Data Processing Addendum
Template — last updated October 24, 2026
Note: This is a template. Enterprise customers should contact legal@moneymagic.app to execute a customized DPA. The template below incorporates GDPR Article 28 requirements for EU customers and CCPA service-provider terms for California customers.
1. Parties
This Data Processing Addendum ("DPA") is entered into between MoneyMagic, Inc. ("Processor") and the customer identified in the executed Order Form ("Controller"). This DPA supplements the Master Subscription Agreement between the parties.
2. Definitions
"Personal Data" means any information relating to an identified or identifiable natural person processed by Processor on behalf of Controller under the Agreement. "Processing" has the meaning given in GDPR Article 4(2). "Subprocessor" means any third party engaged by Processor to process Personal Data.
3. Scope of processing
Processor processes Personal Data only on Controller's documented instructions, including with regard to transfers of Personal Data to a third country, unless required to do so by law. The scope of processing is described in the Order Form and includes: account information (name, email), financial data entered by Controller's end users (account balances, transactions, budgets, retirement plans), and usage data (error reports, aggregate analytics).
4. Confidentiality and security
Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including: encryption of Personal Data at rest (AES-256-GCM) and in transit (TLS 1.2+); ongoing confidentiality, integrity, availability, and resilience of processing systems; ability to restore availability and access to Personal Data in a timely manner in the event of a physical or technical incident; regular testing and assessment of the effectiveness of security measures. Detailed measures are available in the MoneyMagic Security Overview.
5. Subprocessors
Processor engages the following subprocessors: Amazon Web Services (hosting), Stripe (payment processing), Plaid (bank data aggregation), Resend (transactional email), Sentry (error monitoring), PostHog (product analytics). Current list available at moneymagic.app/subprocessors. Controller may object to a new subprocessor by notifying Processor within 30 days of the change notice.
6. Data subject rights
Processor assists Controller with data subject requests to access, rectify, erase, restrict processing, port, or object. Controller is responsible for verifying the identity of the data subject and providing the response. Processor supports data export (JSON) and account deletion via the application's Settings page.
7. Breach notification
Processor notifies Controller of a Personal Data breach within 72 hours of becoming aware of it, providing: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Processor takes reasonable steps to contain the breach and mitigate its effects.
8. Data deletion on termination
On termination of the Agreement, Processor deletes all Personal Data within 30 days, except where retention is required by law (e.g., GLBA record-keeping requires 7-year retention of audit logs). Processor provides written certification of deletion on request.
9. Audit rights
Processor maintains SOC 2 Type II reports and makes them available to Controller on request under NDA. Controller may audit Processor's compliance with this DPA once per year with 30 days' notice, at Controller's expense, during normal business hours.
10. CCPA service provider terms
For California customers, Processor acts as a "service provider" under CCPA. Processor does not sell Personal Data, does not use Personal Data for any purpose other than providing the services, and does not combine Personal Data with data from other sources except as permitted by CCPA.
11. Contact
Processor's Data Protection Officer can be reached at privacy@moneymagic.app.