Kinlet™ — Data Processing Addendum (DPA)
Version 2026-11-06
Last updated: 6 November 2026 — a correction to the version of 22 October 2026. It lists more accurately the personal data the Processor already stores (§ 3) and states that automatic mode is off until the Controller switches it on (§ 2). Nothing else has changed.
Kinlet is made by PurrGiants (sole trader, Business ID 2702464-3), 91800 Tyrnävä, Finland.
This Addendum forms part of the Kinlet Terms of Service between
PurrGiants (sole trader, Business ID 2702464-3), 91800 Tyrnävä, Finland ("Processor"), and
the business that installs Kinlet ("Controller").
1. Roles
The Controller operates an online community. The Processor provides Kinlet, which processes personal data of the Controller's members only on the Controller's documented instructions.
The Processor is controller — not processor — of its own customer, billing and accounting data about the Controller. That data is covered by the Privacy Policy § 3, not by this Addendum.
Whop, Inc. is the Controller's own platform provider. The Processor does not engage Whop; it accesses the Controller's community through Whop's interface under the Controller's installation. Whop is therefore not a subprocessor under this Addendum, and the Controller's own agreement with Whop governs the data at its source.
2. Documented instructions
The Controller's documented instructions are:
- the Terms of Service and this Addendum;
- the Controller's settings in the app — in particular automatic mode (off until the Controller switches it on; switchable off at any time) and impact measurement (Large only; on by default there; switchable off);
- messages the Controller writes, approves or sends in the app.
If the Processor believes an instruction infringes data protection law, it will tell the Controller.
3. Subject matter, duration, nature and purpose (Art. 28(3))
| Subject matter | identifying members at risk of leaving and inviting them back |
| Duration | while Kinlet is installed, plus up to 30 days (§ 8) |
| Nature | reading activity (who posted in the community's chat channels, and when) and subscription signals from the platform; showing the Controller members' display names next to their status; ranking; sending platform notifications to selected members; recording what was sent and what followed; showing the Controller the recurring revenue of members at risk; notifying the Controller (not the member) when a paying member cancels, a payment fails, or a failed payment later goes through |
| Purpose | retention of the Controller's members, and measuring whether it works |
| Personal data read, not stored | platform member ID; display name or username (shown to the Controller only); join date; author and time of chat posts (the text is discarded unread; only the date of each member's latest post is kept, see Personal data stored); subscription status (cancelling, trial end, failed payment); whether the member has paid, the plan's recurring price and currency, and the end of the paid period |
| Personal data stored | platform member ID in the action log, together with what was done, when (and, if it was about a failed payment, the date the payment first failed), by whom (automatic / Controller), the message sent, and the outcome; platform member ID in the leaving-alert log, with the event type and date (and, for a failed payment that later went through, the time it went through), so each event is reported to the Controller once; on Large with measurement on, platform member ID in the measurement log, with the date the case was left alone and whether the member stayed 30 days later; the date of each member's latest chat post, under a one-way keyed hash of the platform member ID (no message text), so that Kinlet reads only new posts; while the Controller's automatic mode is off, a one-way keyed hash of the platform member ID in the "would have sent" log, with the case, the kind of message and the date (kept 30 days); a one-way keyed hash of the platform user ID of a member who turned messages off, or whom the Controller marked "Don't message", with the community and the time (message opt-out marker) |
| Categories of data subject | members of the Controller's community |
| Special categories | none — Kinlet neither requests nor stores them |
⭐ Kinlet does not store member names, usernames, email addresses, phone numbers, avatars, IP addresses, or the content of any message, post or submission written by a member. A member's display name is shown to the Controller in the app, read fresh and never saved. The platform returns message text when Kinlet reads who posted and when; it is discarded immediately without being stored or analysed. Kinlet does not request the platform permissions for member email addresses or phone numbers.
4. Processor obligations (Art. 28(3)(a)–(h))
The Processor shall:
(a) process personal data only on the Controller's documented instructions (§ 2), including as to international transfers, unless EU or Member State law requires otherwise — in which case it informs the Controller first, unless the law prohibits it;
(b) ensure that persons authorised to process the data are bound by confidentiality;
(c) implement the measures in § 7;
(d) engage other processors only as set out in § 5, and impose the same data protection obligations on them;
(e) assist the Controller, insofar as possible, in responding to data subject requests: on the Controller's written request (by email to support@getkinlet.com), remove a member's identifier from all records within 30 days and confirm it in writing. A verifiable deletion request received directly from a member or from Whop is handled the same way, and the Controller is informed;
(f) assist the Controller with security, breach notification (§ 9) and data protection impact assessments, taking into account the nature of the processing;
(g) at the end of the service, delete member personal data as set out in § 8 — except where EU or Member State law requires storage;
(h) make available the information necessary to demonstrate compliance and allow for audits (§ 10).
5. Subprocessors
The Controller gives general authorisation for the subprocessors below. The Processor gives at least 30 days' notice in the app before adding or replacing one, and the Controller may object on reasonable data protection grounds; if the objection cannot be resolved, the Controller may terminate and receives a refund of the unused prepaid period.
| subprocessor | purpose | location | transfer basis |
|---|---|---|---|
| Supabase — contracting entity under Supabase's DPA: Supabase Pte. Ltd. (Singapore) | database and serverless functions: stores the action log, runs the webhook receiver | EU — Frankfurt (eu-central-1): stored there and primarily processed there (Supabase DPA § 6.1) |
Standard Contractual Clauses, Module Three (processor to processor), incorporated in the Supabase DPA (Version 1, 1 August 2026), Schedule 2 § 1.1(b) |
| Whop (Whop Inc., USA) — app interface | hosts Kinlet's interface as part of the Whop app platform; requests from the interface reach Kinlet's API through Whop's proxy, which attaches the signed-in user's identity | USA | not engaged by the Processor as a subprocessor: Whop is the platform the Controller already uses, and the data passing through is data Whop already holds about the Controller's community |
Supabase's own subprocessors are the Controller's sub-subprocessors. Supabase publishes them at supabase.com/legal/customer-resources/subprocessor-list (list dated 12 October 2026), is bound to impose equivalent obligations on them, and remains liable for them (Supabase DPA § 6.2). According to Supabase, the database is hosted on Amazon Web Services and logs on Google Cloud (BigQuery), and data may be transferred to the United States and Singapore under the safeguards stated in its transfer impact assessment.
Changes to Supabase's subprocessors are passed on to the Controller within 3 days of the Processor receiving Supabase's notice. The 30-day notice above applies to subprocessors the Processor engages directly.
⭐ Where the data is processed. Member data is stored
in Frankfurt and primarily processed there; Supabase's subprocessors may
process it elsewhere under the transfer bases stated. Supabase Edge
Functions run by default near the caller, which for a Whop webhook
means the United States, so Kinlet's webhook address carries an explicit
forceFunctionRegion=eu-central-1 parameter (for requests from the app
interface: the x-region: eu-central-1 header) to run in Frankfurt.
Not subprocessors: Whop (see § 1). Anthropic, PBC receives only server diagnostics for internal monitoring alerts and no personal data covered by this Addendum; if that ever changes, it is added to the table above with 30 days' notice first.
6. International transfers
Member personal data is stored and processed in Frankfurt. Where a subprocessor's access involves a transfer outside the EU/EEA, it is made under the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) or another valid Chapter V mechanism. For Supabase this is Module Three of the Standard Contractual Clauses (processor to processor), incorporated in Supabase's DPA and governed by Irish law (§ 5).
7. Technical and organisational measures (Art. 32)
- Data minimisation by design: only the fields in § 3 are used. The platform permissions for member email and phone are not requested.
- Encryption in transit: all traffic over HTTPS.
- Authenticated ingest: incoming platform events are verified with HMAC-SHA256 over the raw request body and a 5-minute time window in both directions; unsigned, altered, replayed or out-of-window events are rejected.
- Closed database: every table has row-level security enforced and no access for public roles; only the server-side service key can read or write, and only the operations each table needs.
- Records that cannot be rewritten: stored events and acceptance records cannot be updated; action log rows can only receive their outcome or have the member identifier removed.
- Private messages only: a notification without named recipients is refused by the software, so nothing is ever sent to a whole community by mistake.
- Logging: every automatic action is recorded before it is sent; an action that cannot be recorded is not sent.
- Access control: production access limited to the Processor's operator.
8. Deletion at the end of the service
Within 30 days after the Controller uninstalls Kinlet or the service otherwise ends, the Processor removes every member identifier from its records. What remains cannot be linked to any member.
During the service, member identifiers are removed from the action log, the leaving-alert log and the measurement log after 12 months.
⚠ Exception, stated plainly: records that form part of the Processor's own accounting — payment records identifying the Controller as a customer — are kept as required by the Finnish Accounting Act (vouchers 6 years, accounts and financial statements 10 years) and may not be altered or deleted during that period. They contain no data about the Controller's members.
Aggregated statistics. The Processor may compute statistics that combine outcomes across customers (for example, whether invitations improve retention, measured against the deliberately untouched cases). Such statistics are anonymous: they identify no member and no community, and they are not personal data.
9. Breach notification
The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and in any case within 72 hours, with the information available at the time and further details as they become known.
10. Audit
The Controller may, once per calendar year and on 30 days' notice, request written information demonstrating compliance with this Addendum. On-site audits may take place where a supervisory authority requires it or following a personal data breach, at the Controller's cost unless the audit shows a material breach by the Processor.
11. Liability and precedence
Liability under this Addendum between the Controller and the Processor is subject to the limitation of liability in the Terms of Service, and counts towards the same total, except where applicable law does not permit it. Nothing in this Addendum limits the rights of data subjects or the powers of supervisory authorities. If this Addendum and the Terms conflict on the processing of members' personal data, this Addendum prevails.