SunnyLoop
Data Processing Agreement
This Data Processing Agreement (“DPA”) forms part of the Merchant Terms between BrightJoy.AI LLC (“BrightJoy,” “we,” “us”) and the merchant. It covers personal information submitted to or generated in the service on that merchant’s behalf (“merchant data”).
Effective date: 2026-09-10
1. Roles, scope and instructions
The merchant determines the purposes and lawful basis for its customer and staff records and acts as controller or business where those legal terms apply. BrightJoy.AI LLC acts as processor or service provider for merchant data processed on its behalf. For our own account administration, billing, security and legal compliance, the Privacy Policy describes our separate role.
The Terms, settings and authorized use of the service are the merchant’s documented instructions. We process merchant data to perform the agreed service and lawful written instructions, or as required by law. If an instruction appears unlawful, we will inform the merchant and may pause it while the issue is resolved.
2. Processing details
Purpose and operations — hosting, organizing, retrieving and displaying customer records, membership/card balances and activity; calculating business summaries; authorized transaction notifications; support, maintenance and security. People concerned — the merchant’s customers, owners, employees and authorized users, and individuals named in records or connected calendar events. Data categories — names, phone numbers, optional email addresses, birthday month/day, notes, referral details, card and transaction records, staff attribution, business contact details, and connected calendar data where enabled. Duration — while providing the service and for any restricted retention required by lawful instructions, legal obligations or the return/deletion process below. Excluded data — full card numbers, passwords, government identifiers, regulated medical records and other sensitive information requiring an agreement or safeguards this service does not provide.
3. Merchant responsibilities
The merchant must provide required notices, establish a lawful basis, collect required consents, keep records accurate and limit data to what is necessary. It must control staff access, handle customer requests and give us instructions needed to assist. It must not treat consent to a login code as consent to unrelated merchant messages.
The merchant is responsible for lawfully sharing a connected calendar with its team and for information entered about children or other people. The service does not provide a parental-consent or specialized health-data workflow.
4. Use restrictions and confidentiality
We will not sell merchant data, share it for cross-context behavioral advertising, use it for our own marketing or train general-purpose AI models on it. We will not retain, use or disclose merchant data outside the specific service purposes in this DPA, outside our direct business relationship with the merchant, or for an unrelated commercial purpose, except as applicable law permits or requires. We will not combine it with personal information from other customers, third parties or our own interactions with individuals, except as applicable law permits for providing the agreed services. We will comply with applicable processor and service-provider obligations and provide the privacy protection those laws require.
People authorized to access merchant data must be subject to appropriate confidentiality duties and have access only as needed for their work. Google data is additionally subject to the Limited Use commitments in the Privacy Policy.
5. Security and incidents
We use technical and organizational safeguards appropriate to the processing, including access controls, tenant-scoped authorization, encrypted transport, encrypted production storage and encrypted Calendar tokens. The merchant remains responsible for its users, devices, lawful input and instructions.
If we become aware of a personal-data breach affecting merchant data, we will notify the merchant without undue delay and provide available information reasonably needed to assess the incident and meet legal obligations. Information may be supplied in stages. We will investigate and take reasonable mitigation steps; notice is not an admission of liability. The merchant is responsible for notices it must give to its customers or authorities, with our reasonable assistance.
6. Providers and integrations
The merchant authorizes providers necessary for the service. The current provider categories are AWS for infrastructure, Twilio for messages/verification, Sentry for enabled diagnostics, and Google for support email. Stripe processes the merchant’s own subscription and also has independent payment/legal responsibilities; Google Calendar is connected at the merchant’s direction. Each receives information only relevant to its role.
Where a provider processes merchant data for us, we require appropriate contractual data-protection obligations and remain responsible for our obligations under this DPA. We will identify material additions or replacements and give prior notice where required. A merchant may contact us with a reasonable data-protection objection; we will seek a resolution and explain whether continued use is possible. The Privacy Policy describes provider purposes and Google-specific restrictions.
7. Rights requests and accountability
We will reasonably assist the merchant with access, correction, deletion and other applicable privacy requests, taking account of the service and information available to us. Requests concerning the merchant’s data may be referred to the merchant; we will not disclose another business’s data to answer them.
We will make information reasonably needed to demonstrate our compliance available and cooperate with assessments or audits required by applicable law, subject to safeguards for security, confidentiality and other customers. If we can no longer meet these obligations, we will notify the merchant and cooperate to stop or remedy the affected processing. Send requests to hello@brightjoyai.com.
8. Return, deletion and retained records
On termination or a verified written instruction, we will cooperate to return or delete merchant data unless a law permits or requires continued retention. Coordinate the scope with support; there is currently no automatic account-erasure or complete data-export button. Canceling a subscription does not itself request deletion.
The service maintains an append-only card ledger. We will assess whether associated personal details can be removed or de-identified while preserving records that must lawfully remain. Ledger design alone does not justify keeping all identifiable data indefinitely. Retained data is restricted to its permitted purpose and remains protected. Backup copies are handled through their retention cycles and legal-hold requirements.
9. International processing and precedence
The service primarily hosts data in the United States, and providers may operate in other countries. We will use safeguards required for applicable transfers. This DPA does not by itself incorporate EU/UK standard contractual clauses or certify a transfer mechanism; a merchant requiring those arrangements must agree them with us before transferring affected data.
This DPA controls over conflicting Terms on the processing of merchant data. It does not reduce anyone’s mandatory privacy rights. Obligations that must continue for retained data survive termination.