Data Processing Agreement.
A concise description of Dunning’s processing commitments for organizations using the service.
Roles and instructions
For customer information submitted to the service, the customer organization acts as controller or business and Dunning acts as processor or service provider. Dunning processes personal data only to provide the service, follow customer instructions, maintain security, and meet legal obligations.
Data processed
Processing may include business contact details, customer names and email addresses, invoice and payment-status information, correspondence, recovery decisions, workspace configuration, audit records, and technical identifiers.
Confidentiality and security
Dunning limits access to authorized personnel and service providers with a need to know and confidentiality obligations. Controls include authentication, authorization, organization-level isolation, encrypted transport, secrets management, logging, monitoring, and backups.
Subprocessors
Dunning may use subprocessors and infrastructure providers such as Clerk, Resend, Google Cloud/Gemini, and billing or payment providers selected by the customer. Dunning remains responsible for subprocessors within its service commitments.
Assistance and incidents
Dunning will provide reasonable assistance with data-subject requests and security investigations when information is available. We will notify the customer of a confirmed personal-data breach affecting its data without undue delay.
Return and deletion
On termination or written request, Dunning will delete or return customer data where practicable, except where retention is required by law or for security, audit, or dispute purposes. Requests go to support@dunning.website.
Compliance safeguards
Dunning includes configurable safeguards for opt-outs, disputes, attorney representation, vulnerability and hardship disclosures, contact hours, message frequency, sanctions screening, and unsafe outbound language. These are product controls, not legal advice or a guarantee of compliance in every jurisdiction. Organizations must provide accurate location and account information and review their workflows.
These materials describe the current intended operation of Dunning and may be updated as the service develops.