Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Mugavi Terms of Service between you ("Controller") and Mugavi, Inc. ("Processor"). It applies to the extent that Mugavi processes Personal Data on your behalf when you use the A/R automation service.

Mugavi processes two categories of data: (a) Customer Data: invoices, customer contact information, payment history, and dunning messages you provide or authorize us to pull from connected accounting systems; and (b) Service Data: telemetry, account information, and audit logs needed to operate the service.

Mugavi processes Customer Data only on your documented instructions, including:

• Syncing invoices, customers, and payments from connected systems (QuickBooks, Xero, Stripe, Square, Plaid).
• Generating dunning messages and cash-flow forecasts using a paid Google Gemini API. Google's terms for paid services state that submitted prompts and responses are not used to train its models; retention depends on the applicable service terms and account configuration.
• Sending emails and SMS on your behalf through Resend and Twilio.
• Storing Customer Data for as long as your account is active.

Mugavi uses the following sub-processors. You can subscribe to changes at dpa@getcollectly.app.

• Vercel: application hosting.
• Microsoft Azure: managed Postgres database (Azure Database for PostgreSQL).
• Clerk: authentication and identity.
• Resend: transactional email delivery.
• Twilio: SMS delivery.
• Google (Gemini): AI message generation. Paid-tier API; not used for model training. See processing instructions above for retention detail.
• PostHog: product analytics. Receives account identifiers (user ID, organization ID) and standard web-analytics data (pages viewed, device/browser info, approximate location from IP); never receives invoice, customer, or payment content.
• Upstash: Redis-backed rate limiting and caching.

Self-serve accounts are currently processed in a single region (US). For transfers from the EEA, UK, or Switzerland to a third country, Mugavi relies on the European Commission's 2021 Standard Contractual Clauses (Module 2: Controller-to-Processor) and the UK International Data Transfer Addendum. A copy of the executed SCCs is available on request.

Mugavi implements technical and organizational measures to protect Customer Data, including: TLS 1.2+ in transit, org-scoped queries, sign-in through Clerk, and an events log of key actions. The current security posture is published on our Security page.

Mugavi will assist you in responding to data-subject requests (access, rectification, deletion, portability, objection) within 10 business days. The account owner or an admin can download customers, invoices, reminders and statements as a ZIP of CSV files from Settings; for anything outside that, ask us and we will provide it as part of the same request process. The account owner can delete the account from Settings: Customer Data is removed from the live database immediately, and backups rotate out on a 30-day cycle.

Mugavi will notify affected Controllers without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data breach affecting Customer Data. Notification will include the information required by GDPR Article 33(3) to the extent available.

On termination of your account, Mugavi will delete all Customer Data within 30 days, except where retention is required by law (e.g. tax records, AML logs). Backups rotate on a 30-day cycle.

Disconnecting an accounting system from the Integrations page asks the provider to revoke our access and deletes the stored tokens. Customer Data already imported stays until you remove it or delete the account, which also asks the provider to revoke access.