Data Processing Agreement (DPA)
Last updated: February 6, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Reloop ("Processor", "we", "us") and you ("Controller", "you") and governs the processing of personal data by Reloop on your behalf.
1. Definitions
- Personal Data: any information relating to an identified or identifiable natural person
- Processing: any operation performed on personal data (collection, storage, use, deletion, etc.)
- Controller: the entity that determines the purposes and means of processing personal data (you)
- Processor: the entity that processes personal data on behalf of the Controller (Reloop)
- Subprocessor: any third party engaged by the Processor to process personal data
2. Scope of Processing
Reloop processes personal data on your behalf to provide the Service, including:
- Storing uploaded content (images, text, brand assets)
- Processing voice samples for voice cloning features
- Generating AI-powered ad creatives
- Managing your account and subscription
3. Obligations of the Processor
Reloop shall:
- Process personal data only on documented instructions from the Controller
- Ensure persons authorized to process personal data are bound by confidentiality obligations
- Implement appropriate technical and organizational security measures
- Assist the Controller in responding to data subject rights requests
- Delete or return all personal data upon termination of the Service, at the Controller's choice
- Make available all information necessary to demonstrate compliance with this DPA
- Not engage additional subprocessors without prior notice to the Controller
4. Security Measures
Reloop implements the following security measures:
- Encryption: TLS 1.2+ for data in transit, AES-256 for data at rest
- Access control: Role-based access, multi-factor authentication for internal systems
- Infrastructure: Hosted on trusted cloud providers with SOC 2 compliance
- Monitoring: Continuous monitoring and alerting for security events
- Incident response: Documented incident response procedures
5. Subprocessors
A current list of subprocessors is available on our Subprocessors page. We will notify you before adding new subprocessors, giving you the opportunity to object.
6. Data Transfers
Where personal data is transferred outside the European Economic Area (EEA), Reloop ensures appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions where applicable
7. Data Breach Notification
In the event of a personal data breach, Reloop will:
- Notify the Controller without undue delay (within 72 hours of becoming aware)
- Provide details of the breach, its likely consequences, and measures taken
- Cooperate with the Controller in fulfilling its notification obligations
8. Audits
The Controller may audit Reloop's compliance with this DPA, subject to reasonable notice and confidentiality obligations. Reloop will cooperate and provide necessary access and information.
9. Duration and Termination
This DPA remains in effect for the duration of the Service agreement. Upon termination:
- Reloop will delete all personal data within 30 days
- Backups will be purged within 90 days
- The Controller may request a data export before deletion
10. Contact
For questions regarding this DPA:
Email: help@reloop.so