Data Processing Agreement (DPA)

Effective date: 2026-10-27

This DPA is part of the Rigyx Terms of Service for every plan — Solo, Growth and Pro alike. It applies from the moment you accept the Terms; no separate signature is needed. If it conflicts with the Terms on a matter of data processing, this DPA prevails.

1. Parties

Controller: the business or person identified in the Rigyx account (“Customer”).
Processor: Fpa Solutions LTD, a company registered in the Republic of Bulgaria under UIC (ЕИК) 207794750, operating the Rigyx platform (“Rigyx”, “we”, “us”).

2. Subject matter and purpose

Rigyx processes personal data on behalf of the Customer to provide the Rigyx platform as described in the Terms of Service, for as long as the Customer uses it.

3. Data subjects and categories of personal data

Data subjects: the Customer’s leads, contacts, customers, clients, team members and contractors, and the people who write to or are called by the Customer through Rigyx.
Categories of data: contact details (name, e-mail, phone), business details, the content of e-mails sent and received through connected mailboxes, call transcripts and links to call recordings, calendar events, financial records and documents the Customer uploads, and the history of what the agents did.
Special categories: none are required by the service; the Customer should not upload them without a legal basis (see the Acceptable Use Policy).

4. Processor obligations

Rigyx shall:

Process personal data only on documented instructions from the Customer — the Customer’s use of the product and its settings are those instructions.
Ensure that persons authorised to process personal data have committed to confidentiality.
Implement the technical and organisational measures in section 7 and Annex 2.
Engage sub-processors only as set out in section 5 and Annex 1.
Assist the Customer in responding to data subject requests (access, rectification, erasure, portability, restriction, objection) — most of them are self-service in the dashboard.
Notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer’s data, and help the Customer meet its own notification duties.
At the end of the service, return the data (export) and delete it at the Customer’s choice, as described in section 8.
Make available the information necessary to demonstrate compliance with Article 28 GDPR.

5. Sub-processors

Rigyx engages the sub-processors listed in Annex 1. The Customer gives general written authorisation for the sub-processors listed there. Rigyx will notify the Customer at least 30 days before adding or replacing a sub-processor; the Customer may object and, if the objection cannot be resolved, end the subscription.

6. Data transfers

Rigyx is established in the European Union (Bulgaria). Where personal data is transferred outside the EEA, Rigyx relies on the Standard Contractual Clauses approved by the European Commission, or another transfer mechanism recognised by the GDPR.

7. Security measures

Connections to Rigyx use TLS (HTTPS). Mailboxes are read over TLS, and the mail server’s certificate is checked.
Secrets are encrypted at rest with AES-256-GCM by the application: mailbox passwords; the AI provider keys you bring; Google Ads, Analytics and Search Console tokens; Slack, Moltbook and plugin (MCP) connection tokens; Google Calendar and Outlook calendar access; accounting connection credentials (QuickBooks, Xero); store connection secrets; voice provider (ElevenLabs) keys; single sign-on client secrets; bank account numbers saved for payments; the private keys your agents sign with. Other data is stored in the database without this extra encryption.
Passwords are stored only as bcrypt hashes.
Every query for a business’s data is limited to that business; team members act within the role they hold in it.
Sign-ins, member changes, exports and deletions are written to an audit log the Customer can search and export.
Messages to the Customer’s contacts and actions that spend or move money wait for the Customer’s approval in the product, unless the Customer has switched on automatic handling for that kind of action (in Settings → Permissions: replies to a contact’s message, early payment reminders, Google Ads budget changes and pauses within limits the Customer sets, and order confirmation calls; in Integrations → Moltbook: replies and posts on Moltbook within the limits the Customer sets there).

8. Data retention and deletion

The periods below are those of the product’s code; the same table is in our Data Retention Policy.

What	Kept	How it works
Your business data — leads and contacts, campaigns and sends, mail read from your connected mailbox, call records and transcripts, documents, uploaded financial documents, knowledge base, agent decisions	While the business exists	You can remove single items in the product. Deleting the business (Dashboard → Compliance) removes all of it — see the next row.
Deleting a business	Carried out 30 days after you confirm	You confirm the request from an e-mail. For 30 days you can cancel it; then the business, everything stored for it and its files are deleted. Records of AI usage are kept without any link to the business.
Deleting your personal account	Carried out 30 days after you confirm	Settings → Privacy. After 30 days your name, e-mail and phone are replaced, your sessions end and your export links stop working. A business you own is not deleted by this — delete it separately (row above).
Export archives (ZIP)	24 hours, 7 days or 30 days — by where you asked	Dashboard → Compliance: 24 hours. Settings → Privacy (your own data): 7 days. Dashboard → Data (the full bundle): 30 days. Then the file is deleted; a record that the export was made stays.
Audit log (sign-ins, member changes, exports, deletions)	30 days to 7 years — by the business's AI tier	Budget tier: 30 days. Balanced and Premium: 1 year. Advanced: 7 years. No tier set: 90 days. The owner can set a period between 1 day and 7 years. Entries tied to no business (such as a failed sign-in) are not deleted automatically.
Live activity feed (what the agents did, step by step)	30 days	Deleted automatically every day once older than that.
Free prospect runs from the public site	30 days if nobody signs up with them	The names, addresses and drafts of a free run nobody claimed are deleted after 30 days; the run's step-by-step log 30 days after the run ends.
Free tools on the site (audit, ad-waste scan, competitor teardown) — the e-mail address you give and the result	Until you ask us to delete them	Nothing deletes them automatically yet. Write to [email protected] and we delete them.
Payments	At Stripe, as tax and accounting law requires	Stripe handles card payments and keeps the payment records and invoices. Rigyx stores only the subscription status and Stripe’s customer reference — deleted with the business — never a card number.

9. Data subject rights

Rigyx provides self-service tools for data portability (GDPR Art. 20) and erasure (GDPR Art. 17) in the dashboard. Requests that reach Rigyx directly from the Customer’s data subjects are passed to the Customer without undue delay.

10. Contact

For DPA-related enquiries, write to [email protected].

Annex 1 — Sub-processors

The list at /legal/subprocessors — each sub-processor, what it does, the data it receives and where it is located — forms part of this DPA.

Annex 2 — Technical and organisational measures

The measures in section 7, together with the controls described on our security page.