1. Parties
This Data Processing Agreement ("DPA") is between:
Customer (the data controller)
ManyRequests (the data processor)
This DPA forms part of the Terms of Service.
2. Roles
The Customer decides what data is collected and why.
ManyRequests processes personal data only on behalf of the Customer.
3. Scope of processing
ManyRequests processes personal data to provide its software platform, including:
Managing client requests and projects
Storing and organizing customer data
Enabling communication between users and their clients
Types of data
Names, email addresses and contact details
Billing information
Content uploaded by users (messages, files, project data)
Technical data (IP address, logs)
4. Purpose of processing
Data is processed only to:
Provide and operate the ManyRequests platform
Maintain and improve the service
Keep the service secure and prevent abuse
ManyRequests does not use the personal data the Customer processes in its portal (for example, the Customer's clients and their requests) for its own marketing. We do send product and account emails to the Customer's portal owner about their ManyRequests account.
5. Customer responsibilities
The Customer agrees to:
Comply with applicable data protection laws
Only upload and process data they are legally allowed to use
Provide the necessary notices to their own users and clients
6. Subprocessors
ManyRequests uses trusted third-party providers to operate the service, such as AWS (hosting), Stripe (payments) and Postmark (email). The current list, with what each provider does and the data it processes, is on our Subprocessors page. These subprocessors:
Only process data as needed to provide their service
Are bound by data protection obligations
7. AI processing
Some features use AI providers listed on the Subprocessors page:
When a user asks AI to rewrite a comment or message, that draft is sent to the AI provider together with context: the request or conversation details and its most recent comments or messages, with the names and roles of who wrote them.
During portal setup, information about the Customer's agency (such as its name, agency type, team size and a public description of its website) is used to suggest services.
Outgoing emails can be screened automatically for spam and phishing.
This data is processed only to provide the feature.
8. International data transfers
Data may be processed outside the EU/UK. When this happens, ManyRequests uses appropriate safeguards, including Standard Contractual Clauses (SCCs).
9. Security
ManyRequests implements appropriate technical and organizational measures, including:
Secure cloud infrastructure
Access controls, including optional two-factor authentication
Encryption in transit where applicable
10. Data subject rights
ManyRequests helps Customers, where reasonably possible, respond to requests from data subjects, including:
Access
Correction
Deletion
Data portability
11. Data breaches
ManyRequests will:
Notify the Customer without undue delay after becoming aware of a personal data breach
Provide reasonable information to help the Customer meet its legal obligations
12. Data retention and deletion
Data is kept for as long as the Customer's account is active.
After cancellation, data is kept for 30 to 90 days and then deleted, unless the law requires otherwise.
13. Return or deletion of data
On request or at termination, Customer data will be deleted or returned where technically feasible.
14. Audits
Formal audits are not supported, but ManyRequests may provide reasonable information about its security practices on request.
15. Liability
Each party's liability is subject to the limitations set out in the Terms of Service.
16. Governing law
This DPA is governed by the same law as the Terms of Service.
17. Contact
For any data protection questions, contact our support team through the chat in your portal. See also our GDPR article.