Data Processing Agreement
Last updated: 31 October 2026
This Data Processing Agreement ("DPA") is part of the Terms of Service between the customer that holds a TweakTick workspace ("Customer", the controller) and TERRANOAH ECOM VENTURES (OPC) PRIVATE LIMITED, D/1401 Kanakia Sevens, Andheri Kurla Road, Marol Naka, Mumbai, MH 400059, India ("TweakTick", the processor). It applies when TweakTick processes personal data on the Customer's behalf. No signature is needed: it applies automatically when you use the Service.
1. What is processed
| Item | Details |
|---|---|
| Subject matter | Running the TweakTick review and approval service for the Customer |
| Duration | While the Customer uses the Service, plus the deletion periods in section 8 |
| Nature and purpose | Storing, displaying, converting and transmitting review content; sending notification and approval-code emails; keeping the sign-off record |
| People concerned | The Customer's clients (guests), team members, and anyone shown in the content under review |
| Types of data | Names, email addresses, comments, voice notes, attachments, IP addresses and browser details at approval, and any personal data contained in the files under review |
| Special categories | Not intended. The Customer should not upload special-category data unless it has a lawful basis and has told us |
2. TweakTick's duties
TweakTick will:
- Process personal data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use of the Service settings are those instructions. If an instruction breaks the law, we'll say so.
- Make sure everyone with access is bound to confidentiality.
- Apply the security measures in section 5.
- Use sub-processors only as described in section 6.
- Help the Customer answer requests from people exercising their rights (access, correction, deletion, portability), mainly through the Service's own tools: deleting comments, projects and guests, and the workspace export.
- Help with security, breach notification and data protection impact assessments, as far as reasonable given the information we have.
- At the end of the Service, delete the Customer's personal data as described in section 8.
- Make available the information needed to show compliance with this DPA, and allow reasonable audits (normally by written questions, at most once a year, with 30 days' notice).
3. The Customer's duties
The Customer:
- is responsible for having a lawful basis to collect and share its clients' data and to upload the content under review;
- gives its clients the privacy information they need (the client hub shows a short notice and links to our Privacy Policy);
- keeps its account credentials and API keys safe;
- decides whether to use optional features that send data to third parties: AI review (its own provider and key), email client previews (Mailgun), integrations and webhooks, and its own SMTP server.
4. The sign-off record
Approvals are written to an append-only, hash-chained record that the application cannot edit or delete. The Customer instructs TweakTick to keep this record after the related project, workspace or account is deleted, because it is evidence of what was agreed. TweakTick keeps it for at least 6 years after the last approval in the project.
5. Security measures
- Encryption in transit (HTTPS) for the app and review links.
- Passwords hashed with argon2id; secrets (AI keys, tokens, staging logins, SMTP passwords) encrypted with AES-256-GCM.
- The application's database user can only add to and read the sign-off table, never change it.
- Every workspace query is scoped to its workspace; internal comments are filtered on the server before anything reaches a client.
- Website screenshots are taken in a separate, isolated container whose outbound traffic goes through a filtering proxy, so user-supplied addresses can't reach internal systems.
- Nightly encrypted backups, with a regular restore test.
- Error reports are scrubbed of cookies, tokens and email addresses.
More detail: Security.
6. Sub-processors
The Customer gives general authorisation for the sub-processors listed on the Sub-processors page. We'll update that page and email workspace owners at least 14 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds; if we can't resolve it, the Customer may stop using the Service and, for a monthly plan, cancel it. We impose data protection terms on each sub-processor that are no less protective than this DPA, and remain responsible for them.
AI providers used for AI review are not our sub-processors: the Customer chooses them and contracts with them directly using its own key.
7. Personal data breaches
If we become aware of a personal data breach affecting the Customer's data, we'll tell the workspace owners without undue delay, and within 72 hours where possible, with the information we have, and keep them updated.
8. Deletion and return
- The Customer can export a workspace (owner only) and delete projects, guests, the workspace or the account at any time from the Service.
- On deletion, data is removed from the live system, and backup copies expire within 30 days (off-site backups) or 7 days (local backups), as stated in the Privacy Policy.
- The sign-off record is kept (section 4). Billing records are kept as tax law requires.
9. International transfers
TweakTick is based in India; hosting is with OVH in Canada. Where personal data subject to the GDPR is transferred to a country without an adequacy decision, the parties rely on the European Commission's Standard Contractual Clauses (module 2, controller to processor, or module 3 where applicable), which are incorporated by reference, and the equivalent UK addendum where UK law applies.
10. Order of precedence
If this DPA conflicts with the Terms on data protection, this DPA wins.
Questions: [email protected]