RetainQ

LEGAL

Data Processing Addendum

Last updated: August 2026

1. Scope and Purpose

This Data Processing Addendum ("DPA") supplements the RetainQ Terms of Service and governs the processing of personal data by Webriy ("Processor") on behalf of you ("Controller") when using the RetainQ platform.

2. Definitions

  • Personal Data - Any information relating to an identified or identifiable natural person collected through RetainQ flows
  • Processing - Any operation performed on personal data, including collection, storage, retrieval, and deletion
  • Data Subject - The individual whose personal data is processed (your end customer)

3. Types of Data Processed

RetainQ processes the following categories of personal data on your behalf:

  • Email addresses (when email collection is enabled in flows)
  • Cancellation reason selections
  • Offer acceptance or decline responses
  • Free-text feedback provided during exit surveys
  • Session metadata (timestamps, flow identifiers, outcome status)

4. Processor Obligations

As Processor, Webriy agrees to:

  • Process personal data only on documented instructions from the Controller
  • Ensure that persons authorized to process data are bound by confidentiality obligations
  • Implement appropriate technical and organizational security measures
  • Not engage sub-processors without prior authorization (see sub-processor list in our GDPR Commitment)
  • Assist the Controller in responding to data subject requests
  • Delete or return all personal data upon termination of the service, at the Controller's choice
  • Make available all information necessary to demonstrate compliance

5. Security Measures

We implement the following security measures to protect personal data:

  • Row-level security (RLS) on all database tables ensuring workspace-level data isolation
  • SHA-256 hashing of API keys
  • SSRF protection on webhook delivery endpoints
  • HTTPS encryption for all data in transit
  • Google reCAPTCHA v3 for bot and abuse protection
  • Upstash Redis rate limiting to prevent unauthorized bulk access

6. Data Breach Notification

We will notify the Controller without undue delay (and within 72 hours) upon becoming aware of a personal data breach. The notification will include the nature of the breach, categories of data affected, approximate number of records, and measures taken to address the breach.

7. Data Retention and Deletion

Personal data is retained for the duration of your active RetainQ account. Upon account deletion or service termination, all workspace data including personal data will be permanently deleted within 30 days.

8. International Data Transfers

If personal data is transferred outside the EEA, we ensure appropriate safeguards are in place through our sub-processors' standard contractual clauses or equivalent mechanisms.

9. Controller Obligations

As Controller, you are responsible for:

  • Ensuring you have a lawful basis for collecting personal data through RetainQ flows
  • Providing appropriate privacy notices to your end customers
  • Responding to data subject access requests from your end customers
  • Determining the types and categories of data collected

10. Contact

For DPA-related inquiries or to request a signed copy, contact us at info@retainq.com.

RetainQ is a product of Webriy.