Data Processing Addendum (DPA)
Last updated: 19 June 2026
This DPA forms part of the Terms of Service between you (the “Customer”, acting as data controller) and Muloo (the “Processor”) and applies where Muloo processes personal data on your behalf in providing Muloo Signals.
1. Roles & scope
For HubSpot data and prospect data you bring into the product, you are the controller and Muloo is the processor. Muloo processes this personal data only to provide the service and on your documented instructions, including those given through the product's settings.
2. Nature & purpose of processing
Processing covers: importing prospect data; researching and scoring prospects; generating editable outreach drafts; operating the human-approved task queue; and syncing qualified contacts, companies, notes and tasks to your HubSpot portal. We do not scrape LinkedIn or perform automated outreach.
3. Categories of data & data subjects
Data subjects: your prospects and the contacts in your HubSpot portal. Data categories: business contact details, role/firmographic information, and outreach/activity records. You must not upload special-category data.
4. Sub-processors
You authorise Muloo to engage sub-processors (hosting, database, AI model provider, payment processor) under written terms imposing equivalent data-protection obligations. We maintain a current sub-processor list and will give notice of material changes so you may object.
5. Security
Muloo implements appropriate technical and organisational measures, including encryption of credentials in transit and at rest, least-privilege access, audit logging of CRM reads and writes, and reversible HubSpot writes (no bulk overwrites).
6. International transfers
Where personal data is transferred across borders, Muloo relies on an appropriate transfer mechanism (such as Standard Contractual Clauses) where required by law.
7. Assistance, breach & deletion
Muloo will assist you, taking into account the nature of processing, with data-subject requests and with security, breach-notification and impact-assessment obligations. We will notify you without undue delay of a personal-data breach. On termination, Muloo deletes or returns customer personal data per the Terms.
8. Audits
Muloo will make available information reasonably necessary to demonstrate compliance with this DPA and will accommodate reasonable audit requests, subject to confidentiality.
9. Contact
To request a signed copy or our sub-processor list, email legal@muloo.co.