Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the Customer and Reclaiva. For the personal data of the Customer's end customers that Reclaiva reads from the Customer's Stripe account and uses to send reminder emails, the Customer is the controller and Reclaiva is the processor, within the meaning of the Swiss Federal Act on Data Protection and, where applicable, article 28 of the GDPR.

• Nature: reading invoice, customer and subscription data from Stripe; assigning failed invoices to the Reclaiva group or the control group; sending reminder emails; recording delivery events; computing monthly statements.
• Purpose: recovering the Customer's failed subscription invoices and measuring the increase, as described in the Terms.
• Duration: as long as the Customer's Stripe connection is active, and until deletion under section 10.

• Data subjects: the Customer's end customers whose invoices failed.
• Data: name, email address, country, language, Stripe customer and invoice identifiers, invoice amounts and currency, invoice status, decline code, hosted payment link, number of successful payments, tenure, and email delivery events (bounce, complaint, click with time and user agent).
• No special categories of data. No card numbers: Stripe does not expose them to Reclaiva.

Reclaiva processes the data only on the Customer's documented instructions. These are the Terms, the settings chosen in the app (sending activation, pause, control group size, high-value threshold, sender name and reply-to address) and the approval of each email drafted with the help of an AI model. Reclaiva informs the Customer if it considers an instruction unlawful.

The persons authorised by Reclaiva to process the data are bound by confidentiality. Access is limited to what is necessary to operate the Service.

• Stripe access tokens and restricted keys are encrypted at rest with AES-256-GCM and never displayed after entry.
• Access to Stripe is read-only: OAuth scope read_only or restricted keys only. Reclaiva never writes to the Customer's account; an automated test verifies that a write is refused.
• Row-level security on every table: a row is readable only by its owner. The service role is used only on the server.
• TLS in transit. Secrets are never written to logs, error messages or source control.
• Preview mode by default: nothing is sent before explicit activation. A pause control is always available. Each send re-checks the stop conditions (invoice paid, complaint, bounce, pause, subscription canceled).
• Audit log of sensitive actions. Webhooks verified by signature and processed once.
• Database hosted in the European Union (Frankfurt).

The Customer authorises the sub-processors listed below. Reclaiva gives 30 days' notice by email before adding or replacing a sub-processor; the Customer may object and terminate the Service before the change takes effect.

Transfers outside Switzerland and the European Economic Area rely on standard contractual clauses or on an adequacy decision (to be confirmed per sub-processor at the legal review).

• Reclaiva assists the Customer in answering requests from data subjects (access, rectification, erasure, objection) and forwards within 5 working days any request it receives directly.
• Reclaiva assists the Customer, as far as it is able, with security, breach notification and data protection impact assessments.

Reclaiva notifies the Customer without undue delay, and at the latest within 72 hours of becoming aware of a breach affecting the Customer's data, with the information available at that time, and completes it as it becomes available.

• When the Customer disconnects Stripe or deletes its account, Reclaiva deletes the data read from the Stripe account and the related email data. Statements and invoices that Reclaiva must keep under Swiss accounting law (10 years) are kept for that purpose only.
• Before deletion, the Customer may export its statements as CSV from the app.

Once a year, and after a breach, the Customer may ask Reclaiva for the information necessary to demonstrate compliance with this DPA, including a description of the security measures, and may conduct an audit at its own cost, with 30 days' notice, during business hours and without disrupting the Service.

This DPA is governed by the same law and the same jurisdiction as the Terms: Swiss law, courts of Lausanne (to be confirmed).