This Data Processing Addendum ("DPA") describes how Approfits ("we", "us") processes personal data on behalf of EmailBot KH customers ("Controller", "you"). It supplements the EmailBot KH Terms of Service and Privacy Policy.

1. Roles

For personal data you upload to EmailBot KH (contacts, recipients, message content, custom fields), you are the Controller and Approfits is the Processor. For account-level data we collect directly from you (billing email, login, usage analytics), we act as Controller.

2. Scope of processing

• Purpose: providing the EmailBot KH service — email generation, sending, automation, deliverability tooling, and reporting.
• Duration: for the duration of your subscription plus the retention period stated in our Privacy Policy.
• Categories of data subjects: your contacts, recipients, and team members.
• Categories of personal data: name, email address, organization, custom fields you upload, engagement events (open / click / reply).

3. Subprocessors

We use the following subprocessors to deliver the service. Each is bound by data-processing terms at least as protective as this DPA.

• Supabase — primary database, authentication, edge functions, storage.
• Google (Gmail API) — only when a customer connects a Gmail mailbox; data scope is limited to the OAuth scopes the customer grants.
• Firebase Cloud Messaging / APNs — push notification delivery to mobile devices.
• Local payment processors — KHQR, ABA, Wing, TrueMoney, Chip Mong, Acleda, Stripe (where enabled by the customer).
• Cloudflare R2 — asset / file storage for customer uploads.

4. International transfers

Where customer personal data is transferred outside its country of origin, we rely on the relevant lawful transfer mechanism (e.g. Standard Contractual Clauses) made available by the subprocessor.

5. Security measures

The technical and organizational measures we operate are described on our Security page and form part of this DPA.

6. Data subject rights

We provide self-service tooling for data subject requests:

• Export: /data-export-request
• Deletion: /data-deletion-request

Where requests are made directly to Approfits about data we process on your behalf, we will forward them to you and assist as required by applicable law.

7. Sub-processor changes

We will update this page when we add or change subprocessors. Customers on enterprise plans can subscribe to advance notifications by contacting privacy@emailbot.approfits.com.

8. Contact

For a signed DPA or related questions, contact privacy@emailbot.approfits.com.