NewYour apps can now ship to the app storesShip your apps to the app stores
Legal  ✦

Data Processing Agreement

Privacy PolicyTerms of ServiceDPASub-processors

Data Processing Agreement

How Whacka processes data on behalf of app publishers.

Last updated: May 13, 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Promnes Lane Technology Inc, doing business as Whacka (“Processor,” “we,” or “us”), and you (“Controller,” “you”), and governs the processing of personal data by Whacka on your behalf.

By using the Service to publish apps that collect or process end-user data, you agree to this DPA. No separate signature is required.

1. Definitions

  • “Personal Data” means any information relating to an identified or identifiable natural person, as defined by applicable data protection laws including the GDPR.
  • “Processing” means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, and deletion.
  • “App Data” means Personal Data collected through a published app from its end users.
  • “Sub-processor” means a third party engaged by the Processor to process Personal Data on behalf of the Controller.
  • “GDPR” means the General Data Protection Regulation (EU) 2016/679.
  • “SCCs” means the Standard Contractual Clauses approved by the European Commission.

2. Roles and scope

  • You (Controller): You determine the purposes and means of processing Personal Data collected through your published apps. You are responsible for ensuring a lawful basis for data collection within your apps and for providing appropriate privacy notices to your end users.
  • Whacka (Processor): We process App Data solely on your behalf to operate your published apps. We also act as an independent controller for your account data (email, profile, billing), which is governed by our Privacy Policy.
  • Scope: This DPA applies to all App Data processed through Whacka’s infrastructure in connection with your published apps.
  • Duration: This DPA remains in effect for as long as you have an active Whacka account with published apps.

3. Processor obligations

Whacka shall:

  • Process Personal Data only on your documented instructions. Using the Service constitutes your instruction to process App Data as necessary to operate your published apps.
  • Ensure that persons authorized to process Personal Data are bound by confidentiality obligations.
  • Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
    • Encryption of data in transit (TLS/HTTPS) and at rest.
    • Access controls through Row Level Security policies on the database.
    • Regular review of security practices.
    • Secure credential storage (password hashing via Supabase Auth).
  • Assist you, taking into account the nature of processing, in responding to requests from data subjects exercising their rights under applicable data protection laws.
  • Assist you in ensuring compliance with data security, breach notification, data protection impact assessments, and prior consultation obligations.
  • At your request, delete or return all Personal Data after the end of the provision of services, unless applicable law requires retention.
  • Make available to you all information necessary to demonstrate compliance with this DPA. You may request a summary of our current security measures by contacting [email protected].

4. Sub-processors

  • A current list of sub-processors is maintained at whacka.app/legal/subprocessors.
  • We will notify you of any intended changes to our sub-processors by updating the sub-processors page at least 14 days before the change takes effect.
  • If you object to a new sub-processor, you may discontinue use of the Service. Continued use after the 14-day notice period constitutes acceptance of the new sub-processor.
  • We ensure that each sub-processor is bound by data protection obligations no less protective than those in this DPA.

5. Data breach notification

  • We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data processed on your behalf.
  • The notification will include the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed to address the breach.

6. International data transfers

  • Personal Data is stored in the United States (AWS us-west-2, Oregon).
  • For transfers of Personal Data from the EEA to the US, the parties agree to the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (Controller to Processor), which are incorporated into this DPA by reference.
  • For the purposes of the SCCs:
    • The “data exporter” is you (Controller).
    • The “data importer” is Whacka (Processor).
    • The governing law is that of the EU Member State in which the data exporter is established, or where the data exporter is not established in the EU, the laws of Ireland.
    • Disputes shall be resolved before the courts of the same jurisdiction.
    • The optional docking clause (Clause 7) is included, allowing additional parties to accede to the SCCs.
    • The data importer’s option under Clause 9(a) is Option 2 (general written authorization), with a notification period of 14 days.
    • The optional redress clause (Clause 11(a)) is not included.

7. Data details

For the purposes of this DPA and the SCCs:

  • Categories of data subjects: End users of the Controller’s published apps.
  • Categories of personal data: As determined by the Controller’s app design; may include names, email addresses, user-generated content, usage data, device identifiers, and any data fields created within the app.
  • Sensitive data: The Processor does not require or encourage collection of sensitive data. If the Controller’s app collects sensitive data, the Controller is solely responsible for ensuring a lawful basis.
  • Frequency of transfer: Continuous, as end users interact with published apps.
  • Nature and purpose of processing: Hosting, storing, retrieving, and displaying App Data to operate the Controller’s published apps; transmitting prompts and content to AI providers for runtime AI features.
  • Retention period: As specified in our Privacy Policy, or until the Controller requests deletion.

8. Controller obligations

You shall:

  • Ensure that your collection and use of Personal Data through your published apps is lawful, including obtaining any required consents from end users.
  • Provide appropriate privacy notices to end users of your published apps.
  • Not instruct Whacka to process Personal Data in violation of applicable data protection laws.

9. Limitation of liability

Liability under this DPA is subject to the limitation of liability provisions in the Terms of Service.

10. Changes to this DPA

We may update this DPA from time to time. Material changes will be communicated via email or in-app notification at least 30 days before they take effect. Continued use of the Service after the effective date constitutes acceptance of the updated DPA.

11. Contact

For questions about this DPA, contact us at [email protected].

Promnes Lane Technology Inc
8 The Grn Ste A
Dover, DE 19901, United States