Data Processing Agreement
Last updated 2026-09-24. Part of the Terms of Service for every subscription, under Article 28 GDPR.
1. Parties and roles
The Customer is the controller. OkayAgent, operated by Mohamed El Hadrami, Nouakchott, Mauritania is the processor for personal data the Customer sends through OkayAgent.
2. Subject and duration
- Nature and purpose: holding actions proposed by the Customer's automations, notifying approvers, recording decisions, returning them to the Customer's workflows.
- Data subjects: the Customer's staff, the Customer's clients and their approvers, and people named in action payloads (for example end customers of a refund).
- Data categories: names, email addresses, action text and payloads sent by the Customer, amounts, decisions, timestamps. The Customer should not send special-category data (health, biometrics and similar) through the Service.
- Duration: the subscription, plus up to 30 days for deletion.
3. Processor obligations
- Process personal data only on the Customer's documented instructions, which are the Customer's configuration of the Service and these terms.
- Ensure anyone with access is bound by confidentiality.
- Apply the security measures in section 5.
- Help the Customer answer data subject requests and meet its obligations under Articles 32 to 36 GDPR, as far as the Service allows.
- Notify the Customer without undue delay, and within 72 hours at most, after becoming aware of a personal data breach affecting its data.
- At the end of the subscription, delete the Customer's data within 30 days, or return it as a CSV export on request before deletion.
- Make available the information needed to show compliance with this agreement, and answer reasonable audit questionnaires.
4. Sub-processors
The Customer authorises these sub-processors. We will announce any new sub-processor by email at least 14 days in advance; the Customer may object and cancel if we cannot resolve the objection.
| Provider | Purpose | Location |
|---|---|---|
| Render Services, Inc. | Application hosting and database storage | Hosting region |
| Whop, Inc. | Billing, subscriptions and "Sign in with Whop" | United States |
| Resend, Inc. (transactional email) | Sending approval, reminder and alert emails | United States / EU |
| Slack Technologies, LLC | Only if you add a Slack webhook in Settings | United States |
International transfers rely on Standard Contractual Clauses offered by each provider.
5. Security measures
- HTTPS for all traffic; signed, expiring links for approvals; confirmation page before any decision.
- Per-client agent keys that can be revoked; each client's approvers only see that client's actions.
- HMAC-signed callbacks with timestamps; outgoing callbacks blocked towards private networks.
- Audit log of decisions, key changes and settings changes.
- Access to production limited to the operator; secrets stored as environment variables, not in code.
6. Contact
Requests, breach contacts and questions: the support chat on the OkayAgent page on Whop.