Data Processing Agreement

Last updated: 11 October 2026 · Part of the Junto Terms of Service

1. Parties and roles

The business using Junto is the controller of its customers' personal data. Sabu Labs LLC, which operates Junto, is the processor and processes that data only on the business's documented instructions, which are its settings and its use of the Service. This agreement meets Article 28 of the GDPR and the UK GDPR, and applies equally to similar laws elsewhere.

2. What is processed

• Data subjects: the business's customers and prospects who write to it on WhatsApp or Instagram, and its team members.
• Data: names, WhatsApp numbers and Instagram accounts, messages, voice notes, photos, videos and documents, bookings, orders, payment status and receipts, notes and marketing preferences.
• Purpose: answering messages, managing bookings, orders and payments, sending confirmations and reminders, and giving the business its dashboard.
• Duration: while the business uses Junto, plus the deletion period below.

3. Our obligations

• Process the data only on the business's instructions and tell it if an instruction seems to break the law.
• Keep the data confidential; only authorised people who are bound to confidentiality can access it.
• Protect it with appropriate security: encryption in transit, encryption of secrets at rest, access control with two-factor authentication for administrators, logging, backups and masked phone numbers in monitoring.
• Help the business answer data-subject requests (export and deletion are available in the dashboard) and with security, impact assessments and consultations where needed.
• Notify the business of a personal-data breach without undue delay, and within 48 hours of becoming aware of it.
• When the account is closed, delete the business's customers' data within 30 days, unless the law requires us to keep it; the business can export it before closing.
• Make available the information needed to show compliance and allow reasonable audits, with reasonable notice.

4. Sub-processors

The business authorises these sub-processors. We bind each one to data protection terms at least as protective as these and remain responsible for them.

• Hetzner Online: hosting and database
• Cloudflare: network and security
• Meta Platforms (WhatsApp Business Platform, Instagram): message delivery
• Anthropic and OpenAI: AI replies and voice-note transcription
• Functional Software (Sentry): error monitoring, with phone numbers masked
• Google, Shopify, WooCommerce and payment providers: only when the business connects them

We will give at least 30 days' notice of new sub-processors in the dashboard or by email; the business may object on reasonable grounds, and if we cannot address the objection it may close its account.

5. Data processed in other countries

Junto is used worldwide, so personal data (for example a customer's message handled by Meta or an AI provider) may be processed in countries other than the customer's. We comply with the privacy laws that apply to the data we process. For personal data from the EU or EEA processed in a country without an adequacy decision, the parties agree to the European Commission's Standard Contractual Clauses (Module Two, controller to processor, and Module Three for onward transfers to sub-processors), and for the UK the International Data Transfer Addendum, which are incorporated by reference.

6. Contact

Sabu Labs LLC · [email protected]