Data Processing Addendum

Last updated: October 12, 2026

This addendum covers personal information you upload to Encore Text. See also our Privacy Policy and Terms of Service.

1. Roles

You (the customer) are the controller, or "business", for the personal information in your contact lists and messages: you decide who to text and why. Shaw Wireless Inc, doing business as Encore Text, is your processor, or "service provider", and processes that information only for you.

2. Processing only on your instructions

We process customer personal information only to provide the service, following your documented instructions — your settings, uploads, campaigns and support requests — and as required by law. We tell you if we believe an instruction breaks the law. We do not sell or share it, use it for our own marketing, or combine it with other data except as needed to provide the service.

3. Confidentiality

Everyone authorized to process customer personal information is bound by confidentiality duties. Staff access it only to provide support you requested, investigate abuse or carrier complaints, or comply with law, and staff views of contacts and messages are logged.

4. Sub-processors

We use these sub-processors: Twilio (message delivery and toll-free numbers), Stripe (payments), Lovable Cloud with Supabase (application hosting and database) and our email delivery provider (account and notice emails). Each one is bound by data-protection terms at least as protective as these. We will give notice of new sub-processors through our Privacy Policy, and you may object for reasonable data-protection reasons.

5. Security

We maintain appropriate technical and organizational measures, including encryption in transit, workspace-level access isolation, role-based permissions, private file storage, logged staff access and routine backups.

6. Breach notice

If we become aware of a security breach affecting your customer personal information, we will notify you without undue delay, and we aim to do so within 72 hours. We will share what we know, the steps we are taking and the help you need to meet your own notice duties.

7. Data-subject requests

We help you respond to requests from individuals to access, correct, delete or opt out, using the export, deletion and opt-out tools in the service, or with reasonable further help on request. If an individual contacts us directly about your data, we refer them to you unless the law requires otherwise. STOP and opt-out requests are honored automatically.

8. Deletion and return

You can export your data at any time. Within 30 days after a workspace closes, we permanently delete its contacts, messages, click data and uploaded files. We keep consent records, opt-in proof and audit logs only for as long as the Privacy Policy says, to show compliance.

9. Applicable laws

We process customer personal information in line with applicable US state privacy laws, including the California Consumer Privacy Act service-provider requirements, and with Canada's PIPEDA and provincial privacy laws where they apply. Data is stored and processed in the United States. Canadian customers are responsible for telling their contacts that their information may be processed in the United States.

10. Audits

Once a year, or after a breach, you may ask us to fill in a reasonable written security questionnaire. Email support@encoretext.com. We will answer within a reasonable time, and our answers are confidential.

11. Part of the Terms

This addendum is part of our Terms of Service, and the Terms' liability limits apply to it. Where this addendum and the Terms conflict on the processing of customer personal information, this addendum applies.