Data Processing Agreement

Mushy’s commitments as a processor of the personal data in your workspace, for businesses that need a data processing agreement. The Owner accepts it in the app under Settings › Data.

Current version 1.0 · Effective October 26, 2026

Under legal review

This Data Processing Agreement (“DPA”) is between EcoEarth Enterprises, Inc., a Delaware corporation based in Austin, Texas, which provides Mushy (“Mushy”, “we”, “us”), and the customer that accepts it for a workspace (“you”). It forms part of the Terms & Conditions and covers the personal data Mushy processes for you.

This is version 1.0, drafted for review. Counsel’s version will replace it before Mushy opens to customers, and this version will stay online.

Scope

• Customer personal data: the personal data in your workspace that Mushy processes to run Mushy for you. That includes your members’ names and email addresses, your posts, drafts, media, replies, notes and reports, the comments on your connected channels with their commenters’ handles, names and photos, and your activity log.
• Roles: for customer personal data, you decide why and how it is processed, and Mushy processes it on your behalf.
• Mushy’s own data: the data Mushy uses for its own purposes, such as people’s sign-in details, billing records and Mushy’s own product analytics, is covered by the Privacy Policy instead.
• Duration: this DPA lasts as long as Mushy processes customer personal data for you.

[Counsel to complete: the parties’ roles for each kind of data, and the data protection laws this DPA follows.]

Instructions

• Mushy processes customer personal data only to run Mushy for you, as the Terms, this DPA and your use of the app direct, including what your members and your agents do in your workspace.
• Mushy never uses customer personal data to train models, never shares it between workspaces, never sells it and never uses it for advertising.
• Commenters’ data is processed only to help your workspace understand and answer the responses to its own posts.
• Mushy tells you if it believes an instruction breaks data protection law.
• Mushy helps you answer requests from people about their data: members export and delete their own data in the app, and Mushy deletes a commenter’s data across every workspace within 30 days of a verified request.

Confidentiality

• Everyone at Mushy who can process customer personal data is bound to keep it confidential.
• Mushy staff see a workspace’s content only through time-limited support access of 1, 4 or 24 hours.
• Support access notifies the workspace’s Owner and Admins by email and in the app as it starts, and the Owner or an Admin can end it at any time.
• Every action taken through support access appears in the workspace’s activity log as Mushy support, with the person’s name.
• The Owner can turn on Ask before support access, so that no grant starts without their approval.

Security

A summary of the measures Mushy takes to protect customer personal data:

• Workspace isolation: each workspace is a separate tenant, with row-level security on every database table, and every job, file path and cache entry belongs to one workspace. A test on every change signs in to one workspace and confirms nothing in another can be reached.
• Token vault: network sign-in tokens are sealed with a key pair for each workspace, whose private half is wrapped by Google Cloud Key Management Service. Tokens open only in the workers that publish and sync, and never appear in logs, in the browser or in anything sent to a model. Disconnecting a channel destroys its tokens, and deleting a workspace destroys its keys.
• Encryption: TLS for every connection, and databases, backups and files encrypted at rest.
• Sign-in: passkeys first, then email, Google or Apple, with no passwords. Sessions end after 30 days without use or 90 days in all, and sensitive actions ask for a fresh check. Mushy staff sign in to the admin console with passkeys only.
• API keys: shown once, stored hashed, revocable, and revoked automatically when a secret-scanning program reports one leaked.
• Approvals: agents can’t publish without a person’s approval, and no agent can raise its own permissions.
• Payments: Stripe’s hosted checkout and billing portal, so card details never reach Mushy.
• Backups: a nightly encrypted backup off-site to Google Cloud, kept 35 days under a locked retention policy, so no copy can be deleted or changed sooner.
• Monitoring: logs carry workspace and request IDs, never tokens, content or commenters’ data.
• Testing: dependency scanning on every change, and an external penetration test before any customer is admitted.

Sub-processors

• You authorize Mushy to use the companies on the sub-processor list, which names each one with its purpose, the data it handles and its data location.
• Mushy announces a new sub-processor at least 30 days before it starts processing customer personal data, and the list shows the new version as upcoming from then.
• Mushy binds each sub-processor to data protection terms that protect customer personal data at least as well as this DPA, and stays responsible for their work.

[Counsel to complete: how you can object to a new sub-processor, and what happens if you do.]

International transfers

Mushy stores customer personal data in the United States, in DigitalOcean’s New York region, with key management and off-site backups in Google Cloud’s us-east4 region in Northern Virginia. Where a sub-processor processes it elsewhere, the sub-processor list gives that location. Transfers of personal data from the European Union and other regions that require safeguards rely on terms counsel sets.

[Counsel to complete: Standard Contractual Clauses]

Breach notification

• If Mushy learns of a breach of security that affects customer personal data, it tells the workspace’s Owner and Admins by email without undue delay.
• The notice says what happened, what data and which people are affected, what Mushy has done about it and who to contact, and Mushy sends updates as it learns more.
• Mushy helps you meet any duty you have to tell regulators or the people affected.

[Counsel to complete: breach notice templates]

Deletion and return

• Return: an Admin can export the workspace’s data at any time.
• Deletion: when you delete your workspace, access ends at once and deletion completes within 30 days. Copies in backups roll off within 35 days.
• End of service: when the Terms end, Mushy deletes customer personal data within 30 days.
• Exceptions: Mushy keeps billing records for 7 years, as tax law requires, and anything else only where the law requires it.

Audits

• On request to support@, Mushy gives you the information you reasonably need to show that it meets this DPA.

[Counsel to complete: audit rights, their frequency, notice and cost, and the reports Mushy provides in place of an on-site audit.]

Acceptance

• The Owner accepts this DPA for the workspace in the app under Settings › Data. Mushy records who accepted it, the version and the time.
• When this DPA changes, the new version shows here as upcoming before it takes effect, and the Owner accepts it again on the same page.
• Every version stays online with its date, and the version history at the end of this page links each one.

Contact

EcoEarth Enterprises, Inc., Austin, Texas, USA. Email [email protected] about this DPA.