Data Processing Agreement

Version 1.0. Effective 7 August 2026.

Between you, the founder using LaunchValid, and AmpFi App LLC, a Wyoming limited liability company trading as LaunchValid.

Questions about anything here go to hello@launchvalid.com.

---

In plain words, before the formal part

When you use LaunchValid to run a demand test page, or an app that other people sign in to, those other people give you their information. Their names, their email addresses, whatever your form asks for.

That information is yours to answer for, not ours. You decide what to collect and why. We hold it for you and do what you tell us with it.

This document is the written promise that we will only ever do what you tell us, that we will keep it safe, that we will help you when one of your customers asks to see or delete their information, that we will tell you quickly if something goes wrong, and that we will give it back and delete our copies when you leave.

You need this document if any of your customers are in the United Kingdom or the European Economic Area. The law there says you cannot let somebody else hold your customers' information without an agreement like this one in place. It costs you nothing and there is nothing to negotiate.

The rest of this is the same promises, written the way the law expects.

---

1. What this covers, and when it applies

This agreement applies whenever LaunchValid handles personal information on your behalf. That is:

• People who fill in a form on a demand test page you published
• People who sign in to an app you built, and anything they save in it
• People whose contact details you upload or enter into the product
• Anyone whose personal information appears in material you give us

It does not cover your own account with us. There, you are our customer, and our Privacy Policy explains what we do with your information.

This agreement forms part of the Terms of Service. Where the two disagree about personal information belonging to your customers, this agreement wins.

2. Who answers for what

Two words with fixed legal meanings, used throughout.

Controller is the party that decides what personal information is collected and why. For your customers' information, that is you.

Processor is the party that holds and handles it on the controller's instructions. That is us.

You are responsible for having a lawful reason to collect what you collect, for telling your customers what you do with it, and for answering them when they ask. We are responsible for doing only what you tell us, keeping it safe, and helping you meet those duties.

You confirm that you have a lawful basis for the personal information you put through LaunchValid, and that you have given your customers the notice the law requires. Your account settings hold a link to your own privacy notice, and we show it to your customers where they give you their details.

2A. One part works the other way round

We say this plainly rather than leave it implied, because it is the kind of thing a careful reader finds later and wonders why it was not said.

How signing in to your app works is our decision, not yours, so for that part we are the controller. We choose that it is an emailed link and not a password. We choose how long a sign in lasts. We choose how often one email address can be written to across every app on LaunchValid, and which addresses we stop writing to because they bounced or asked us to stop. We choose when an account nobody has used is removed. You cannot change any of those, and it would be wrong for us to describe them as your instructions when no control exists for you to give one.

Everything your app stores, and every role you hand out, stays yours to decide and ours to hold for you. Section 2 governs all of that, and the rest of this agreement applies to it in full.

3. Our instructions come from you

We handle your customers' personal information only:

• To provide the product to you, which is your standing instruction
• On any further written instruction you give us
• Where a law we are subject to requires it, in which case we tell you first, unless that law forbids us from telling you

We will tell you if we believe an instruction of yours breaks data protection law, and we may pause that instruction while we discuss it with you.

We do not sell your customers' personal information. We do not use it for our own purposes. We do not use it to train artificial intelligence models, and our contracts with the suppliers in Annex B bar them from using it to train theirs.

4. Confidentiality

Everyone who can reach your customers' personal information is bound to keep it confidential, and only the people who need it for their work can reach it.

5. Security

We keep the measures set out in Annex C. If we change them, they stay at least as protective as they are now.

6. The other companies that help us

We use the suppliers listed in Annex B, and you agree to us using them.

Each one is under a written contract carrying data protection terms at least as strict as this agreement, and we remain answerable to you for what they do with your customers' information.

If we add or replace one, we will tell you by email at least thirty days before they start handling your customers' information. If you object on reasonable data protection grounds within those thirty days, reply to that email and we will try to offer you a different arrangement. If we cannot, you may end your subscription for the affected part of the product, and we will refund the unused part of what you have paid.

7. Helping you with your customers' requests

If one of your customers asks to see, correct, delete, or take away their information, or objects to what you are doing with it:

• Where the product lets you do it yourself, you do it, and we build the tools for that
• Where it does not, ask us and we will do it, at no charge, within five working days
• If your customer contacts us directly, we will not answer for you. We will point them to you, and tell you they got in touch, within three working days

We will also help you, as far as we reasonably can, with data protection impact assessments and with consulting your regulator, where those are needed because of how the product works.

8. If something goes wrong

If we become aware of a security breach affecting your customers' personal information, we will tell you without undue delay, and within seventy two hours of becoming aware of it.

We will tell you what we know: what happened, roughly how many people and records are affected, what the likely consequences are, and what we are doing about it. If we do not have all of that at once, we will send what we have and follow up as we learn more.

Telling your customers, and telling your regulator, is yours to do, because you are the controller. We will give you what you need to do it.

9. How long we keep things, and deleting them

We keep your customers' personal information for as long as you keep it in the product, plus the periods in Annex A.

When your subscription ends, or on your written request at any time:

• Where your app uses the sign in we provide, that sign in stops thirty days after your payment stops
• Your information stays available for you to download for ninety days after that
• We then delete it, and ask our suppliers to delete their copies, within thirty days
• Backups are overwritten on a rolling cycle, and any copy of deleted information goes with them. Until it does, it stays protected by this agreement and is not used for anything

We keep only what a law requires us to keep, and only for as long as it requires.

If you tell us to delete something sooner, we do it, and we confirm in writing when it is done.

10. Where the information is held

Your customers' personal information is held by us and by the suppliers in Annex B, which means it may be handled in the United States and in the other countries named there.

Where personal information leaves the United Kingdom or the European Economic Area, that transfer relies on the UK International Data Transfer Addendum and the European Commission's standard contractual clauses, which form part of this agreement and of our contracts with those suppliers.

11. Showing you we do what we say

On reasonable notice, and no more than once a year unless a regulator requires otherwise or we have had a breach, we will give you the information you reasonably need to satisfy yourself that we are keeping to this agreement.

We can usually meet that with a written response and our security documentation. Where that genuinely is not enough, you may audit us, or have an independent auditor do it, at your cost, at a time that does not disrupt the service.

12. Liability

Liability under this agreement is subject to the limits in the Terms of Service, except where the law does not allow those limits to apply.

13. How long this lasts, and changing it

This agreement lasts as long as we hold personal information on your behalf, including after your subscription ends.

We may update it to keep up with the law or with changes to the product. We will tell you at least thirty days before any change that materially reduces your protection, and you may end your subscription if you do not accept it.

---

Annex A: what we handle

Kinds of personal information. Names, email addresses, and anything else your own form or app asks for. Records of when somebody signed in. A one way scrambled form of visitor network addresses, which we cannot turn back into an address. Whatever your customers save in your app.

Whose information. Your customers and prospective customers. Visitors to pages you publish. People you invite into your app. People whose details you upload.

Special categories. Not intended and not supported. Do not use LaunchValid to collect health information, biometric information, or the other special categories the law names. If your idea needs those, this is not the right place for it.

Children. The product is not for children. Do not use it to collect information from anyone under sixteen.

What we keep after you delete something. Email delivery records for one hundred and eighty days, which is how we answer "my customer says the email never arrived". Technical request records for ninety days. Where your app uses the sign in we provide, an account nobody has signed in to for twenty four months is deleted, and we tell you before it happens.

Annex B: the other companies that help us

Google and Sheets appear only when you connect them. Stripe appears only when you pay us.

Annex C: how we keep it safe

Getting in. You sign in with Google or with an emailed link. We do not store a password for your account, and we do not store passwords for your customers either. Your customers sign in with an emailed link.

Keeping apps apart. Every published page and app is served from its own web address, on a different domain from the product itself, so a published page can never reach your account. A sign in for one app cannot be read by another.

Moving around. Everything travels encrypted between browsers, our servers and our suppliers.

Sitting still. Stored files and records sit on encrypted storage provided by our infrastructure suppliers.

Who can see it. Access is limited to the people who need it for their work, and to the smallest number of people who can run the service.

Records. Email delivery, technical requests and administrative actions are recorded, and kept for the periods in Annex A.

Passwords and keys. Credentials for our suppliers are held as encrypted configuration, never in the product's code.

---

Accepting this

You accept this agreement by accepting the Terms of Service, or by turning on sign in for an app you built. No signature is needed. If your own compliance process needs a signed copy, email hello@launchvalid.com and we will sign one.