Data processing addendum

Effective date: July 28, 2026

This page summarizes Unafi's Data Processing Addendum ("DPA") — the agreement that governs how Unafi processes personal data contained in customer workspaces. The executable DPA, suitable for signature, is available on request from legal@unafi.io.

1. Roles

For personal data contained in your workspace — contacts, leads, subscribers, and other individuals whose data you bring into or collect through the Services — you (the customer) are the controller and Unafi is the processor. You decide what data enters the workspace and why; Unafi processes it on your documented instructions, which are expressed through your use and configuration of the platform (including the work you direct Unafi to perform).

For your own account data (for example, your name and login email), Unafi acts as an independent controller as described in our Privacy Policy.

2. Processing purposes

Unafi processes workspace personal data solely to provide the Services: storing and organizing audience records, sending the communications you initiate or approve, publishing the content and sites you direct, performing the AI-assisted work you request (see the AI Usage Policy), and producing the analytics and reports the platform provides. Unafi does not process workspace personal data for its own marketing, and does not sell it.

3. Subprocessors

Unafi uses a limited set of subprocessors to deliver the Services, in these categories:

Cloud hosting and infrastructure — application and database hosting;
Payment processing — subscription billing (Stripe);
Email and message delivery — delivering the communications you send;
AI model providers — performing AI processing for requested work, where Unafi-managed.

Subprocessors are bound by data-protection obligations consistent with the DPA. The executable DPA includes the current subprocessor list and a mechanism for notifying customers of changes.

4. Security measures

Unafi implements technical and organizational measures appropriate to the risk, including encryption of data in transit, tenant-level isolation of workspace data, role-based access controls, logging of administrative and AI actions, and access limited to personnel who need it to operate the Services. The full description of measures is an annex to the executable DPA.

5. Assistance with data-subject requests

If an individual whose data is in your workspace exercises data-protection rights (access, correction, deletion, portability, objection), Unafi will assist you in responding — through the platform's built-in tools where possible, and directly where needed. Requests Unafi receives about data in your workspace will be referred to you as the controller.

6. Breach notification

If Unafi becomes aware of a personal-data breach affecting your workspace data, we will notify you without undue delay after becoming aware of it, and provide the information reasonably available to help you meet your own notification obligations.

7. Deletion on termination

When your subscription ends, Unafi deletes or anonymizes the workspace personal data it processes on your behalf within a reasonable period, except where retention is required by law. Export tools are available so you can take your data with you before closure.

8. International transfers

Where workspace personal data is transferred internationally, the DPA incorporates appropriate safeguards, including contractual data-protection clauses with subprocessors.

9. Getting the executable DPA

This page is a summary and does not replace the executable agreement. To receive the current executable DPA for signature — or to ask questions about any of the commitments above — email legal@unafi.io.