# Data Processing Addendum

Source: https://jointextkit.com/dpa
Index: https://jointextkit.com/llms.txt

**Last updated: October 29, 2026**

> **The short version**
>
> - When you send us your recipients' data, we process it only to run
>   TextKit for you.
> - We tell you before adding a new subprocessor, and you can object.
> - We report a breach to you within 72 hours of confirming it.
> - We delete your data within 90 days after you leave.
> - It applies automatically: no signature needed. A countersigned copy is
>   available from support@joinsimplesms.com.

This Data Processing Addendum ("DPA") is part of the [Terms of
Service](/terms) between Truelabel Inc d/b/a TextKit
("TextKit") and the Customer, and applies whenever TextKit processes
Customer Personal Data. Capitalized terms not defined here have the meaning
in the Terms or in Data Protection Laws.

## 1. Definitions

- **Data Protection Laws:** all privacy and data protection laws that apply
  to the processing, including the GDPR, UK GDPR, Swiss FADP, the CCPA as
  amended by the CPRA, and other US state privacy laws.
- **Customer Personal Data:** personal data within Customer Content,
  including recipient phone numbers, message content and metadata, contact
  records, and consent records, that TextKit processes on the Customer's
  behalf.
- **Account Data:** information about the Customer's account, users, and
  billing, which TextKit processes as an independent controller under its
  [Privacy Policy](/privacy) and which this DPA does not cover.

## 2. Roles and Instructions

The Customer is the controller (or business) and TextKit is the processor
(or service provider) of Customer Personal Data. TextKit processes it only
on the Customer's documented instructions, which are the Terms, this DPA,
and the Customer's use and configuration of the Service, unless the law
requires otherwise (in which case TextKit will tell the Customer first,
unless the law forbids it). TextKit will tell the Customer if it believes
an instruction violates Data Protection Laws. The Customer is responsible
for the lawfulness of the data it provides and for having the consent or
other legal basis needed to message each recipient.

## 3. Permitted Purposes

TextKit processes Customer Personal Data only to provide, secure, and
support the Service; to detect and prevent fraud, spam, and abuse and to
enforce the Messaging Policy; to honor opt-outs; and to comply with law.
TextKit may create aggregated or de-identified data that cannot reasonably
identify any person, and will not attempt to re-identify it.

## 4. US State Law (CCPA) Terms

As a service provider, TextKit will not sell or share Customer Personal
Data; retain, use, or disclose it for any purpose other than the business
purposes in Section 3, or outside the direct business relationship with the
Customer; or combine it with personal data from other sources except as Data
Protection Laws permit. TextKit will provide the same level of protection
the law requires of the Customer, will notify the Customer if it can no
longer meet these obligations, and allows the Customer to take reasonable
steps to stop and remediate unauthorized use. TextKit certifies that it
understands these restrictions.

## 5. Confidentiality and Personnel

TextKit ensures that everyone authorized to process Customer Personal Data
is bound by confidentiality obligations and has access only as needed.

## 6. Security

TextKit maintains the technical and organizational measures in Annex 2 and
may update them, provided the overall level of protection does not decrease.

## 7. Subprocessors

The Customer authorizes TextKit to use the subprocessors described on the
[Subprocessors](/subprocessors) page. TextKit will give the Customer the
named list on request to support@joinsimplesms.com; it is confidential information.
TextKit imposes data protection terms on each subprocessor that protect
Customer Personal Data at least as well as this DPA, and is liable for its
subprocessors' performance.

TextKit will give at least 10 days' notice before a new subprocessor
processes Customer Personal Data, to Customers who have asked for notices at
support@joinsimplesms.com. The Customer may object on reasonable data protection
grounds within that period; the parties will then work in good faith toward
a solution, and if none is found the Customer may terminate the affected
Service and receive a refund of prepaid fees for it. Where a change is
needed urgently to keep the Service running or secure, TextKit may make it
first and notify promptly afterward.

## 8. Assistance

Taking into account the nature of the processing, TextKit will assist the
Customer with requests from individuals exercising their rights, with data
protection impact assessments and prior consultations, and with security
obligations. TextKit will promptly forward requests it receives directly
from an individual about Customer Personal Data and will not answer them
itself except to confirm the request was forwarded or as the law requires.
Recipients' STOP replies are honored automatically, as the Customer
instructs by using the Service.

## 9. Personal Data Breaches

TextKit will notify the Customer without undue delay, and in any case
within 72 hours, after confirming a breach of security leading to the
accidental or unlawful destruction, loss, alteration, unauthorized disclosure
of, or access to Customer Personal Data. The notice will describe the
breach, the data and individuals affected as far as known, its likely
consequences, and the measures taken, and TextKit will update it as it
learns more. Notifying the Customer is not an admission of fault.

## 10. Deletion and Return

During the subscription the Customer can export its data through the API,
and delete or redact individual messages through it ([Data
Retention](/data-retention) "Deleting sooner" lists what each removes and
what is kept).
The subscription ends when the Customer's account is closed (Terms §13).
Within 90 days after the subscription ends, TextKit will delete Customer
Personal Data, except for copies the law requires it to keep, opt-out and
consent records kept to enforce suppression and defend claims, and data in
backups, which are deleted on their normal cycle. Deletion starts 30 days
after closing, so that a mistaken closure can be reversed at the
Customer's request; until then the Customer can still read and export its
data in the console. Retained data remains protected by this DPA.

## 11. Audits

TextKit will make available the information reasonably necessary to
demonstrate compliance with this DPA, including by answering security
questionnaires. If that is not sufficient, or a regulator requires it, the
Customer may audit TextKit's compliance once per year, at its own cost,
with 30 days' notice, during business hours, under confidentiality, and in a
way that does not compromise other customers' data.

## 12. International Transfers

TextKit processes Customer Personal Data in the United States. For
transfers from the EEA, the EU Standard Contractual Clauses (Commission
Decision 2021/914) are incorporated by reference: Module 2 where the
Customer is a controller, Module 3 where it is a processor, with clause 7
(docking) included, option 2 (general authorization) in clause 9 with the
notice period in Section 7, the optional language in clause 11 omitted, Irish
law and courts in clauses 17 and 18, and Annexes I and II completed by
Annexes 1 and 2 of this DPA. For transfers from the UK, the UK International
Data Transfer Addendum is incorporated, with the Clauses above as the
approved EU SCCs. For transfers from Switzerland, the same Clauses apply with
the Swiss FADP in place of the GDPR and the FDPIC as the competent authority.

## 13. General

Each party's liability under this DPA is subject to the limits in the Terms,
except where Data Protection Laws do not allow it. If this DPA conflicts with
the Terms, this DPA governs as to Customer Personal Data; if it conflicts
with the Standard Contractual Clauses, the Clauses govern. This DPA lasts as
long as TextKit processes Customer Personal Data.

## Annex 1: Description of Processing

- **Data subjects:** the Customer's message recipients and contacts,
  people who message the Customer's numbers, people who sign up on an
  opt-in page TextKit hosts for the Customer, and people the Customer
  sends verification codes to by email.
- **Categories of data:** phone numbers; email addresses the Customer sends
  verification codes to; message content and media;
  message metadata (timestamps, IDs, delivery status, carrier and routing
  information, tags the Customer attaches) and delivery statistics derived
  from it; contact attributes
  the Customer stores (names, email addresses, company, state or province,
  tags, custom fields, notes, source, the import a contact came from, the
  lists it is in, and its id in a tool the Customer connected), the lists,
  segments and subscription topics the Customer defines, data the Customer
  directs TextKit to read from tools it connects (the same contact
  attributes and the SMS consent state the tool records, and, for an online
  store with a cart-reminder, order or shipping automation, its abandoned
  checkouts, new orders and shipments: phone number, checkout link, order
  number and status link, total, items, and tracking number, link and
  carrier), and which
  broadcasts a number was included in; opt-in, opt-out, and consent records,
  including who changed them, opt-in evidence the Customer records (source,
  time, page, disclosure wording, IP address, user agent, the registration
  the opt-in was given for, the inbound message for a keyword opt-in) and
  the same evidence for sign-ups on an opt-in page TextKit hosts for the
  Customer, with the text asking them to confirm and their reply,
  re-confirmation texts sent on the Customer's behalf and the
  reply or its absence,
  and each number's
  subscription preference per topic; verification outcomes; lookup
  results; records the Customer keeps about its own customers in the
  customers API (names, identifiers, metadata) and per-customer usage counts;
  events the Customer sends about its users for automations (event names,
  the Customer's user identifiers, phone numbers, and event properties) and
  the record of each automation run; the recurring schedules the Customer
  creates (recipient phone number, message text, and repeat rule) and the
  record of each occurrence; when the Customer uses link shortening, the
  links in its messages and counts of when and on what kind of device they
  were opened (no IP address or user agent kept); and any personal data the Customer
  includes in the example messages it writes for a registration, and in the
  filed copies of them (examples should use made-up names and values).
- **Sensitive data:** none intended. The Customer must not send special
  category data, payment card data, government ID numbers, or protected
  health information (Terms §6.5).
- **Frequency:** continuous, for the duration of the subscription.
- **Nature and purpose:** transmitting and receiving messages, sending and
  checking verification codes by text or email, provisioning numbers, storing message history for the Customer,
  screening for fraud and abuse (automatically, and by TextKit staff who
  review new kinds of message during an account's first 30 days of live
  sending), checking that each new kind of message matches the registration
  or toll-free verification it is sent under (automatically, and by staff
  when the check cannot tell), enforcing opt-outs, and support.
- **Retention:** as set out in [Data Retention](/data-retention) and
  Section 10.
- **Subprocessors:** as set out on the [Subprocessors](/subprocessors) page,
  for the same nature and purpose.
- **Exporter:** the Customer. **Importer:** Truelabel Inc, based in
  Nashville, Tennessee; registered office 5830 E 2nd St, Ste 7000, PMB 35111, Casper, WY 82609, USA;
  privacy@joinsimplesms.com.

## Annex 2: Security Measures

- Encryption of data in transit (TLS) and at rest.
- API keys never stored in plain text: looked up by keyed hash under a
  server-held secret, and kept encrypted (AES-256-GCM) under a separate
  server-held key so the Customer's admins can view them in the console, each
  view recorded in the Customer's audit log; the encrypted copy deleted when
  a key is revoked or rolled. Keys rotatable at any time and restrictable to
  scopes. Verification codes stored only as hashes, salted with their record
  identifier.
- Customer-side access control: admin, member, and read-only viewer roles,
  and an audit log of account changes (keys, team, webhooks, spend limits,
  numbers, consent overrides, settings) recording the actor, time, and IP
  address, available to the Customer's admins.
- Access to production systems limited to personnel who need it, with
  strong authentication, and logged. Changes our staff make to a customer
  account are made under the staff member's own sign-in and logged with who
  made them and why. When our support staff look at a customer's account as
  the customer sees it, the view is read-only, lasts at most 30 minutes, is
  opened under the staff member's own sign-in, and is recorded in the
  Customer's audit log.
- Separate test and live environments: test keys cannot send carrier
  traffic, and each key sees and changes only its own environment's data;
  once an account is live, data both environments share needs a live key,
  and a webhook endpoint receives only its own environment's events.
- Signed webhooks so customers can verify that events come from TextKit.
- Automated fraud and abuse monitoring, rate limits, and content screening.
- Logs designed to exclude message content and verification codes where
  they are not needed.
- Subprocessors selected for their security practices and bound by data
  protection terms.
- An incident response process with customer notification as in Section 9.

## Contact

Truelabel Inc (d/b/a TextKit), a Wyoming corporation based in Nashville, Tennessee.
Registered office and mailing address: 5830 E 2nd St, Ste 7000, PMB 35111, Casper, WY 82609, USA.
support@joinsimplesms.com