Back

Data Processing Agreement (DPA) for Refund Guard

Last Updated: September 26, 2026

This Data Processing Agreement ("DPA") is incorporated into and forms part of the Terms of Service or other written agreement (the "Agreement") between Refund Guard, acting as the data processor ("Processor"), and its customer, acting as the data controller ("Controller"). This DPA takes effect on the date the Controller begins using Refund Guard's services and governs the handling of personal data in compliance with applicable data protection legislation, including but not limited to the General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act ("CCPA").

1. Interpretation

• 1.1 "Personal Data": Any information relating to an identified or identifiable natural person that is processed under this Agreement.
• 1.2 "Processing": Any operation performed on Personal Data, whether automated or not, such as collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction.
• 1.3 "Applicable Laws": All data protection laws and regulations applicable to the processing of Personal Data under this Agreement, including the GDPR, CCPA/CPRA, and any other relevant legislation.
• 1.4 "Controller": The natural or legal person, public authority, agency, or other body that determines the purposes and means of processing Personal Data.
• 1.5 "Processor": Refund Guard, which processes Personal Data exclusively on behalf of and under the instructions of the Controller.

2. Scope and Details of Processing

2.1 Categories of Personal Data

The Processor will process the following categories of Personal Data on behalf of the Controller:

• User email addresses, collected during account registration.
• Subscription status and associated payment data, received from Stripe.
• App Store notification data (including transaction identifiers, product identifiers, and refund status) supplied by the Controller's connected applications.

2.2 Purposes of Processing

The Processor will process Personal Data solely for the following purposes:

• User account creation and authentication.
• Subscription administration and billing management.
• Handling refund notifications and updating refund outcomes.
• Delivering customer support services.

2.3 Duration of Processing

The Processor will retain Personal Data for the duration necessary to provide the services under the Agreement, unless the Controller requests earlier deletion or applicable law requires longer retention.

3. Processor Responsibilities

3.1

The Processor undertakes to:

• Process Personal Data only in accordance with the Controller's documented instructions and strictly for the purposes set out in this DPA.
• Ensure that all personnel with access to Personal Data are bound by confidentiality obligations or are subject to an equivalent statutory duty of confidentiality.
• Implement and maintain appropriate technical and organizational measures to ensure a level of security commensurate with the risks associated with the processing.

3.2

The Processor will promptly notify the Controller if, in its opinion, any instruction from the Controller infringes applicable data protection laws.

3.3

The Processor will provide reasonable assistance to the Controller to meet its legal obligations under Applicable Laws, including obligations relating to:

• Responding to requests from data subjects exercising their rights.
• Conducting data protection impact assessments (DPIAs) where required.
• Notifying supervisory authorities or affected data subjects in the event of a personal data breach.

3.4

The Processor will make available all information reasonably necessary to demonstrate compliance with this DPA and will cooperate with audits conducted by the Controller or its duly appointed auditor.

4. Security of Personal Data

4.1 Technical and Organizational Measures

The Processor will implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, including but not limited to:

• Encryption of data in transit using HTTPS/TLS protocols.
• Secure password storage using cryptographic hashing algorithms.
• Access controls ensuring that Personal Data is accessible only to authorized personnel who require it to perform their duties.

4.2 Data Storage Location

All Personal Data is stored in a database, with the primary storage location in the United States.

4.3 Access Management

Access to Personal Data is restricted to authorized personnel who have a legitimate business need for such access in order to perform their assigned duties.

4.4 Secure Transmission

The Processor will ensure that Personal Data is transmitted securely, employing industry-standard encryption protocols such as HTTPS/TLS.

4.5 Personal Data Breach Notification

In the event of a personal data breach affecting Personal Data, the Processor will:

• Notify the Controller without undue delay and in any event no later than 72 hours after becoming aware of the breach.
• Provide sufficient information about the breach to enable the Controller to meet its own legal obligations, including:
  • The nature and circumstances of the breach.
  • The categories and approximate number of data subjects and data records affected.
  • The likely consequences of the breach.
  • The measures taken or proposed to mitigate the breach and prevent recurrence.

5. Sub-Processors

5.1

The Processor may engage the following sub-processors to assist in providing the services:

• Stripe: Payment processing and subscription management.

5.2

The Processor will ensure that any sub-processor it engages is subject to data protection obligations that are no less protective than those set out in this DPA.

6. International Data Transfers

6.1

The Controller acknowledges that Personal Data may be transferred to the United States or other jurisdictions where sub-processors are located. The Processor will take appropriate measures to ensure that such transfers comply with Applicable Laws, including the implementation of Standard Contractual Clauses (SCCs) where required.

7. Data Subject Rights

7.1

The Processor will assist the Controller in responding to requests from data subjects seeking to exercise their rights under Applicable Laws, including the rights of access, rectification, and erasure.

7.2

The Processor will promptly inform the Controller if it receives any such request directly from a data subject.

8. Retention and Deletion

8.1

The Processor will retain Personal Data for the term of the Agreement, unless the Controller requests earlier deletion.

8.2

Upon receiving a valid deletion request (submitted to [email protected]), the Processor will delete the affected Personal Data within 30 days, unless retention is required by applicable law.

9. Liability and Indemnity

9.1

The Processor's liability for any breach of this DPA will be limited to the extent permitted under the Agreement.

9.2

The Controller will indemnify and hold harmless the Processor from any costs arising from the Controller's non-compliance with Applicable Laws.

10. Termination Effects

10.1

Upon termination or expiration of the Agreement, the Processor will, at the Controller's option, delete or return all Personal Data to the Controller, unless applicable law requires continued retention.

11. Final Provisions

11.1

This DPA is governed by the laws of Hong Kong. Any disputes arising from or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of Hong Kong.

11.2

This DPA may be updated from time to time to reflect changes in data protection laws or the Processor's operational practices. Material changes will be communicated to the Controller via email.

11.3 Contact

For any questions or concerns regarding this DPA, please contact us at [email protected].