Data Processing Agreement

1. Roles of the parties

As between MiniMoth ("we", "us", "Processor") and you ("Customer", "Controller"), the parties acknowledge that:

• For End-User Personal Data — phone numbers, OTP records, session data, and identity records described in our Privacy Policy — Customer is the Controller and MiniMoth is the Processor, processing that data only on Customer's documented instructions. Customer's instructions are given by the API calls, dashboard configuration (including which regions or identity features are enabled), and integrations Customer chooses to use.
• For Developer Account Data — Customer's own account, billing, and project-configuration data — MiniMoth is an independent Controller, as described in our Privacy Policy.

2. Details of processing

• Subject matter: provision of the MiniMoth OTP delivery and session-management API.
• Duration: for the term of the Terms, and thereafter for the retention periods set out in our Privacy Policy.
• Nature and purpose: generating, delivering, and verifying one-time passcodes over WhatsApp and/or SMS; issuing and validating session tokens; recognising a returning end-user across logins where Customer has enabled that capability.
• Categories of personal data: phone numbers; OTP codes (stored only as irreversible hashes); session and refresh tokens (stored only as irreversible hashes); a persistent identifier linked to a phone number, where Customer has enabled that capability.
• Categories of data subjects: Customer's own end-users.

3. Processor obligations

MiniMoth will:

• Process End-User Personal Data only on Customer's documented instructions, unless required to do otherwise by law applicable to MiniMoth, in which case MiniMoth will inform Customer of that legal requirement before processing, unless the law prohibits this.
• Ensure that personnel authorised to process End-User Personal Data are subject to confidentiality obligations.
• Implement appropriate technical and organisational measures against unauthorised or unlawful processing and against accidental loss, destruction, or damage — see Security measures below.
• Assist Customer, insofar as reasonably possible, in responding to requests from data subjects exercising their rights under applicable Data Protection Laws — principally via the technical mechanisms described in Data subject rights below.
• Notify Customer without undue delay after becoming aware of a personal data breach affecting End-User Personal Data.
• Make available to Customer information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer, subject to reasonable advance notice, confidentiality, and no more than once per year absent a specific compliance concern.
• At Customer's choice, delete or return all End-User Personal Data after the end of the provision of services, except to the extent MiniMoth is required by applicable law to retain it, or as set out in our Privacy Policy's retention terms.

4. Sub-processors

Customer authorises MiniMoth to engage the sub-processors listed on our Sub-processors page to process End-User Personal Data, scoped to the specific data flows described there. MiniMoth will impose data protection obligations on each sub-processor that are no less protective than those in this DPA. Before engaging a new sub-processor to process End-User Personal Data, MiniMoth will update that page at least 5 days in advance. If Customer objects to a new sub-processor on reasonable data-protection grounds, Customer may terminate the Terms as they apply to the affected processing by written notice to [email protected] before the sub-processor begins processing.

5. Security measures

MiniMoth maintains technical and organisational measures appropriate to the risk, including those described in our Privacy Policy's Security section: OTP codes and refresh tokens are never stored in plain text, only as irreversible hashes; access tokens are short-lived and never written to permanent storage; and connections to our API are encrypted in transit.

6. International transfers

MiniMoth's infrastructure and sub-processors are not all located in the same country as Customer's end-users. Where MiniMoth processes End-User Personal Data originating in the European Economic Area in a country that has not been recognised as providing an adequate level of data protection, the parties incorporate by reference the European Commission's Standard Contractual Clauses (Module Two: Controller to Processor) ("SCCs"), as updated or replaced by the Commission from time to time, with Customer as data exporter and MiniMoth as data importer. In Clause 17 of the SCCs, the Clauses are governed by the law of Ireland; in Clause 18(b), disputes will be resolved before the courts of Ireland; and in Annex I, Part C, the Irish Data Protection Commission is the competent supervisory authority.

For transfers from the United Kingdom, the SCCs apply together with the UK Information Commissioner's Office's International Data Transfer Addendum. For transfers from Switzerland, MiniMoth requires the relevant sub-processor to protect the data to the standard required by Article 28(3) of the GDPR. Where MiniMoth's sub-processors provide their own equivalent transfer mechanism for a given transfer, that mechanism applies in place of the above.

7. Data subject rights

Customer, as Controller, is responsible for responding to its end-users' data subject rights requests. MiniMoth provides the following technical mechanisms to assist, where Customer has enabled them for a project: GET /v1/identity/:id and GET /v1/identity?phone=for access, and DELETE /v1/identity/:id for erasure — see our Identity documentation. Where a capability is not enabled for a project, or a request concerns data not covered by these endpoints, Customer may contact [email protected] for assistance.

8. Term and termination

This DPA takes effect and terminates automatically together with the Terms. Sections that by their nature should survive termination — including confidentiality, security, and the return/deletion obligations in Section 3 — survive to the extent processing or retention continues under our Privacy Policy.

9. Order of precedence

If there is a conflict between this DPA and the Terms, this DPA governs with respect to the processing of personal data. If there is a conflict between this DPA and the SCCs described in Section 6, the SCCs govern.

10. Governing law

This DPA is governed by the same law as the Terms, except to the extent the SCCs described in Section 6 apply to a given transfer, in which case the governing law specified within those Clauses applies to that transfer.