Last updated October 7, 2026
This is a template, not a signed agreement. It describes the terms on which VOpilot will process personal data on your behalf. It becomes binding only when executed by both parties. If your organization requires a countersigned DPA, email support@vopilot.co. Please have your own counsel review it before relying on it.
This Data Processing Addendum (“DPA”) supplements the VOpilot Terms of Service (the “Agreement”) between the customer (“Customer,” the data controller) and VOpilot (the data processor), and applies to VOpilot's processing of personal data on Customer's behalf.
Customer is the controller of the personal data it submits to VOpilot; VOpilot is the processor and processes that data only to provide the service and on Customer's documented instructions (including as set out in the Agreement and this DPA), unless required by law.
Subject matter & duration: processing for the term of the Agreement plus the retention periods described in Section 9.
Nature & purpose: hosting, organizing, parsing, and presenting the records Customer creates or forwards (jobs, auditions, invoices, contacts, expenses, residuals, payments), and sending email Customer initiates.
Categories of data subjects: Customer and its clients, agents, end clients, and contacts.
Types of personal data: names, email addresses, phone numbers, postal/billing addresses, business and payment-status details, and the contents of emails Customer forwards.
VOpilot will: (a) process personal data only on Customer's documented instructions; (b) ensure persons authorized to process the data are bound by confidentiality; (c) implement appropriate technical and organizational security measures (see Section 5); (d) assist Customer, taking into account the nature of processing, with data-subject requests and with its own security and breach obligations; and (e) make available information reasonably necessary to demonstrate compliance with this DPA.
Customer authorizes VOpilot to engage the following sub-processors, which are also listed on our Security page:
Microsoft and Google come in only if you choose to connect an Outlook mailbox or your Google contacts under Contacts → Add from email. We then read from your account with the permission you grant, and you can disconnect at any time. Likewise, a calendar you add on the Planner (from Google, Outlook, iCloud, or elsewhere) is fetched from the private address you paste in, until you remove it.
VOpilot uses each sub-processor under terms that limit its use of the data and remains responsible for its performance. VOpilot will give Customer notice of any new sub-processor before it processes Customer's personal data, by email to the address on Customer's account, and a reasonable opportunity to object on legitimate grounds.
VOpilot maintains technical and organizational measures appropriate to the risk, including: tenant isolation via database row-level security; encryption in transit (TLS) and at rest (by its database provider); field-level encryption of mailbox access tokens; encrypted backup copies kept for 30 days; access to production systems limited to the people who run VOpilot; and an access log in the application that shows Customer some operator access (changes to plan access, and maintenance scripts that record their reads and repairs). The access log is not a complete record of operator access. The application offers two-step login with an authenticator app: optional for Customer's users, and required for VOpilot staff to open the application's admin area. Operator accounts at the hosting and database providers (Vercel, Supabase) require two-step login. A current description, including these limits, is published on our Security page.
VOpilot will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer's data, and will provide information reasonably available to help Customer meet its own notification obligations.
Taking into account the nature of the processing, VOpilot will assist Customer with appropriate measures to respond to requests from data subjects to exercise their rights. Customer can fulfill most such requests directly through the application.
Where personal data is transferred across borders, the parties will rely on a lawful transfer mechanism (such as the applicable Standard Contractual Clauses), which are incorporated by reference where required.
During the Agreement. Stored copies of emails Customer forwards to VOpilot are kept to process them and to read them again at Customer's request: their contents are deleted 30 days after processing, and their sender, subject, and outcome 180 days after receipt. Records Customer creates are kept until Customer deletes them.
Return. While Customer's plan is active, Customer can export its data with the application's export tools. Before deletion, and on Customer's request (including after Customer's plan has ended, when those tools are no longer available to it), VOpilot will provide a copy of Customer's personal data that Customer cannot export itself.
Deletion. When Customer deletes its account, or on Customer's written request at the end of the Agreement, VOpilot deletes Customer's personal data from the application's database and file storage. Copies VOpilot cannot tie to Customer's account (such as an email to VOpilot's support address sent from another address) are deleted on the schedules above or on request; VOpilot's log of Stripe's payment notices is deleted, and any detail in its background-job logs cleared, within 180 days. Copies in backups are deleted as the backups expire: within 7 days for its database provider's backups, and within 30 days for VOpilot's own encrypted backups. Copies made before October 7, 2026 may also remain, encrypted, in the backups of the computer that makes VOpilot's backups until they age out. Sub-processors keep data according to their own terms, as summarized in our Privacy Policy. Retention required by law is excepted.
This DPA forms part of the Agreement. In the event of a conflict regarding the processing of personal data, this DPA controls. The liability terms of the Agreement apply to this DPA.
To put this DPA in place for your organization, contact support@vopilot.co. Both parties' authorized signatures are required for it to take effect.