Data processing agreement

Version 1.1. Last updated 31 October 2026.

This agreement (the DPA) covers the personal data of your clients that Mozee holds for you. It sets out what Article 28 of the GDPR requires, in plain words. Our privacy policy explains the rest.

1. Who is who

You, the pro who uses Mozee, are the controller. You decide why your clients' data is used.
MOZEE LLC, a Delaware limited liability company, is the processor. We handle the data for you, only as this DPA says.

2. When it applies

This DPA is part of the agreement between you and MOZEE LLC for using Mozee. It applies from the moment you use Mozee to take bookings, and lasts as long as we hold your clients' data. There is nothing to sign.

If this DPA and any other Mozee terms disagree on data protection, this DPA wins.

3. The processing

3. The processing
Item	Details
Subject matter	Taking bookings from your clients through Mozee
Duration	While your account exists, then until copies age out: 30 days in backups, 37 days at Resend
Nature and purpose	Showing your booking page, storing bookings, sending booking emails to you and your clients, adding bookings to your calendar once you connect one, and stopping fake bookings
Types of data	Client name, email address, time zone, language and region setting, and booking times and type
Data subjects	People who book time with you, and people you book through Mozee

4. What we do as processor

(a) We process your clients' data only on your documented instructions. Your instructions are this DPA and the way you set up and use Mozee, transfers outside the EU included. If the law makes us do something else, we tell you first, unless the law forbids that. If we think an instruction breaks data protection law, we tell you.
(b) Everyone who can reach the data has a duty to keep it confidential.
(c) We keep the data secure with the measures in section 6.
(d) We use only the subprocessors in section 7, under the rules there.
(e) We help you answer clients who use their GDPR rights. If a client writes to us, we pass the request to you.
(f) We help you meet your duties on security, breach notices, data protection impact assessments and talks with supervisory authorities, as far as our role and the information we have allow.
(g) When you stop using Mozee and ask us to delete your account, we delete your clients' data. If you ask before then, we send you a copy first. Copies age out of backups within 30 days and out of Resend within 37 days. We keep data longer only if EU or member state law requires it.
(h) We give you the information you need to show we meet these duties, and we allow and help with audits, inspections included, by you or an auditor you choose. Ask at support@mozee.co.

5. Data breaches

If we learn of a breach of your clients' data, we tell you without undue delay. We tell you what happened, which data and roughly how many people it touches, what it may lead to, what we did about it, and who to contact. If we do not know everything yet, we tell you what we know and send the rest as we learn it.

6. Security measures

EU hosting: the app and the database run at Render in Frankfurt, Germany. The nightly backup goes to Scaleway in Amsterdam, the Netherlands.
Encryption in transit: Mozee's pages, and Mozee's calls to Resend and to the backup storage, use TLS.
Encryption at rest for tokens: calendar access and refresh tokens are encrypted in the database.
The database is reachable only on Render's private network. Its list of outside addresses allowed in is empty.
Least privilege: each service key does one job. The email key can only send email from Mozee's domain, and the backup key reaches only the backup storage.
Backups: point-in-time restore at Render, plus a nightly copy kept up to 30 days.
Logs: Mozee masks email addresses and leaves out names, IP addresses and tokens before a log line is written.
Sign-in sessions keep no IP address and no browser details.

7. Subprocessors

You allow us to use the subprocessors below. Each is bound by a contract with data protection duties that match this DPA. Before we add or replace one, we tell you by email and update this page, and you can object. If we cannot solve your objection, you can stop using Mozee and we delete your data. We stay responsible to you for our subprocessors' work.

Render
What it does
Runs the Mozee app and its database, with short-term backups and request logs.
Where
Frankfurt, Germany
Data
All Mozee data.
Resend
What it does
Sends Mozee emails: sign-in codes and booking emails.
Where
Sends from Ireland. Stores account data, email records and logs in the United States.
Data
Each email: the address it goes to, the names in it and the booking details.
Better Stack
What it does
Keeps our logs and checks that Mozee is up.
Where
EU
Data
Log lines with account and booking ids. Mozee masks email addresses and leaves out names, IP addresses and tokens before a line is written.
Scaleway
What it does
Stores the nightly backup of the database.
Where
Amsterdam, the Netherlands
Data
A full copy of the database.
Microsoft
What it does
Sign-in with Microsoft. Later, the calendar sync you turn on.
Where
Where Microsoft keeps your Microsoft account
Data
Your Microsoft account details. Once calendar sync ships: when you are busy, and the events for your Mozee bookings.
Cloudflare
What it does
Runs DNS for mozee.co and passes on emails sent to support@mozee.co.
Where
Global network
Data
Emails you send to support@mozee.co, on their way to us.
GitHub
What it does
Stores the source code of Mozee.
Where
United States
Data
No personal data.

8. Transfers outside the EU

MOZEE LLC is in the United States. Where the GDPR applies to you and our access to the data counts as a transfer, the Standard Contractual Clauses the European Commission adopted in 2021 (Implementing Decision (EU) 2021/914), Module Two (controller to processor), apply and are part of this DPA by reference. You are the data exporter and we are the data importer.

Clause 7 (docking) does not apply.
Clause 9: option 2, general written authorisation, with notice as in section 7.
Clause 11: the optional wording does not apply.
Clause 13: the supervisory authority of the member state where you are established.
Clause 17: option 2, the law of the member state where you are established.
Clause 18: the courts of that member state.
Annex I is sections 1 and 3 of this DPA, Annex II is section 6, and Annex III is section 7.

Resend, our email subprocessor, sends from Ireland but stores its record of each email and its logs in the United States. Resend's data processing agreement covers that transfer with the Standard Contractual Clauses, and says Resend follows the EU-US Data Privacy Framework.

If this DPA and the clauses disagree, the clauses win.

9. Governing law

The law of the State of Delaware governs this DPA, except where the Standard Contractual Clauses or the GDPR require EU or member state law. If a part of this DPA is invalid, the rest still applies.