This Data Processing Agreement ("DPA") explains how Popsicle Labs ("Popsicle", "we", "us", "our") processes personal data on behalf of our customers ("Customer", "you"). It is written to meet the requirements of data protection laws in the European Union, the United Kingdom, Singapore, Indonesia and the United States, so one agreement applies wherever you operate.
This DPA forms part of, and is incorporated into, our Terms of Service (the "Terms"). It applies automatically when you accept the Terms and Popsicle processes Customer Personal Data. If you need a countersigned copy for your records, contact us at info@popsicle-labs.app.
Terms such as "controller", "processor", "personal data", "processing", "data subject", "business", "service provider", "consumer", "sale" and "sharing" have the meanings given to them in the applicable Data Protection Laws. In addition:
This DPA is designed to satisfy the processor and service-provider requirements of the following laws, as they apply to you:
Where these laws use different words for the same role (for example "processor", "service provider", "data intermediary" or prosesor data pribadi), this DPA uses "processor" to mean all of them.
For Customer Personal Data, you are the controller (a "business" under the CCPA, an "organisation" under the PDPA, and a pengendali data pribadi under the PDP Law), and Popsicle is your processor. We process Customer Personal Data only on your behalf and for the purposes described in this DPA.
Popsicle is a controller only of the limited personal data we need to run our own business, such as the account details of your users, billing records and how the platform is used. That data is covered by our Privacy Policy, not this DPA.
We process Customer Personal Data only to provide, secure, support and improve the Services for you: detecting revenue-relevant signals in the channels you connect, explaining them, and preparing recommended actions. The subject matter, duration, nature and purpose of processing, and the types of personal data and individuals involved, are set out in Annex 1.
The Services are not designed to process special categories of personal data (such as health data, biometric data, or data about religion or sexual orientation). You agree not to direct such data to Popsicle deliberately. If it appears incidentally in connected channels, we protect it under this DPA like all other Customer Personal Data.
We process Customer Personal Data only on your documented instructions. Your instructions are set out in the Terms, this DPA, and the choices you make in the Services, such as which channels you connect, which Slack channels Popsicle may read, and your settings. Additional instructions must be agreed in writing.
We will tell you promptly if, in our opinion, an instruction would breach Data Protection Laws, and we are not required to follow it. If a law requires us to process Customer Personal Data other than on your instructions, we will tell you first unless that law prohibits it.
Everyone at Popsicle who can access Customer Personal Data is bound by a duty of confidentiality, receives appropriate data protection training, and has access only to the extent their role requires.
We implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of processing, together with the risks to individuals. The measures in place are described in Annex 2. We may update them over time, provided the overall level of protection does not decrease.
Popsicle uses AI models to read signals and answer your questions. When we do:
You give us general authorisation to engage the sub-processors listed in Annex 3. For each one, we:
We will give at least 30 days' notice before adding or replacing a sub-processor, by updating Annex 3 and by email to your account's owner. You may object on reasonable data protection grounds within that period. We will then work with you in good faith on an alternative; if none is possible, you may terminate the affected Services and receive a pro-rated refund of any prepaid fees for them.
People have rights over their personal data under Data Protection Laws, such as access, correction, deletion, portability, objection, and opting out of sale or sharing. Taking into account the nature of the processing, we will help you respond to these requests through the Services' features (for example, export and deletion) and, where needed, with further reasonable assistance. If we receive a request directly that relates to your data, we will pass it to you without undue delay and will not respond ourselves unless you instruct us to.
If we become aware of a Personal Data Breach affecting Customer Personal Data, we will notify you without undue delay, and in any event within 48 hours of confirming it. This timing is designed to let you meet your own deadlines, including the 72-hour notice under the GDPR and UK GDPR, the 3 × 24-hour notice under Indonesia's PDP Law, and the PDPA's requirement to assess and notify promptly.
Our notice will describe, as far as we know at the time, the nature of the breach, the data and people affected, its likely consequences, and the steps we are taking. We will provide updates as more becomes known, take reasonable steps to contain and remedy the breach, and help you with any notices to regulators or individuals. Notifying you is not an admission of fault.
Taking into account the information available to us, we will give you reasonable help with data protection impact assessments, risk assessments and prior consultations with regulators that relate to your use of the Services, and we will cooperate with regulators as Data Protection Laws require.
Popsicle's application servers are in Singapore and its database is in the United States (Oregon). Some sub-processors operate in other countries, as listed in Annex 3. Customer Personal Data may therefore be transferred outside your country. For each such transfer:
Where Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply and are incorporated into this DPA: Module Two (controller to processor), or Module Three (processor to processor) where you are yourself a processor. For the Clauses: the optional docking clause 7 applies; under clause 9, option 2 (general authorisation) applies with the notice period in Section 10; the optional wording in clause 11 does not apply; under clauses 17 and 18, the law and courts of Ireland apply; Annexes I and II are completed by Annexes 1 and 2 of this DPA.
For transfers subject to UK data protection law, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner applies and is incorporated into this DPA, completed with the information in this DPA. Either party may end the Addendum as permitted by its Section 19.
For transfers subject to the PDPA, we will ensure the recipient is bound by legally enforceable obligations, including the terms of this DPA, to give the transferred data a standard of protection comparable to the PDPA, as the Transfer Limitation Obligation requires.
For transfers subject to the PDP Law, we will ensure that the destination provides a level of personal data protection equal to or higher than the PDP Law or, where it does not, that adequate and binding safeguards are in place through this DPA and our agreements with sub-processors, in line with Article 56 of the PDP Law and its implementing regulations.
Where another country's law restricts transfers, we will put in place the safeguards that law requires, and you agree to cooperate in completing them.
To the extent the CCPA or other US State Privacy Laws apply, Popsicle is your service provider (California) and processor (other states), and we certify that we understand and will comply with the following:
On request, we will make available the information reasonably necessary to demonstrate our compliance with this DPA, including completed security questionnaires and summaries of our security practices. Where that information is not enough to demonstrate compliance, or a regulator requires it, you may carry out an audit, no more than once in any 12-month period (except after a Personal Data Breach or at a regulator's request), with at least 30 days' written notice, during business hours, in a way that does not disrupt our operations, and subject to reasonable confidentiality terms. Each party bears its own costs unless the audit reveals a material breach by us.
When the Services end, you may export your data for 30 days, as described in the Terms. After that period we will permanently delete Customer Personal Data from our live systems, and it will be removed from backups as they expire, within a further 35 days. You may also delete your workspace and its data at any time from within the Services. We may keep data only where a law requires us to, in which case we will keep it confidential and process it only for that purpose.
| Item | Details |
|---|---|
| Subject matter | Providing the Popsicle revenue intelligence platform to the Customer. |
| Duration | For the term of the Services, plus the export and deletion periods in Section 17. |
| Nature and purpose | Connecting to the channels the Customer authorises; reading messages, meetings and records to detect revenue-relevant signals (for example disengagement, pricing concerns or competitor mentions); storing those signals with short excerpts as evidence; calculating figures such as revenue at risk; answering users' questions; drafting recommended messages; and sending notifications the Customer configures. |
| Categories of individuals | The Customer's employees and users of the Services; the Customer's customers, prospects and their employees; and other people who appear in the connected channels. |
| Types of personal data | Names, business email addresses and phone numbers, job titles and employers; message and meeting metadata (senders, recipients, dates, participants); short excerpts of communications; account and deal information from CRM systems; and users' questions, notes and decisions recorded in the Services. |
| Special categories | None intended (see Section 4). |
| Frequency | Continuous, while channels remain connected. |
| Retention | For the term of the Services; deleted as described in Section 17. Full message archives are not kept. |
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, authentication and file storage | United States (Oregon) |
| Vercel, Inc. | Application hosting | Singapore |
| Anthropic, PBC | AI processing to detect signals, answer questions and draft messages (no training on customer data) | United States |
| Resend, Inc. | Transactional email, such as invitations and notifications | United States |
| PostHog, Inc. | Product analytics on how the Services are used (account identifiers only; no message content). Used only if enabled. | United States |
The channels you connect (such as Google Workspace, Slack, Zoom or HubSpot) are services you use and authorise directly; they are not sub-processors of Popsicle.
For questions about this DPA, to request a countersigned copy, or to exercise any right under it, contact us at info@popsicle-labs.app.