year on 30 days' notice.
4. Sub-processors
You agree we can use the companies below. Each is bound by a written contract with data protection terms at least as strong as these. We'll email you at least 30 days before adding or replacing one, and you can object; if we can't resolve it, you can cancel.
| Who | What for | What they get | Where |
|---|---|---|---|
| Supabase | Database and sign-in | All account, customer, quote, invoice and message data | London, UK |
| Cloudflare | Hosting the app | Requests passing through, not stored | Global network |
| The SMS Works | Sending and receiving texts | Customer mobile numbers and message text | UK |
| Resend | Sending emails | Email addresses and message text | United States |
| Stripe | Taking subscription payments | Your billing details (not your customers') | UK, EU and United States |
| Anthropic | Optional AI helpers: reading a quote you upload, reading a customer's reply | The quote document or reply text | United States |
5. Transfers outside the UK
Where a sub-processor handles data outside the UK, we rely on UK adequacy regulations (including the UK-US data bridge) or the ICO's international data transfer agreement or addendum.
6. Your commitments
You confirm you have a lawful basis to contact each customer you add, that messages relate only to their quote or invoice, and that you'll tell customers how their data is used (your own privacy notice can link to ours).
7. Contact
[Company name], [Registered address]. Data protection queries: [Contact email].