Data Processing Addendum
Effective: Last updated 2026-09-19 · Version: 2026-09-19
1. Roles
For personal data our customer puts into the Service about its own leads, customers, staff, and contacts ("Customer Data"), the customer is the controller (or, where it is itself a processor, the instructing party) and Javill Byron, doing business as Tomonagi is the processor. For account data about the customer's own users (names, emails, billing, usage), we are the controller and the Privacy Policy applies instead.
2. Our instructions
We process Customer Data only to provide, secure, support, and improve the Service as described in the Terms, and as you further instruct through the features you use (for example, when you schedule an email, you instruct us to send it). We will not process Customer Data for our own purposes, sell it, or use it to train artificial-intelligence models. If we believe an instruction breaks the law, we will tell you rather than follow it.
3. Confidentiality and our people
Only people who need access to operate or support the Service can reach Customer Data, and each is bound by confidentiality obligations. Support staff access a customer's workspace only when the customer asks for help or when needed to investigate abuse or an incident, and that access is logged.
4. Sub-processors
We use the sub-processors listed at /legal/subprocessors. Each is bound by written terms that protect Customer Data at least as well as this addendum. We will update that page before adding a new sub-processor; if you object on reasonable data-protection grounds within 30 days of the update and we cannot resolve the objection, you may terminate the affected part of the Service without penalty.
5. Security
We maintain the technical and organizational measures described in the Security Overview at /legal/security, including encryption in transit and at rest, tenant isolation on every database query, role-based access within a workspace, encrypted storage of connected-account tokens, and an audit log of administrative actions. We review these measures as the Service changes and will not materially reduce them during your subscription.
6. Personal-data breaches
If we confirm a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data, we will notify you without undue delay and in any case within 72 hours of confirming it, with what we know about the nature of the breach, the data and people affected, the likely consequences, and the steps we have taken. We will keep you updated as we learn more and assist you with any notification you must make.
7. Helping you meet your obligations
The Service gives you the tools to answer most data-subject requests yourself: you can view, correct, export, and delete records in your workspace, and the export at Admin → Backup produces a complete machine-readable copy. Where a request needs our help, we will assist within a reasonable time. We will also provide the information reasonably needed for your impact assessments and consultations with regulators.
8. Return and deletion
You may export Customer Data at any time while your account is active. When your subscription ends, your data is held in a read-limited state for up to 90 days so you can export or reactivate, then deleted, unless the law requires us to keep it. Backups roll off on their own schedule after that. On your written request we will confirm deletion.
9. Audits
On written request, no more than once a year unless a regulator or an incident requires otherwise, we will provide the documentation reasonably needed to show compliance with this addendum. If that is not enough to meet a legal obligation you have, we will discuss a further review at a mutually agreed time and scope, at your cost.
10. International transfers
The Service is hosted in the United States. If you are subject to a law that restricts transfers out of your jurisdiction, we will rely on the transfer mechanism that law recognizes, such as standard contractual clauses, and will enter into those clauses with you on request.
11. Precedence and contact
Where this addendum and the Terms of Service conflict about personal data, this addendum wins. Questions: jbyron@tomonagi.com, Javill Byron, doing business as Tomonagi, 16300 SW 137 Ave, Unit 130, Miami, FL 33177, USA.