Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Exostack SARL (SIREN 922 481 981, "Exostack") and the Customer. It applies to the personal data that the Customer's apps and systems send to Carillon ("Device Data") and implements Article 28 of Regulation (EU) 2016/679 ("GDPR"). Terms defined in the GDPR have the same meaning here.

1. Roles

The Customer is the controller of Device Data, or a processor acting for its own client, in which case Exostack is a sub-processor and the Customer passes on the obligations below. Exostack processes Device Data as the Customer's processor.

2. Subject matter, duration, nature and purpose

Exostack processes Device Data to provide Carillon for the duration of the contract: registering devices, storing their attributes, resolving the audiences the Customer targets, scheduling and sending notifications through APNs and FCM, recording delivery traces and reported opens, producing the statistics shown to the Customer and counting Monthly Reachable Devices for billing.

3. Data subjects and categories of data

Data subjects: the users of the Customer's mobile apps whose devices are registered, and any person the Customer identifies in the data it sends.

Categories of personal data:

• push tokens issued by APNs or FCM, and a digest of the installation secret the SDK generates;
• the external identifier the Customer assigns to a user;
• tags, as key and value pairs set by the Customer;
• locale and IANA timezone;
• platform, environment, app version and build, bundle identifier, operating system version, notification permission status and SDK version;
• opt-in status, registration, last activity and invalidation dates, and the reason a provider gave for invalidating a token;
• notification content (title, body and data payload) and audience definitions;
• delivery traces: per-device delivery status, attempts, timestamps and provider responses;
• open events reported by the app for a delivery;
• monthly presence records used to count reachable devices;
• CSV files the Customer imports, as uploaded.

The Customer must not send special categories of personal data unless it has a lawful basis and the processing is necessary.

4. Instructions

Exostack processes Device Data only on the Customer's documented instructions. The Terms, this DPA, and the Customer's use of the API, the dashboard, the hosted MCP endpoint and the command-line tool constitute those instructions, including sending notifications to APNs and FCM. Exostack informs the Customer if it considers that an instruction infringes data protection law, unless the law prohibits it.

5. Confidentiality

Exostack ensures that the persons it authorizes to process Device Data are bound by confidentiality and access it only as needed to operate the service or answer the Customer.

6. Security

Exostack implements the measures described in the annex below and keeps them appropriate to the risk.

7. Sub-processors

The Customer gives Exostack general authorization to engage sub-processors. The current list is published at /legal/subprocessors. Exostack notifies the owners of each organization by email of planned additions or replacements, allowing the Customer an opportunity to object on reasonable data protection grounds before the new sub-processor processes Device Data. If the objection cannot be resolved, the Customer may terminate the affected service before the change takes effect. Exostack imposes on each sub-processor data protection obligations equivalent to this DPA and remains responsible for it.

8. Delivery providers

APNs and FCM are designated by the Customer, which holds the Apple Developer account and the Firebase project whose credentials it uploads. Exostack transmits the push token and the notification payload to them on the Customer's instruction. Their processing is governed by the Customer's agreements with Apple and Google, and may take place outside the European Union.

9. Assistance

Taking into account the nature of the processing, Exostack assists the Customer:

• with requests from data subjects, primarily through the API: the Customer can find devices by external identifier, export them, and delete them;
• with data protection impact assessments and prior consultations, by providing the information in this DPA and in the documentation;
• with personal data breaches: Exostack notifies the Customer without undue delay after becoming aware of a breach affecting Device Data, with the information available under Article 33(3) GDPR, and supplements it as it becomes available.

10. Retention, return and deletion

Data	Retention
Devices and their attributes	Until the Customer deletes them through the API, or the account is closed
Delivery traces and open events	At least 30 days. Whole monthly partitions are removed after the applicable retention window, so retention can extend by up to one additional calendar month, plus the daily cleanup interval. Longer periods agreed in separate written contracts may extend retention of shared partitions.
Idempotency records	24 hours, purged daily
Deduplication records	30 days, purged daily
Imported CSV files	Deleted when the import completes or is marked failed; import counts and the processing report remain available in the dashboard
Technical logs and traces	7 days
Database backups	14 days

During the contract the Customer can export devices and read delivery traces through the API. After termination, the Customer has 30 days of read-only access to export its data through the available API and dashboard features. New sends, registrations, imports and other changes are disabled. Exostack deletes Device Data from active systems within 30 days after that export window ends, unless the law requires its retention. Residual copies in database backups expire within a further 14 days.

11. Information and audits

Exostack makes available the information necessary to demonstrate compliance with Article 28 GDPR and allows for audits by the Customer or an auditor it mandates, subject to reasonable notice, confidentiality and frequency. Existing documentation is used first. Routine audits are limited to once in any twelve-month period, with at least 30 days’ written notice, during normal business hours and at the Customer’s expense. Audits must minimize disruption and protect other customers’ data. These limits do not prevent additional audits required by a supervisory authority, applicable law, or reasonable evidence of a personal data breach or material non-compliance.

12. International transfers

Exostack and its sub-processors store and process Device Data in the European Union. Device Data leaves the European Union only when Exostack sends a notification to APNs or FCM on the Customer's instruction, as described in section 8.

13. Liability

Each party's liability under this DPA is subject to the limitations of the Terms of Service, except where the law does not permit such a limitation.

Annex: security measures

• Hosted in Europe. The API, dashboard, worker, database, key management, secret storage and observability are hosted by Scaleway in the European Union.
• Network isolation. The database has no public endpoint and is reachable only on a private network. The worker exposes no public endpoint.
• Tenant isolation. Every query goes through a repository that requires the tenant derived from the API key or the session, never from a request parameter. PostgreSQL row-level security, forced on the tables that hold devices, campaigns, deliveries and provider credentials, applies a second, independent barrier. The application never connects to the database as a superuser.
• Encryption of provider credentials. APNs keys and Firebase service accounts are envelope-encrypted with Scaleway Key Manager before storage. The API can only encrypt and the worker can only decrypt. Credentials are never returned by the API after upload and are redacted in logs.
• Secrets and keys. Database passwords and signing secrets are stored in Scaleway Secret Manager, not in configuration files. API keys are stored as digests; secret keys are shown once.
• Transport and sessions. Traffic is encrypted with TLS. Dashboard sessions use __Host- prefixed, Secure, HttpOnly, SameSite=Lax cookies bound to the dashboard host. Passwords are stored as salted one-way hashes.
• Access control. Organization roles restrict who can manage members, keys, credentials and billing. Mobile keys cannot send, list devices or read traces.
• Abuse protection. Rate limits apply per key and per IP address.
• Backups. The database is backed up daily; backups are hosted in the European Union and retained for 14 days.