Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Magic Money Funnel ("MMF", "we", the "Processor") and the customer that has created an organization account on the Platform ("Customer", the "Controller"). It applies whenever MMF processes Customer Data on the Customer's behalf.

For personal data your buyers and leads submit through funnel pages you publish with the Platform, you are the data controller and MMF is your data processor. For your own account data (name, email, billing identity), MMF is the controller, as described in the Privacy Policy.

"Customer Data" means personal data of the Customer's end customers, buyers, leads, and subscribers that is submitted to or collected by the Platform on the Customer's behalf — including names, email addresses, order and subscription records, and funnel activity events. Terms such as "personal data," "processing," "controller," "processor," and "data subject" have the meanings given to them in applicable data protection law (including, where applicable, the GDPR and CCPA/CPRA).

MMF processes Customer Data solely to provide the Platform's services: hosting funnel pages, capturing leads, recording orders and subscriptions, computing analytics, executing configured automations (such as outbound webhooks the Customer sets up), and providing the buyer self-service subscription manager. Processing lasts for the duration of the Customer's subscription plus the deletion window in Section 10.

Categories of data subjects: the Customer's buyers, leads, and subscribers. Categories of data: contact details (name, email), transaction records (products purchased, amounts, billing status), shipping addresses where the Customer sells physical goods, and funnel engagement events. Payment card data is never stored by MMF — card details are entered directly into Stripe's hosted elements and processed by Stripe on the Customer's connected Stripe account.

MMF processes Customer Data only on the Customer's documented instructions — which are, collectively: this DPA, the Terms, and the configuration choices the Customer makes in the Platform (funnels published, integrations connected, automations enabled). MMF will not use Customer Data for its own marketing, will not sell it, and will inform the Customer if, in its opinion, an instruction infringes applicable data protection law.

MMF ensures that persons authorized to process Customer Data are bound by confidentiality obligations. Access to Customer Data within MMF is restricted to what is necessary to operate, support, and secure the Platform.

MMF implements appropriate technical and organizational measures, including: tenant isolation enforced at the database layer (organization-scoped row-level security), authorization checks on all backend functions that access Customer Data, cryptographically signed tokens for buyer-facing payment actions, secrets held in managed environment storage rather than code, encrypted transport (TLS) for all traffic, and payment card data handled exclusively by Stripe (PCI-DSS Level 1). MMF reviews its security posture regularly, including with automated security scanning.

The Customer authorizes MMF to engage the subprocessors listed at magicmoneyfunnel.com/legal/subprocessors. MMF will update that page before adding or replacing a subprocessor and will provide notice of material changes; the Customer may object on reasonable data-protection grounds, in which case the parties will work in good faith toward a resolution, up to and including termination of the affected service.

Integrations the Customer connects and directs itself (for example outbound webhooks to CRMs, ad-platform pixels and conversion APIs, or email service providers) are service providers of the Customer, not subprocessors of MMF, and are governed by the Customer's own agreements with those vendors.

Taking into account the nature of the processing, MMF will assist the Customer with reasonable measures to respond to data subject requests (access, correction, deletion, portability) concerning Customer Data, and with the Customer's obligations regarding security, breach notification, and data protection impact assessments, insofar as the information is available to MMF.

MMF will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and will provide information reasonably required for the Customer to meet its own notification obligations, including the nature of the breach, categories and approximate volumes affected, likely consequences, and measures taken.

Upon termination of the Customer's subscription, MMF will, at the Customer's choice, delete or return Customer Data within 30 days, unless retention is required by law (for example, transaction records retained for tax and accounting purposes). The Customer may also request deletion of individual data subjects' records at any time via support.

MMF will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for audits, including inspections, conducted by the Customer or its mandated auditor — no more than once annually, on reasonable notice, during business hours, and without disrupting Platform operations. Where possible, audit requests will first be satisfied with existing documentation and third-party attestations (for example, Stripe's PCI attestations and the hosting provider's security documentation).

Customer Data is hosted and processed in the United States by MMF's hosting subprocessor. Where applicable data protection law requires a transfer mechanism for data originating elsewhere (for example, EU/UK data subjects), the parties agree that the applicable standard contractual clauses are incorporated by reference. [ATTORNEY REVIEW: confirm SCC module selection and UK addendum if EU/UK customers are onboarded.]

Each party's liability under this DPA is subject to the limitations of liability in the Terms. In the event of a conflict between this DPA and the Terms with respect to the processing of Customer Data, this DPA prevails.

Data protection inquiries and requests: