Skip to content

Data processing agreement

Last updated: 2026-10-07.

This agreement is between OpenWings Automação Comercial Ltda., CNPJ 63.852.648/0001-06 ("colding", "we"), and the customer who owns a workspace ("you"). It is part of the Terms of service and applies from the day you create a workspace, without a signature, the same way the Terms do. Two sets of standard contractual clauses, for moving data between countries, are annexes to it (section 9).

It covers the personal data we handle on your behalf: your contacts, the people who write to your mailboxes, and the people your app emails through us. Under the GDPR you are the controller and we are the processor. Under the LGPD you are the controlador and we are the operador. If you handle that data for a client of yours, you are their processor and we are your sub-processor, and this agreement applies the same way.

It does not cover data about you and your team, such as your account, your sign-ins and your plan. For that data we are the controller. The privacy policy covers it.

Our data protection contact, encarregado under the LGPD and data protection officer under the GDPR, is Gustavo Salomé Silva, at [email protected].

1. What we do with your data

We connect to the mailboxes you choose. We send your campaigns, single messages and your app's email through them, read their mail into your inbox, check whether addresses can receive mail, and keep track of what happened to each message. We do this only to run the service for you, as the Terms, this agreement, the API guide and your own settings describe.

This agreement lasts as long as your workspace exists, and for the time it takes to delete it (section 8).

2. Whose data, and which data

The people are:

  • your contacts: the people in your lists, and the people your app emails through the service;
  • correspondents: anyone who writes to a mailbox you connected.

The data is:

  • For a contact: what you import or add (email address, name, company and the custom fields you define), and what we learn by sending: which steps went out, and whether the person replied, bounced, complained or unsubscribed. When someone opts out, we keep a suppression record. If you turn on tracking, also when an email was opened or a link was clicked, which kind of program did it, and the IP address as a keyed hash.
  • For an address check: the address, the result and why.
  • For a message: the headers and the text and HTML body, up to 512 KB per part. We never store attachments. When you download one, we fetch it from the mailbox and pass it to you without keeping it.
  • For app email sent through us: the address, the message, and what became of it.

We do not look for special categories of data, such as health, beliefs or criminal records, and the service is not built to hold them. You decide what goes in your lists and mailboxes.

3. Your instructions

We process your data only on your documented instructions: this agreement, the Terms, the API guide, your settings, and what you ask the console, the API or the MCP server to do. If we think an instruction breaks the law, we tell you, and we may wait to carry it out until you confirm or change it. An instruction that goes beyond how the service works needs a written agreement. If the law requires us to process your data in another way, we tell you first, unless the law forbids it.

We do not sell your data, use it for our own marketing, or use it to train models.

4. Who can see it, and how we protect it

Only the people who run colding can reach your data, and each is bound to keep it confidential, also after they stop working with us. Today that is the operator alone. What staff change in the admin area is written to the audit log with the name of who did it.

These measures exist today:

  • Mailbox logins are encrypted (AES-256-GCM) before they are stored. The service that answers the links in your emails never holds the key.
  • API keys are stored as hashes. A key's secret is shown once.
  • Each workspace's data is kept apart. A request for another workspace's data is answered "not found".
  • You decide what a person or an API key may do: owner, admin and member roles, and for a key, which mailboxes and campaigns, a daily and a total send limit, and an expiry date.
  • Traffic to and from our servers uses TLS wherever the other side supports it. The database asks for its password on every login from outside our server.
  • Mail you receive is cleaned and shown in a sandbox without scripts.
  • The audit log records who changed what in your workspace. We keep it 90 days.
  • Our address-checking server keeps no copy of the addresses it checks and never writes them in its logs.
  • Backups: a copy of the database every night. Before a copy leaves our server we encrypt it with a key that is kept offline. We keep copies 7 days on our server and 30 days in a private bucket.

We may change these measures, and we do not lower the protection they give. No system is perfect.

5. Sub-processors

You allow us to use the sub-processors on the sub-processors page. It says what each one does for us, what it receives and where it works.

Before we add or replace a sub-processor that handles your data, we email your workspace's owners 30 days ahead. If you object for a reason about data protection, write to [email protected] before the change applies, and we will talk. If we cannot agree, you can delete the workspace before the change applies (section 8).

We have a written data processing agreement with each sub-processor that handles your data. We remain responsible to you for what they do with it. Section 8 of the privacy policy says what those agreements say, and do not say, about moving data between countries.

6. Requests from people

If someone asks us to show, correct or delete data we hold for you, or to stop mail to them, we do not answer for you. We send the request to you and help you answer it. A person who uses an unsubscribe link, or replies asking to stop, is stopped at once and needs no account.

You can do most of it yourself: find a contact, change or delete it, add it to the suppression list, and export your contacts as a spreadsheet from the Contacts page. If you need more, write to [email protected]. We answer within 15 days.

We also help you with a data protection impact assessment and with questions from a supervisory authority (in Brazil, the ANPD), with what we know about the processing.

7. If something goes wrong

When we learn of a personal data breach that affects your data, we email your workspace's owners within 48 hours. We do not wait until we know everything. We say what happened, which data and roughly how many people it touches, what we have done, and who to ask, and we send an update each time we learn more.

Your own clocks may be short: 72 hours to tell a supervisory authority under the GDPR (article 33), three working days to tell the ANPD and the people affected under Resolution CD/ANPD 15/2024. Both start when you know, so we tell you as early as we can. We help you with any notice you owe an authority or the people affected. Whether to send that notice is your decision.

We keep a record of every breach: what happened, what it touched and what we did. We give it to you, or to an authority, on request.

8. Getting your data out, and deleting it

While you use the service. The workspace owner can download a copy of the workspace's data from Settings, under Your data. It is one file with the contacts, labels and segments, the campaigns, every email sent with what it said, the inbox, drafts, the suppression list, saved replies, the settings of the mailboxes, API keys and webhook, the members, and the record of who changed what. It leaves out logins and passwords, mailbox sign-in tokens, API key hashes, the webhook's signing secret and the addresses of warmup partners. The owner can make up to 1 of these files a day. Each link works 60 minutes, for up to 3 downloads.

When you leave. The owner asks to delete the workspace in Settings, under Delete workspace. For 30 days the owner can cancel. From the moment they ask, the workspace sends nothing and its API keys stop working. When the date passes, we erase its mailboxes and their logins, contacts, campaigns, messages, sends, drafts, address checks, webhooks, API keys, members, invitations, download links and audit log. Erasing runs in steps and takes from a few minutes to some hours for a big workspace. Nothing can be downloaded once it starts, so download first.

What stays. Only as a keyed hash, a code we cannot turn back into the address, and with no workspace attached: a recipient's own opt-out for 3 years, so the same owner's next workspace cannot write to someone who asked to stop; a hold on a mailbox address's warmup until it ends, and for 1 year when it has no end; and the limit we put on the workspace, if it had one, for 2 years. The workspace's row stays with no name and no readable address: its id, dates, plan, the Stripe ids our payment records need, and the version of the acceptable use policy it accepted. Section 6 of the privacy policy has the full list.

Backups and sub-processors. Data leaves our backups when the last copy that holds it expires: 7 days on our server and 30 days offsite. MillionVerifier keeps an address it checked in its cache for up to 7 days, and in its backups until they are replaced.

One contact. Deleting a contact removes it from your lists. The emails already sent to it stay in the send log until the workspace is erased, and its suppression record stays, because that is the only way to keep honoring its opt-out.

The sign-in account of the person who asked stays. They can delete it themselves in Settings, under Delete your account, by typing the email they sign in with. Before that, they give each workspace they still own to another member or ask to delete it. Section 6 of the privacy policy says when an account deletion runs and what it removes.

9. Moving data to other countries

Our servers are in the United States, so what we hold for you is stored there, wherever you and your contacts are. The sub-processors page says where each of the others works. Section 8 of the privacy policy says, for each one, what its agreement states about moving data between countries. Where an agreement names no mechanism, we say so and do not claim one.

The clauses. Two sets of standard contractual clauses are annexes to this agreement. They bind us both from the day you create a workspace, the same way the rest of the agreement does.

  • The ANPD's clauses, Annex II of Resolution CD/ANPD 19/2024, for personal data the LGPD covers. They are in Portuguese and nothing in them is changed, because the resolution (article 16) has them adopted as written. The blanks the form leaves are filled in there.
  • The EU's clauses, Module Two (controller to processor) of Commission Implementing Decision (EU) 2021/914, with the UK's addendum and the Swiss additions, for personal data the GDPR, the UK GDPR or Swiss law covers. The options we chose are listed at the top of that page.

In both you are the exporter and the controller, and we are the importer and the processor (the operador, in the LGPD's words). If you handle this data for a client of yours, you are a processor too, and these versions do not fit: write to [email protected] and we will sign the one that does. For a copy signed by both of us, with your details filled in, write to the same address.

What each set is for. Brazil and the EU now treat each other's rules as adequate. The ANPD did so in Resolution 32/2026, for personal data sent from Brazil to the European Union. The European Commission did so in Decision (EU) 2026/179, for personal data sent from the EU to controllers and processors in Brazil that the LGPD covers. So a move of data between the two needs no clauses of its own, and the EU's clauses are a fallback. Clause 16(e) lets either of us revoke them while that decision covers the move. Neither of us has, so they stand until one of us does. They are also the instrument we offer for UK and Swiss data. The move that is left is the one out of Brazil, to our servers and to some of our sub-processors in the United States, and the ANPD's clauses are for that.

Where we stand in the LGPD. The ANPD's clauses speak of an importer in a foreign country (article 3 of the resolution). We are a Brazilian company, so it is not clear that your sending data to us is a transfer abroad. The move that surely is one is ours, from Brazil to the United States. We adopt the clauses whichever way it is read, so you are covered if your move counts.

Sending your data on. In the ANPD's clauses we chose Option B of clause 3, and in the EU's clauses Option 2 of clause 9(a). Both let us send your data on to the companies the sub-processors page lists as able to handle your contacts' data, for what that page says each one does, and to no one else. We tell you 30 days ahead of a change (section 5), and we answer to you for what they do with your data. The clauses (ANPD clause 18.2, EU clause 9(b)) ask for a written contract that holds each of them to the same safeguards. Each has a data processing agreement with us. None of those agreements names the ANPD's clauses, and none of those companies has signed them. The privacy policy's section 8 quotes what each agreement does say.

What we have not done. Both sets ask us to declare that we found nothing in the law of the country where the data sits that stops us keeping the clauses (EU clause 14(a), ANPD clause 22.1). We have not written down an assessment of United States law behind that declaration, and EU clause 14(d) asks for one. If you need one for your own file, write to [email protected].

The notice your contacts read. In the ANPD's clauses you are the Designated Party, so clause 14 has you publish a notice about the transfer, in Portuguese and plain words. We write none for you. These are the facts it needs from us:

  • Form, duration and purpose: your contacts' data and your messages go to our servers all the time, for as long as the workspace exists, so that we run the service for you (sections 1 and 2).
  • Destination: the United States. The sub-processors page says where each of the others works.
  • Who shares it: only the companies that page lists as able to handle your contacts' data, each for what it does for us.
  • Who answers for what: you are the controller, and we follow your instructions (section 3).
  • The rights of the people, and how to use them: section 6. We send a request to you and help you answer it.
  • Onward transfers: the same companies, and their purposes, on the sub-processors page.

10. Checking that we do what we say

On request we give you the information you need to check that we follow this agreement. If that is not enough, you can audit us on site, at your own cost, with 30 days' written notice. An audit cannot reach other customers' data.

11. If the documents disagree, and changes

If this agreement and the Terms disagree about personal data, this agreement wins on that point. If either annex and this agreement disagree, the annex wins. The rest of the Terms applies to this agreement, including the governing law and the forum (their section 11), except where an annex names its own. The limit on our liability in their section 10 does not reach what the clauses say about liability (the ANPD's clause 17, the EU's clause 12). We change this agreement the way the Terms say we change themselves (their section 12), and each version is dated at the top.