# Data processing agreement — LittleReply

Version: 2026-10-26. Final contract terms. Each customer's effective date is determined under section 1.

## 1. Parties, acceptance and duration

This agreement (DPA) supplements the service contract between the customer identified in the written acceptance record (Customer) and RyactApps LLC, a New York limited liability company operating LittleReply at https://littlereply.com and Formeo at https://formeo.me (Processor). The Processor's address is 418 BROADWAY, STE N, ALBANY, NY 12207, USA. Privacy and security contact: privacy@formeo.me. Support: contact@formeo.me.

The Customer's authorized representative enters into this DPA by sending express acceptance of version 2026-10-26 to privacy@formeo.me, identifying the Customer's legal name, address, representative, privacy contact, covered workspace identifiers, and role as controller or processor. The Processor confirms acceptance in writing, including by email, identifies its authorized representative and supplies the processing/provider record described in the annexes. The DPA becomes binding when that confirmation is sent. A separately signed agreement expressly incorporating this version has the same effect. Each party retains the agreed document and acceptance record. Visiting the site, downloading the document or accepting general account terms alone does not execute this DPA.

The DPA must be concluded before processing on the Customer's behalf where Article 28 GDPR requires it. It applies throughout the service contract and continues for remaining processing until return or deletion is complete. It does not retrospectively certify earlier processing. The annexes form part of the DPA.

## 2. Roles and scope

Data-protection terms have the meanings given in Regulation (EU) 2016/679 (GDPR). Customer Data means personal data processed on the Customer's behalf as described in Annex 1. The Customer determines the purposes and means as controller. If the Customer is itself a processor, it confirms its authority to appoint the Processor as subprocessor and passes on the controller's documented instructions and applicable obligations. References to Customer instructions include those authorized instructions.

The Customer is responsible for a lawful basis, notices, lawful collection and disclosure, minimization, permissions, recipients and appropriate retention settings. Special-category data, criminal-offence data, identity documents, passwords and payment secrets must not be requested through ordinary forms without a separate written assessment and agreement on suitable safeguards. Neither party's responsibilities relieve the other of its own obligations.

Independent processing for account administration, billing, legal obligations and optional service analytics is described in the [privacy policy](https://littlereply.com/privacy). It does not authorize reuse of Customer Data for advertising, sale or general-purpose AI model training.

## 3. Documented instructions

The Processor processes Customer Data only on documented instructions, including for international transfers, to provide, secure and support the configured service. Instructions comprise this DPA, the service contract, authorized workspace/form settings and subsequent written instructions accepted within the service's scope. The Processor must not determine new purposes for Customer Data.

If Union or Member State law requires other processing, the Processor informs the Customer beforehand unless that law prohibits notice on important public-interest grounds. Other government demands are assessed under applicable law and section 8; this is not a general permission for incompatible disclosure.

The Processor immediately informs the Customer if it considers an instruction to infringe GDPR or other Union or Member State data-protection law and suspends that instruction until lawful processing is possible. The parties cooperate to resolve the issue; the Customer may end affected processing if no lawful solution is available.

## 4. Confidentiality and security

Access is limited to authorized persons who need it for their duties and are bound by contractual or appropriate statutory confidentiality obligations, continuing after access ends. The Processor reviews permissions and removes unnecessary access.

The Processor implements and maintains technical and organizational measures appropriate to the risk under Article 32 GDPR, considering the processing, available technology and implementation costs. Annex 2 describes controls and operational limitations. The Processor regularly assesses effectiveness, investigates deficiencies and remedies them. Changes must not materially reduce agreed protection.

No certification, uninterrupted service, independently operated backup or fixed recovery time is represented. This does not limit the duty to provide appropriate confidentiality, integrity, availability, resilience and recovery measures for processing undertaken.

## 5. Subprocessors and instructed destinations

The Customer gives general written authorization for the subprocessors identified for its processing in Annex 3 and the accompanying provider record. The Processor selects providers offering sufficient guarantees, binds them in writing to materially the same data-protection obligations, and remains fully liable to the Customer for their performance of those obligations.

The Processor gives the designated privacy contact at least 30 days' prior written notice of an additional or replacement subprocessor, identifying its purpose, identity, location and relevant transfer safeguards. The Customer may object on reasonable data-protection grounds within that period. The parties seek an alternative or adequate safeguards. No affected Customer Data is sent to the disputed provider while the objection remains unresolved. If no solution is available, either party may end the affected service, with return/deletion under section 10 and a proportionate refund of prepaid fees for unused affected service.

Customer-selected mailboxes, webhooks and connected services receive data only on the Customer's instructions. The Customer must have the authority and arrangements required for those destinations. A provider engaged by the Processor to perform its processing obligations remains a subprocessor regardless of its interface label.

## 6. Assistance and individual rights

Taking account of the nature of processing and information available, the Processor assists the Customer through appropriate technical and organizational measures with access, correction, erasure, restriction, portability, objection and other applicable rights, and with Articles 32–36 GDPR, including impact assessments and prior consultation.

The Processor forwards requests concerning Customer Data without undue delay and does not answer for the Customer unless instructed or legally required. It provides relevant assistance in time for the Customer's legal deadlines. The Customer supplies necessary scope and instructions; proportionate identity verification and secure disclosure apply. Charges agreed for exceptional assistance must not obstruct mandatory cooperation or legal deadlines.

## 7. Personal data breaches

The Processor notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, using its designated privacy contact and, if necessary, workspace account contact. Initial notification must not wait for a complete investigation.

As information becomes available, notice includes the breach's nature, categories and approximate numbers of affected individuals and records, a contact for further information, likely consequences, and containment/remedial measures taken or proposed. Missing details follow in phases without undue further delay. The Processor documents the incident, preserves relevant evidence, contains and remedies the breach and assists with notifications. The Customer determines notifications to authorities and individuals unless the law requires the Processor to act directly.

## 8. International processing and transfers

Primary database/private storage and application functions are configured in Frankfurt. This is not an exclusively EEA-processing commitment: the Processor is established in the United States, and providers, support, logs, networks and instructed destinations may involve other countries.

Before a restricted transfer, including third-country access, the parties must establish and document a valid Chapter V GDPR mechanism applicable to the actual parties and processing. This may be an applicable adequacy decision or valid standard contractual clauses with required annexes, assessment and supplementary measures. An adequacy framework requires checking current recipient and data coverage. This DPA is not itself international-transfer standard contractual clauses; mentioning a mechanism does not establish certification or its execution.

The Processor records recipients, countries, mechanisms and safeguards and supplies that information and access to applicable safeguards to the Customer. It assesses government-access requests, challenges unlawful or disproportionate demands where appropriate, minimizes legally required disclosure and informs the Customer unless prohibited by law. If safeguards cannot be established or cease to be effective, it informs the Customer and suspends the affected transfer until a lawful solution exists; otherwise section 10 applies. Optional AI must not receive Customer Data until its provider, retention and transfer arrangements are confirmed in writing.

## 9. Records, information and audits

The Processor maintains records required by law, makes available information needed to demonstrate compliance with this DPA and Article 28 GDPR, allows and contributes to audits including inspections by the Customer or its mandated independent auditor, and cooperates with competent authorities.

The parties coordinate proportionate scope, reasonable notice, confidentiality and secure access to protect other customers and service security. These arrangements must not prevent a necessary audit, urgent investigation or authority access. Independent reports may assist but do not replace legally required audit rights. The Processor remedies identified deficiencies and provides corrective-action information. No certification is implied.

## 10. Retention, return and deletion

During service, the Processor follows lawful deletion instructions and the Customer's retention settings. Default message retention is 90 days unless another available setting is selected. The Customer chooses a period appropriate to its purpose.

At the end of affected service, the Customer chooses return in an available, commonly used electronic format followed by deletion, or deletion without return. The Processor requests that choice before planned closure; instructions may also be sent to privacy@formeo.me. If no return instruction follows that request, deletion applies. The Processor completes the instruction without undue delay, deletes remaining copies and confirms completion on request, except where Union or Member State law requires storage. It identifies that requirement where permitted, isolates retained data, limits processing to that requirement and deletes it when the requirement ends.

Submission deletion removes fields and metadata from ordinary service access and schedules dependent files/payloads for purge. Failed purges are tracked and retried. Backup copies, where present, remain protected, are excluded from ordinary processing and are deleted or rendered irrecoverable under the documented schedule supplied for the Customer's processing. Deletion records are applied before restored data is exposed. The schedule must identify actual provider retention and limitations; it is not an unlimited-retention exception. Copies delivered to Customer-controlled mailboxes or integrations remain under the Customer's control.

## 11. Priority, changes and responsibility

This DPA prevails over conflicting service terms for Customer Data. Applicable transfer clauses and mandatory data-protection law prevail over this DPA. Nothing reduces individuals' statutory rights, authority powers or the parties' GDPR liabilities. Service-contract governing-law and dispute terms otherwise apply, subject to mandatory Union and Member State law.

Material amendments require written agreement identifying the new version; publishing a replacement download alone does not amend an executed DPA. Subprocessor changes follow section 5. French and English versions are available; the acceptance record identifies the agreed language/version. Neither translation reduces mandatory GDPR protections.

## Annex 1 — Processing description

| Item | Scope |
| --- | --- |
| Subject matter | Receipt and management of the Customer's website-form submissions and related support. |
| Nature and purpose | Collection, validation, spam/security checks, storage, organization, access, export, notifications, configured integrations and deletion to handle enquiries. Optional AI replies are subject to section 8. |
| Individuals | Website visitors, people named in submissions, designated recipients and authorized team members appearing in Customer Data. |
| Data | Customer-selected fields including names, contact details and enquiry text; permitted attachments; recipients; necessary submission/security metadata; associated workflow, delivery and support records. |
| Frequency/duration | As the Customer uses the service, for the period in section 1 and retention instructions in section 10. |
| Instructions | Identified workspaces, published form settings, recipients/integrations, retention settings and lawful written instructions. |

The acceptance record identifies covered workspaces and authorized contacts. The Processor retains the applicable configuration and additional agreed instructions. Excluded high-risk uses require the separate agreement in section 2.

## Annex 2 — Technical and organizational measures

- Access: authenticated administration, current workspace/project membership, scoped permissions, private storage, access-checked time-limited download links.
- Separation/minimization: tenant authorization and database access policies; public rendering excludes recipient secrets and private configuration; operational logs must exclude message contents and secrets.
- Transmission/secrets: HTTPS endpoints, server-side secrets, encryption of stored integration credentials and scoped revocable API access.
- Intake/files: validation, rate/size limits, spam controls, attachment ownership checks and quarantine. Files requiring a successful scan remain unavailable until that result exists; scanner failure must not release them.
- Integrity/deletion: durable submission/job records, distinct delivery states, authorized exports/deletion, deletion records and retryable file purges.
- Organization: need-to-know authorization, confidentiality, security review, incident handling, assistance and audit obligations under this DPA.
- Recovery: the service relies on infrastructure providers. A separate independent backup system and verified fixed recovery objective are not included in the published configuration. Before undertaking processing, the Processor documents actual backup/restore coverage, provider retention/purge schedules and risk-appropriate recovery measures. It must address inadequacy under section 4; an unverified recovery target is not a guarantee.

## Annex 3 — Providers and transfer record

| Provider/service | Role and scope | Location information |
| --- | --- | --- |
| Supabase | Database, private storage and authentication supporting service access. | Primary project in Frankfurt; provider support and other processing assessed separately. |
| Vercel | Hosting, functions, job transport and technical logs. | Functions in Frankfurt; CDN, logs and support may involve other regions. |
| Brevo | Configured notification/authentication email transport, recipient/delivery information and content needed for delivery. | Applicable locations and retention recorded for the contracted service. |
| OpenAI, only when enabled and cleared under section 8 | Selected fields/context and generated replies for instructed AI features. | Contracting entity, locations, retention and safeguards confirmed before Customer Data is sent. |

The Processor supplies and maintains a record of actual contracting entities, relevant services, processing countries, retention/backup schedules and transfer safeguards. The initial record accompanies written confirmation under section 1; changes follow sections 5 and 8. Official references: [Supabase DPA](https://supabase.com/legal/dpa), [Vercel DPA](https://vercel.com/legal/dpa), [Brevo terms](https://www.brevo.com/legal/termsofuse/), [OpenAI DPA](https://openai.com/policies/data-processing-addendum/). Links are informational and do not prove execution or configuration of those arrangements.

Stripe processes payment/account data in its applicable role; PostHog processes optional service analytics under the privacy policy. This DPA does not authorize them to receive form contents. Customer-configured destinations and optional anti-spam services must be identified according to their actual role; any additional provider engaged by the Processor for Customer Data requires section 5 authorization. The [provider page](https://littlereply.com/subprocessors) supplements information and does not unilaterally amend an executed DPA.