# FlowsFixed Data Processing Addendum (draft, pending review)
1. Roles.  You are the controller of shopper data in your Klaviyo account.  FlowsFixed is a processor acting only on your instructions to deliver the purchased service.
2. Access.  We use one Klaviyo user you invite.  We do not export, copy, or sell shopper lists.  We view profiles only as needed to test flows.
3. Test sends go only to FlowsFixed controlled addresses.
4. Retention.  We keep our own work notes, never shopper records.  You may remove our user at any time; we ask you to remove it at handoff and confirm in writing.
5. Security.  Credentials are never requested.  Our systems use access controls and logging.
6. Incidents.  We notify you within 72 hours of learning of any incident affecting your data.
7. Subprocessors.  Klaviyo (your provider), our hosting provider Railway, and our AI model providers for drafting copy, which receive product and brand information, not shopper personal data.