Data Processing Agreement (DPA)

Last updated: November 2026

Draft — to be reviewed by counsel before publication. This document is not legal advice and may change.

This agreement applies to personal data Squadre processes on behalf of your business and forms part of the Terms. You are the controller (the "database owner" under Israeli law); Squadre is the processor (the "holder") acting on your behalf and on your instructions.

1. What is processed and why

Data about your business's customers and team: names, phone numbers, email addresses, channel identifiers, message content, booking and task details. The only purpose is providing the Service: showing conversations, sending messages, running agents and automations, and analytics for your business.

2. Controller instructions

We process data only on your documented instructions — your account settings, the Terms and this agreement. If an instruction appears to us to breach the law, we will tell you.

3. Confidentiality and access

Access is limited to people who need it for operations and support, under a duty of confidentiality. We do not access conversation content except for support you requested, incident handling or a legal obligation.

4. Security

We apply measures in line with the Israeli Privacy Protection (Data Security) Regulations, 2017:

Encryption in transit, and encryption at rest for channel tokens
Full logical isolation between businesses
Role-based access control and revocable sessions
Action logging and backups

5. Sub-processors

You authorise the sub-processors below. We will give notice before adding or replacing one, and you may object on reasonable grounds.

Railway — hosting and database (USA)
Anthropic — AI model processing (USA)
Meta — WhatsApp, Instagram and Messenger, for the channels you connect
Cloudflare — DNS
PMS systems and channel providers you choose to connect

6. Transfers outside Israel

Data is stored and processed in the United States. Transfers follow the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations, to sub-processors committed to protecting the data. For EU customers we will attach Standard Contractual Clauses on request.

7. Security incidents

We will notify you without undue delay, and no later than 72 hours after becoming aware, of a serious security incident affecting your data, with the details you need to meet your own reporting duties.

8. Data subject rights

We will help you respond to access, correction and deletion requests. A request that reaches us directly from one of your customers will be forwarded to you.

9. Termination, deletion and audit

When the engagement ends you can export the data. After 30 days it is deleted, except what the law requires us to keep.

On reasonable request, and no more than once a year, we will provide information showing compliance with this agreement.