TextKit
Plain text (Markdown)

Data Processing Addendum

Last updated: October 29, 2026

The short version

  • When you send us your recipients' data, we process it only to run TextKit for you.
  • We tell you before adding a new subprocessor, and you can object.
  • We report a breach to you within 72 hours of confirming it.
  • We delete your data within 90 days after you leave.
  • It applies automatically: no signature needed. A countersigned copy is available from support@joinsimplesms.com.

This Data Processing Addendum ("DPA") is part of the Terms of Service between Truelabel Inc d/b/a TextKit ("TextKit") and the Customer, and applies whenever TextKit processes Customer Personal Data. Capitalized terms not defined here have the meaning in the Terms or in Data Protection Laws.

1. Definitions

  • Data Protection Laws: all privacy and data protection laws that apply to the processing, including the GDPR, UK GDPR, Swiss FADP, the CCPA as amended by the CPRA, and other US state privacy laws.
  • Customer Personal Data: personal data within Customer Content, including recipient phone numbers, message content and metadata, contact records, and consent records, that TextKit processes on the Customer's behalf.
  • Account Data: information about the Customer's account, users, and billing, which TextKit processes as an independent controller under its Privacy Policy and which this DPA does not cover.

2. Roles and Instructions

The Customer is the controller (or business) and TextKit is the processor (or service provider) of Customer Personal Data. TextKit processes it only on the Customer's documented instructions, which are the Terms, this DPA, and the Customer's use and configuration of the Service, unless the law requires otherwise (in which case TextKit will tell the Customer first, unless the law forbids it). TextKit will tell the Customer if it believes an instruction violates Data Protection Laws. The Customer is responsible for the lawfulness of the data it provides and for having the consent or other legal basis needed to message each recipient.

3. Permitted Purposes

TextKit processes Customer Personal Data only to provide, secure, and support the Service; to detect and prevent fraud, spam, and abuse and to enforce the Messaging Policy; to honor opt-outs; and to comply with law. TextKit may create aggregated or de-identified data that cannot reasonably identify any person, and will not attempt to re-identify it.

4. US State Law (CCPA) Terms

As a service provider, TextKit will not sell or share Customer Personal Data; retain, use, or disclose it for any purpose other than the business purposes in Section 3, or outside the direct business relationship with the Customer; or combine it with personal data from other sources except as Data Protection Laws permit. TextKit will provide the same level of protection the law requires of the Customer, will notify the Customer if it can no longer meet these obligations, and allows the Customer to take reasonable steps to stop and remediate unauthorized use. TextKit certifies that it understands these restrictions.

5. Confidentiality and Personnel

TextKit ensures that everyone authorized to process Customer Personal Data is bound by confidentiality obligations and has access only as needed.

6. Security

TextKit maintains the technical and organizational measures in Annex 2 and may update them, provided the overall level of protection does not decrease.

7. Subprocessors

The Customer authorizes TextKit to use the subprocessors described on the Subprocessors page. TextKit will give the Customer the named list on request to support@joinsimplesms.com; it is confidential information. TextKit imposes data protection terms on each subprocessor that protect Customer Personal Data at least as well as this DPA, and is liable for its subprocessors' performance.

TextKit will give at least 10 days' notice before a new subprocessor processes Customer Personal Data, to Customers who have asked for notices at support@joinsimplesms.com. The Customer may object on reasonable data protection grounds within that period; the parties will then work in good faith toward a solution, and if none is found the Customer may terminate the affected Service and receive a refund of prepaid fees for it. Where a change is needed urgently to keep the Service running or secure, TextKit may make it first and notify promptly afterward.

8. Assistance

Taking into account the nature of the processing, TextKit will assist the Customer with requests from individuals exercising their rights, with data protection impact assessments and prior consultations, and with security obligations. TextKit will promptly forward requests it receives directly from an individual about Customer Personal Data and will not answer them itself except to confirm the request was forwarded or as the law requires. Recipients' STOP replies are honored automatically, as the Customer instructs by using the Service.

9. Personal Data Breaches

TextKit will notify the Customer without undue delay, and in any case within 72 hours, after confirming a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. The notice will describe the breach, the data and individuals affected as far as known, its likely consequences, and the measures taken, and TextKit will update it as it learns more. Notifying the Customer is not an admission of fault.

10. Deletion and Return

During the subscription the Customer can export its data through the API, and delete or redact individual messages through it (Data Retention "Deleting sooner" lists what each removes and what is kept). The subscription ends when the Customer's account is closed (Terms §13). Within 90 days after the subscription ends, TextKit will delete Customer Personal Data, except for copies the law requires it to keep, opt-out and consent records kept to enforce suppression and defend claims, and data in backups, which are deleted on their normal cycle. Deletion starts 30 days after closing, so that a mistaken closure can be reversed at the Customer's request; until then the Customer can still read and export its data in the console. Retained data remains protected by this DPA.

11. Audits

TextKit will make available the information reasonably necessary to demonstrate compliance with this DPA, including by answering security questionnaires. If that is not sufficient, or a regulator requires it, the Customer may audit TextKit's compliance once per year, at its own cost, with 30 days' notice, during business hours, under confidentiality, and in a way that does not compromise other customers' data.

12. International Transfers

TextKit processes Customer Personal Data in the United States. For transfers from the EEA, the EU Standard Contractual Clauses (Commission Decision 2021/914) are incorporated by reference: Module 2 where the Customer is a controller, Module 3 where it is a processor, with clause 7 (docking) included, option 2 (general authorization) in clause 9 with the notice period in Section 7, the optional language in clause 11 omitted, Irish law and courts in clauses 17 and 18, and Annexes I and II completed by Annexes 1 and 2 of this DPA. For transfers from the UK, the UK International Data Transfer Addendum is incorporated, with the Clauses above as the approved EU SCCs. For transfers from Switzerland, the same Clauses apply with the Swiss FADP in place of the GDPR and the FDPIC as the competent authority.

13. General

Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Laws do not allow it. If this DPA conflicts with the Terms, this DPA governs as to Customer Personal Data; if it conflicts with the Standard Contractual Clauses, the Clauses govern. This DPA lasts as long as TextKit processes Customer Personal Data.

Annex 1: Description of Processing

  • Data subjects: the Customer's message recipients and contacts, people who message the Customer's numbers, people who sign up on an opt-in page TextKit hosts for the Customer, and people the Customer sends verification codes to by email.
  • Categories of data: phone numbers; email addresses the Customer sends verification codes to; message content and media; message metadata (timestamps, IDs, delivery status, carrier and routing information, tags the Customer attaches) and delivery statistics derived from it; contact attributes the Customer stores (names, email addresses, company, state or province, tags, custom fields, notes, source, the import a contact came from, the lists it is in, and its id in a tool the Customer connected), the lists, segments and subscription topics the Customer defines, data the Customer directs TextKit to read from tools it connects (the same contact attributes and the SMS consent state the tool records, and, for an online store with a cart-reminder, order or shipping automation, its abandoned checkouts, new orders and shipments: phone number, checkout link, order number and status link, total, items, and tracking number, link and carrier), and which broadcasts a number was included in; opt-in, opt-out, and consent records, including who changed them, opt-in evidence the Customer records (source, time, page, disclosure wording, IP address, user agent, the registration the opt-in was given for, the inbound message for a keyword opt-in) and the same evidence for sign-ups on an opt-in page TextKit hosts for the Customer, with the text asking them to confirm and their reply, re-confirmation texts sent on the Customer's behalf and the reply or its absence, and each number's subscription preference per topic; verification outcomes; lookup results; records the Customer keeps about its own customers in the customers API (names, identifiers, metadata) and per-customer usage counts; events the Customer sends about its users for automations (event names, the Customer's user identifiers, phone numbers, and event properties) and the record of each automation run; the recurring schedules the Customer creates (recipient phone number, message text, and repeat rule) and the record of each occurrence; when the Customer uses link shortening, the links in its messages and counts of when and on what kind of device they were opened (no IP address or user agent kept); and any personal data the Customer includes in the example messages it writes for a registration, and in the filed copies of them (examples should use made-up names and values).
  • Sensitive data: none intended. The Customer must not send special category data, payment card data, government ID numbers, or protected health information (Terms §6.5).
  • Frequency: continuous, for the duration of the subscription.
  • Nature and purpose: transmitting and receiving messages, sending and checking verification codes by text or email, provisioning numbers, storing message history for the Customer, screening for fraud and abuse (automatically, and by TextKit staff who review new kinds of message during an account's first 30 days of live sending), checking that each new kind of message matches the registration or toll-free verification it is sent under (automatically, and by staff when the check cannot tell), enforcing opt-outs, and support.
  • Retention: as set out in Data Retention and Section 10.
  • Subprocessors: as set out on the Subprocessors page, for the same nature and purpose.
  • Exporter: the Customer. Importer: Truelabel Inc, based in Nashville, Tennessee; registered office 5830 E 2nd St, Ste 7000, PMB 35111, Casper, WY 82609, USA; privacy@joinsimplesms.com.

Annex 2: Security Measures

  • Encryption of data in transit (TLS) and at rest.
  • API keys never stored in plain text: looked up by keyed hash under a server-held secret, and kept encrypted (AES-256-GCM) under a separate server-held key so the Customer's admins can view them in the console, each view recorded in the Customer's audit log; the encrypted copy deleted when a key is revoked or rolled. Keys rotatable at any time and restrictable to scopes. Verification codes stored only as hashes, salted with their record identifier.
  • Customer-side access control: admin, member, and read-only viewer roles, and an audit log of account changes (keys, team, webhooks, spend limits, numbers, consent overrides, settings) recording the actor, time, and IP address, available to the Customer's admins.
  • Access to production systems limited to personnel who need it, with strong authentication, and logged. Changes our staff make to a customer account are made under the staff member's own sign-in and logged with who made them and why. When our support staff look at a customer's account as the customer sees it, the view is read-only, lasts at most 30 minutes, is opened under the staff member's own sign-in, and is recorded in the Customer's audit log.
  • Separate test and live environments: test keys cannot send carrier traffic, and each key sees and changes only its own environment's data; once an account is live, data both environments share needs a live key, and a webhook endpoint receives only its own environment's events.
  • Signed webhooks so customers can verify that events come from TextKit.
  • Automated fraud and abuse monitoring, rate limits, and content screening.
  • Logs designed to exclude message content and verification codes where they are not needed.
  • Subprocessors selected for their security practices and bound by data protection terms.
  • An incident response process with customer notification as in Section 9.

Contact

Truelabel Inc (d/b/a TextKit), a Wyoming corporation based in Nashville, Tennessee. Registered office and mailing address: 5830 E 2nd St, Ste 7000, PMB 35111, Casper, WY 82609, USA. support@joinsimplesms.com