Data processing agreement

This agreement explains how Galloram processes personal data on a member's behalf when providing Monkeymaxxing VIP. It includes safeguards for transfers from the European Economic Area, the United Kingdom, and Switzerland.

Last updated: 26 October 2026.

When this agreement applies

This data processing agreement forms part of the terms of service between Galloram Studios, LLC ("Galloram") and the organization that holds a Monkeymaxxing VIP membership ("the member"). Monkeymaxxing VIP is called "VIP" below.

This agreement applies automatically whenever the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection applies to personal data Galloram processes for the member. No separate signature is required. Accepting the terms for the member also accepts this agreement and the applicable transfer clauses incorporated below. The person accepting must have authority to bind the member.

A member that needs a countersigned copy can write to [email protected]. A countersigned copy records the same standard agreement. Its absence does not delay this agreement or make its protections conditional on a signature.

This agreement remains in force while Galloram or its subprocessors hold personal data covered by it, including during deletion and backup expiry. Ending the membership does not remove obligations that must continue to protect retained data.

The data and the parties' roles

"Personal data" means information about an identified or identifiable person. "Processing" includes storing, using, transmitting, publishing, and deleting that information. A "controller" decides why and how personal data is processed. A "processor" processes personal data for a controller. A "subprocessor" is another processor engaged in that work. A "data subject" is the person the information concerns.

"Data protection law" means the laws applicable to the processing covered here: the EU General Data Protection Regulation, Regulation (EU) 2016/679 ("GDPR"), the UK GDPR and applicable supplementary UK law, and the Swiss Federal Act on Data Protection ("Swiss FADP"). These terms have their statutory meanings where the relevant law applies.

The member is the controller and Galloram is its processor for the content of Lifeline held messages, status page posts, and other personal data the member's people or programs put into VIP for processing on its behalf. If the member processes that data for its own customer, the member is a processor and Galloram is a subprocessor. The obligations in this agreement apply to Galloram in either role. Annex I describes the processing.

Galloram separately acts as controller for account and sign-in data, billing data received from Paddle, the support mail Galloram answers, request logs, and data needed for security and abuse checks. Those activities are described in the privacy policy. Sending information to VIP does not make every use of that information processing on the member's behalf. The actual purpose and role determine which obligations apply.

Support messages may name people or contain personal data supplied by the member. The description of such people in Annex I does not change Galloram's controller role when answering support mail. This agreement covers member-supplied content only to the extent Galloram processes it on the member's behalf.

The member's instructions and responsibilities

The member instructs Galloram to process covered personal data to provide VIP under the terms and this agreement. The member's documented instructions also include its use of VIP through its people and programs. These instructions include submitting and replacing held messages, sending them after their delays when check-ins stop, publishing status page posts, and deleting data as described here.

The instructions include using the subprocessors and processing locations disclosed in Annex III, subject to the safeguards below. Instructions to publish status page content authorize public access to that content. Instructions to send held messages authorize delivery to the member's chosen notification services.

Galloram will process covered personal data only on those documented instructions, including for international transfers, unless applicable law requires otherwise. Where law requires different processing, Galloram will inform the member of that requirement before processing, unless the law prohibits notice on important grounds of public interest. Galloram will inform the member immediately if, in Galloram's opinion, an instruction infringes applicable data protection law.

The member must have a lawful basis for the personal data it puts into VIP and for the processing it instructs. The member must give required privacy notices and obtain consent where the law requires consent. Consent is not required where another lawful basis applies. The member must ensure that its instructions, including instructions to publish information or send it to a notification provider, comply with data protection law.

A member acting for its own customer must have authority to appoint Galloram and authorize the disclosed subprocessors. The member must pass on lawful instructions from that customer and provide information needed to carry them out. The member remains responsible for its own systems, its authorized users, and the notification services it selects. These duties do not reduce Galloram's obligations under this agreement.

Confidentiality and security

Galloram will ensure that personnel authorized to process covered personal data are bound by confidentiality obligations or an appropriate statutory duty of confidentiality. Access to production servers and data is limited to Galloram's own personnel.

Galloram will maintain appropriate technical and organizational measures to protect covered personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, and unauthorized access. Galloram will take account of the processing, available technology, implementation costs, and risks to people's rights and freedoms. Annex II describes the measures for VIP.

VIP does not use members' data to train AI models. VIP does not sell or share personal data for advertising, run analytics, track people across sites, send marketing email, or make automated decisions about people. Emails concern the account and the service.

Security measures do not change the member's instructions about public content. A status page post is public by design. The member must choose what personal data, if any, belongs in a public notice.

Help with privacy obligations

Taking account of the nature of the processing, Galloram will assist the member through appropriate technical and organizational measures with requests from data subjects. Assistance covers requests to exercise applicable rights, including access, correction, deletion, restriction, and portability, where those rights apply to covered personal data.

If Galloram receives a request concerning data it processes for the member, Galloram will notify the member without undue delay, unless legally prohibited. Galloram will not decide the request independently or disclose covered data in response without the member's instructions, unless legally required. Galloram may direct the person to the member. Requests concerning Galloram's own controller activities are handled under the privacy policy.

Galloram will also assist the member with its applicable security obligations, personal data breach notifications, data protection impact assessments, and prior consultations with supervisory authorities. Galloram's assistance takes account of the processing and information available to Galloram. The member remains responsible for deciding whether an assessment, consultation, or notification is required for its activities.

The member can request assistance and compliance information at [email protected]. A member acting as processor must pass relevant information to its controller and coordinate any instructions it receives. Nothing here removes a duty Galloram has directly under law or the applicable transfer clauses.

Personal data breaches

A personal data breach is a security breach that causes accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to covered personal data. An unsuccessful attack that does not compromise personal data is not itself a personal data breach.

Galloram will notify the member without undue delay after becoming aware of a personal data breach affecting covered personal data. Galloram will send notice to the member's owner. The notice will describe the breach, the data and people affected, likely consequences, and measures taken or proposed, to the extent that information is available. It will include a contact for further information.

Galloram will provide available information needed for the member's applicable reporting obligations. Galloram may provide information in stages as the investigation develops, without unduly delaying the initial notice. Galloram will take appropriate steps to contain and address the breach and assist the member with its response.

The member decides which notifications it must make to its customers, data subjects, or supervisory authorities. This does not displace Galloram's own legal obligations or obligations under the transfer clauses. A breach notice is not, by itself, an admission of liability.

Subprocessors

The member gives general written authorization for Galloram to use the subprocessors listed in Annex III for the disclosed work. Authorization applies only to processing needed to provide VIP under this agreement. Paddle is an independent controller for its merchant-of-record activities and is not a subprocessor under this agreement.

Before a subprocessor processes covered personal data, Galloram will enter into a written agreement imposing substantially the same data protection obligations as this agreement for that processing. These obligations include appropriate security, confidentiality, assistance, breach reporting, deletion, and applicable transfer safeguards. Galloram remains responsible to the member for its subprocessors' performance of those obligations.

Galloram will give at least 30 days' notice before a new or replacement subprocessor starts processing covered personal data. Galloram will update this page and email the member's owner. The notice will identify the provider, the work it will perform, and its processing locations.

The member may object on reasonable data protection grounds by writing to [email protected] during that notice period. Galloram and the member will work in good faith to resolve the objection. Galloram will not send that member's covered personal data to the proposed subprocessor while the objection remains unresolved and the membership continues.

If no solution is found, the member may end its membership by written notice before the proposed processing begins. Galloram will refund fees paid for the time after that membership ends. This specific refund right applies even where the ordinary refund policy would not provide a refund. It does not remove mandatory rights under data protection law or the transfer clauses.

Compliance information and audits

Galloram will answer reasonable written questions and provide information necessary to demonstrate compliance with this agreement. The member should describe the processing and obligations its questions concern. Written questions are the normal way to review compliance.

An audit beyond those written answers is available where applicable law or a competent supervisory authority requires it. Such an audit is at the member's cost, requires reasonable advance notice, and is limited to once a year, except where mandatory law, a supervisory authority, or the applicable transfer clauses require otherwise. Galloram will allow and contribute to such required audits, including inspections where required.

The member may conduct a required audit itself or appoint an independent auditor. The parties will agree reasonable arrangements for its scope, timing, confidentiality, and security. An audit must protect other members' data and avoid unnecessary disruption. Those arrangements must not prevent an audit or disclosure required by law or a supervisory authority.

These procedures do not restrict rights under Article 28 of the GDPR or the UK GDPR, or Clause 8.9 of the applicable Standard Contractual Clauses. In particular, those clauses' rights to audits at reasonable intervals or where there are indications of non-compliance prevail over the restrictions above. Cost arrangements must not make a mandatory audit right ineffective.

Deletion and the end of processing

Galloram deletes an organization's data 30 days after its membership ends, including after a trial ends without payment. Galloram also deletes the account of each person who then belongs to no other organization. Ending one organization's membership does not delete a person's account used by another organization.

The member's standing instruction is deletion on that schedule. Where applicable data protection law or transfer clauses give the member a choice of return or deletion, Galloram will honor that choice. The member should send return instructions to [email protected] before the scheduled deletion. This does not extend the separate retention periods for held messages or sent emails.

Deleted database data leaves backups within three weeks after deletion, as the oldest backups expire. The three-week period follows deletion from the active database; it is not measured from the membership's end. Backup copies remain protected under this agreement until expiry. They are kept for recovery and will not be used to resume ordinary processing of deleted data. If a recovery restores deleted data, Galloram will reapply the deletion.

Held messages are deleted when replaced by the next check-in, about every minute, or when sent. VIP's email outbox deletes each email 30 days after sending. Support mail is kept as long as needed to answer and follow up, and deleted on request unless law requires retention. Annex I explains these periods and the distinction between processor and controller records.

If applicable law requires Galloram to retain covered personal data beyond its scheduled deletion, Galloram will retain only the required data for the required period. Galloram will continue to protect that data and limit processing to the legal requirement. Galloram will confirm deletion where the applicable transfer clauses or law require confirmation.

International transfers

VIP's own database servers are on the United States east coast. Annex III identifies providers and processing locations, including Cloudflare's global network. Galloram is not certified under the EU-US Data Privacy Framework. For transfers covered by this agreement that require contractual safeguards, the parties rely on the clauses below.

EU Standard Contractual Clauses

The Standard Contractual Clauses in the annex to Commission Implementing Decision (EU) 2021/914 are incorporated by reference into this agreement ("SCCs"). They apply to transfers from the member to Galloram where required under the GDPR's international transfer rules. The member is the data exporter and Galloram is the data importer.

Module 2 applies where the member is a controller. Module 3 applies where the member is a processor for its own customer. The appropriate module applies to each category of processing; Modules 1 and 4 do not apply. The parties enter into the applicable SCCs when this agreement takes effect for the transfer, without a separate signature.

The SCCs are completed as follows:

• Clause 7: the optional docking clause is included. Another party may join only in accordance with that clause.
• Clause 9(a): option 2, general written authorization, applies. The advance notice period for adding or replacing a subprocessor is at least 30 days, as described under Subprocessors.
• Clause 11(a): the optional wording about an independent dispute resolution body is not used.
• Clause 13: the competent supervisory authority is determined by the member's establishment or representative, or the other applicable case in that clause, as specified in Annex I.
• Clause 17: option 1 applies, and the SCCs are governed by Irish law.
• Clause 18(b): disputes under the SCCs are resolved by the courts of Ireland, without limiting data subjects' rights under Clause 18(c).

Annex I of this agreement supplies SCC Annex I, including the parties, transfer description, and competent supervisory authority. Annex II supplies SCC Annex II. Annex III supplies the subprocessor information for the SCCs and the agreed list under Clause 9's general authorization. Keeping that list does not select specific authorization instead.

The parties must comply with the SCCs in full. Incorporating them does not remove the need to assess the transfer and comply with their requirements concerning local laws, public authority access, onward transfers, and suspension or termination where safeguards cannot be met. Galloram will provide information and cooperation required by those clauses.

United Kingdom transfers

For transfers requiring safeguards under the UK GDPR, the SCCs apply with the UK International Data Transfer Addendum, version B1.0, issued by the Information Commissioner ("UK Addendum"). Its Part 2 Mandatory Clauses are incorporated, including revisions under its Section 18.

Table 1 uses Annex I's parties and contacts; its start date is when this agreement first applies to the UK transfer. Table 2 selects the SCCs, modules, and options stated above. Table 3 uses Annexes I, II, and III. For Table 4, both the exporter and importer are selected as parties that may end the UK Addendum under its Section 19.

The UK Addendum makes the required UK substitutions. These include the Information Commissioner as supervisory authority and the law and courts of England and Wales for the UK transfer clauses. Its mandatory hierarchy governs conflicts with the EU SCCs for UK transfers. The Irish law and court choices continue for EU transfers.

Switzerland transfers

For transfers requiring safeguards under the Swiss FADP, the applicable SCC module applies with these Swiss amendments. References to the GDPR mean the Swiss FADP insofar as the transfer is governed by Swiss law. References to specific GDPR provisions mean the corresponding Swiss provisions where applicable.

The Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for Swiss FADP matters. References to a Member State must not exclude people in Switzerland from enforcing their rights. In particular, Clause 18(c) permits data subjects habitually resident in Switzerland to bring proceedings in Swiss courts.

The Irish law and court choices remain for contractual claims between the parties. They do not restrict the Swiss rights just stated. If both the GDPR and Swiss FADP apply, the EU provisions continue for GDPR matters and the Swiss amendments apply for Swiss matters. Annex I records the corresponding supervisory authorities. These amendments follow the Swiss authority's guidance on adapting the SCCs.

Liability and order of precedence

The terms' exclusions and limitations of liability apply to this agreement only to the extent allowed by applicable law and the applicable transfer clauses. No provision limits a data subject's enforceable rights or liability that cannot lawfully be limited. The terms do not reduce liability imposed by the SCCs where that would conflict with them.

If provisions conflict, the applicable SCCs take precedence, then this agreement, then the terms. For UK transfers, the SCCs include the UK Addendum and its mandatory hierarchy. For Swiss transfers, they include the Swiss amendments. The terms' Wyoming law and dispute provisions do not override the transfer clauses' governing law, courts, or data subjects' rights.

Annex I: Parties and processing details

Parties and contacts

The data exporter is the organization holding the membership under the terms, identified by the organization's name and its contractual identity. Its contact is its owner at the email address used for VIP. The member must supply its full legal name and address, relevant representative details, and any other party details required by the applicable transfer clauses. The member supplies missing details to Galloram in writing; those details form part of this annex. Its relevant activity is using VIP for its business, either as controller or as processor for its customer.

The data importer is Galloram Studios, LLC, a Wyoming limited liability company, entity ID 2025-001610326. Its address is 30 N Gould St Ste R, Sheridan, WY 82801, United States. The contact for data protection is [email protected]. Galloram's relevant activity is providing VIP, including the Lifeline, public status pages, vulnerability alerts, and support. Galloram is a processor, or a subprocessor where the member acts as processor.

Acceptance of the terms by the member's authorized representative and Galloram's provision of VIP constitute the parties' execution of this agreement and the applicable transfer clauses. Their effective date is when this agreement first applies to the relevant processing. VIP records the accepted terms version and time. No blank signature fields need completing.

People and personal data covered

Data subjects are the member's people who use VIP or are on call, and anyone named in the member's status page posts or support messages. Only processing on the member's behalf falls within this agreement.

Covered data consists of personal data in held messages, status page text, and other content submitted by the member's people or programs. Depending on that content, categories include:

• Names or identifying labels in message text, such as a label identifying the person on call.
• Contact or delivery details in held messages, including push app tokens and phone numbers when the member uses its own Twilio account.
• Personal information the member chooses to include in public status page notices or other submitted content.
• Personal information in a coding agent's diagnosis and account of attempted actions, to the extent processed for the member rather than as Galloram's support records.

VIP holds email addresses for accounts, but no separate account name, password, or phone-number field. That does not prevent member-supplied text or held messages from containing names or phone numbers. Account and sign-in records, billing records received from Paddle, and Galloram's other controller records are outside the processor scope described above.

No special categories of personal data or criminal conviction and offence data are intended for this processing. VIP is for businesses and is not meant for anyone under 18.

Nature, purpose, frequency, and duration

Processing includes receiving, storing, retrieving, transmitting, publishing, replacing, and deleting member-supplied content. The purpose is to provide the VIP services the member uses, following its documented instructions.

For the Lifeline, the member's MMHotline sends a check-in about every minute with up to 10 sealed held messages. Each message is a ready-made HTTPS request to the member's notification service with a delay. If check-ins stop, VIP sends held messages after their delays. The Lifeline is a backup path; MMHotline on the member's server remains the main alerting path.

For status pages, the member writes the notices, and VIP publishes them for public reading. For support, people or coding agents submit messages for assistance; Galloram's answering of support mail is controller processing. MMWatchdog sends package names and the distribution release, never versions. VIP stores no vulnerability search text or list of a query's package names.

Transfers occur throughout the membership as the member's people and programs use VIP. Processing lasts for the membership and the retention periods below. Subprocessors perform only their disclosed work for that duration, including applicable deletion and backup expiry.

Retention

Organization data is deleted 30 days after the membership ends. Accounts of people belonging to no remaining organization are deleted with it. Held-message sets are deleted when replaced, about every minute, or when sent. Deletion from backups follows the backup expiry below.

The email outbox keeps sent emails for 30 days after sending. Support mail is kept as long as needed to answer and follow up, and deleted on request unless law requires retention. These periods describe the relevant systems without changing Galloram's controller role for its own emails and support records.

Database backups use pgBackRest: full backups weekly, differential backups daily, with two full backups retained in Cloudflare R2. Deleted database data leaves backups within three weeks as older backups expire. Paddle keeps payment records under its own policy as an independent controller; those records are not subject to Galloram's deletion schedule.

Competent supervisory authority

For GDPR transfers, Clause 13 determines the authority. If the member is established in an EU Member State, it is the authority responsible for the member's compliance. If Article 3(2) applies and the member has an EU representative, it is the authority where that representative is established. If the member is exempt from appointing a representative, it is an authority in a Member State where affected people are located, as Clause 13 requires. The member identifies that authority to Galloram in writing where selection is needed.

For UK transfers, the authority is the Information Commissioner under the UK Addendum. For Swiss FADP transfers, it is the Swiss Federal Data Protection and Information Commissioner. Where more than one law applies, the corresponding authorities retain their respective powers.

Annex II: Technical and organizational measures

Network and communications

Every site uses HTTPS. Cloudflare's network filters attacks before requests reach VIP's servers, which have no public DNS records. VIP's servers communicate with each other over WireGuard. Only SSH with key-only login and fail2ban faces the internet, together with the two Lifeline relay servers.

Held messages

MMHotline seals held messages with VIP's public key so that only VIP's servers can open them. Held messages are encrypted at rest, never written to logs, and deleted when replaced or sent. They are sent through a relay server, so the destination sees a relay server's address. VIP records destination host names for abuse investigations, never the held messages' secrets.

Authentication and access

VIP uses email sign-in and passkeys instead of passwords. Its sign-in cookies are host-only. Keys are shown once at creation. System keys sign requests and are never sent with those requests. Server secrets are kept in files on app servers rather than in the database or database backups. Access to production servers and data is limited to Galloram's own personnel, subject to the confidentiality obligations above.

Availability, recovery, and limited logs

Postgres replicates synchronously to a second database server at another provider, with automatic failover. Backups are stored in Cloudflare R2, which encrypts stored objects at rest, and a restore is tested. The backup schedule and expiry are stated in Annex I. Request logs record no IP addresses and no query strings. Cloudflare processes IP addresses to deliver requests and block attacks.

These measures support the assistance obligations in this agreement. Requests about covered data, security information, or required assessments go to [email protected].

Annex III: Subprocessors

The following providers act for Galloram. Each is authorized only insofar as its disclosed work involves personal data covered by this agreement. Listing a provider does not change Galloram's controller role for other processing that provider performs for Galloram.

Paddle.com Market Limited is excluded from this list. Paddle handles checkout, payments, invoices, sales tax and VAT, and refunds as reseller and merchant of record. Paddle is an independent controller under its own privacy policy.

The member's own notification services receive held messages on the member's instructions. Examples include the member's Pushover service or its own Twilio account. Those examples are not additional Galloram subprocessors. New or replacement Galloram subprocessors are subject to the notice, objection, and termination provisions under Subprocessors.