Data Processing Agreement
Last updated: 10 October 2026
This agreement is between the agency that uses 3 Loop (the controller) and Innovation With Pixels (the processor). It forms part of the Terms of Service for every workspace, with no separate signature needed. To receive a countersigned copy, email hello@innovationwithpixels.com.
1. What it covers
The personal data the agency, its team and its clients put into the workspace — messages, files, WhatsApp and email conversations, projects, tasks and the people in them — processed for as long as the agency uses 3 Loop, only to provide the service.
2. What we commit to (GDPR Article 28)
- Instructions — we process the data only on the agency’s documented instructions: these terms and how the agency uses and configures 3 Loop.
- Confidentiality — everyone who can reach the data is bound to keep it confidential.
- Security — workspaces kept apart from each other, encryption in transit (TLS) and of mailbox and WhatsApp credentials at rest, hashed passwords, access limited to the people who run the service, revocable sessions and audit logs.
- Sub-processors — only those listed below; we tell workspace admins before adding or replacing one, so the agency can object.
- Breaches — we notify the agency without undue delay after becoming aware of a personal-data breach affecting its workspace.
- Requests — we help the agency answer requests from the people whose data it holds, and with impact assessments where needed.
- End of service — when a workspace closes we return its data on request and delete it within 30 days, with backups rolling off within a further 30 days, unless the law requires us to keep it.
- Audits — we answer a reasonable security questionnaire once a year, or after a breach, to show we meet these terms.
- Transfers — data leaves the EU/EEA only under the standard contractual clauses or another lawful mechanism.
3. Sub-processors
| Provider | What for | Where |
|---|---|---|
| Hetzner Online | Hosting of the application and its database | Germany (EU) |
| Backblaze (B2) | Storage of files, images, voice notes and documents | United States |
| Cloudflare | DNS only (no traffic or content passes through it) | Global |
| Meta Platforms (WhatsApp Business) | Sending and receiving WhatsApp messages, for workspaces that connect WhatsApp | Global |
| OpenAI | Voice-note transcription and the AI assistant | United States |
| Google (Gemini) and Mistral AI | The AI assistant, only when a workspace admin selects these models | United States / EU |
| Expo, Apple (APNs), Google (FCM) and browser push services | Delivering push notifications (title, short text and an id) | Global |
| Maileroo | Sending system email such as invitations and password resets | Global |
| Stripe | Payments and invoices, from when paid plans launch | United States / EU |
4. Contact
Data protection questions: hello@innovationwithpixels.com · Post: Innovation With Pixels, 7 Bell Yard, London WC2A 2JR, United Kingdom