Effective date: 24 September 2026 for accounts opened on or after that date; 25 October 2026 for accounts opened before it. Last updated: 24 September 2026. Version: 2026-09-24.
GoUltra Systems LLC, a Wyoming limited liability company. Postal address: 312 W 2nd St #2692, Casper, WY 82601, USA. Support: support@goultra.ai. Privacy: privacy@goultra.ai.
1. Scope roles and instructions
This DPA forms part of the agreement between GoUltra Systems LLC and the Customer for personal data processed on the Customer's behalf. The Customer is controller, or an authorized processor acting for its controller, and GoUltra is processor or subprocessor for that processing. GoUltra's own controller activities are described in the Privacy Policy. This DPA prevails over inconsistent general terms on Customer Personal Data. GoUltra acts only on documented instructions contained in the agreement, configured functions and authorized customer actions, including instructions concerning international transfers, unless law requires otherwise. It informs the Customer of a legally required processing instruction where permitted and alerts the Customer if it considers an instruction unlawful.
2. Processing description
The subject is delivery of the GoUltra communication and workflow service. Operations include receipt, transmission, hosting, organization, retrieval, display, customer-directed analysis and deletion. Purposes include WhatsApp conversations, appointments, contacts, quotes, documents and campaigns. Data subjects include customer contacts and recipients, authorized users and people communicating with the Customer. Data may include names, telephone numbers, profiles, messages and metadata, images, recordings, documents, notes, appointments, quote and signing records and service identifiers. Processing lasts during service use and thereafter only for lawful return, deletion and limited retention. The Customer supplies the information and instructions lawfully. The standard service does not require sensitive data; a supported sensitive-data workflow needs the required legal conditions and safeguards. HIPAA information is accepted only under an expressly agreed supported arrangement.
3. Purpose restrictions and confidentiality
GoUltra does not sell personal data. It does not use Customer Personal Data for cross-customer advertising or train its own generalized AI models on it. Where service-provider or contractor restrictions under applicable US state law apply, GoUltra does not sell or share the data, retain or use it outside the specified business purposes or direct business relationship, or combine it in a prohibited manner. It provides the required level of protection, notifies the Customer if it can no longer meet those duties, and permits reasonable steps to stop and remediate unauthorized use. Authorized personnel are bound by continuing confidentiality duties and receive access only as needed. Customer instructions cannot authorize a use prohibited by mandatory law or binding platform restrictions.
4. Security and incidents
GoUltra maintains appropriate technical and organizational measures described below, considering the nature, risk and context of processing. Changes must not reduce the agreed level of protection. GoUltra notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, supplies available information on scope, consequences, mitigation and contact, and provides updates as facts become known. It does not wait for a complete investigation before giving required initial notice. The parties cooperate on legally required notifications; GoUltra does not impose a generic 72-hour waiting period on its processor notice duty.
5. Subprocessors
The Customer grants general authorization for the subprocessors identified in the current versioned recipient register. GoUltra gives advance notice of additions or replacements before processing begins, including email for material changes, so the Customer has a reasonable opportunity to object on data-protection grounds. The parties seek a reasonable solution; if unresolved, the Customer may terminate the affected service. GoUltra imposes appropriate written obligations on its subprocessors and remains responsible for their performance. Independent store controllers and providers engaged directly by the Customer are identified separately and are not mislabeled as GoUltra subprocessors.
6. Assistance and accountability
Taking account of the processing and available information, GoUltra assists with data-subject requests, security obligations, impact assessments, prior consultation and incident response. It provides export, correction and deletion tools and reasonable assistance where the tools are insufficient. It makes compliance information available, including the register, security measures and reasonable security questionnaires, normally once in twelve months unless an incident, authority or legal duty requires more. Mandatory audit rights are preserved through a proportionate arrangement protecting other customers and system security. GoUltra does not claim an unheld SOC 2 or ISO certification or make an authority's investigation conditional on a commercial questionnaire limit. GoUltra makes the information necessary to demonstrate compliance available and allows and contributes to legally required audits, including inspections, by the Customer or its mandated auditor. Reasonable scheduling and confidentiality protections must not prevent a legally required audit.
7. Return deletion and recovery
At the Customer's choice and subject to applicable law, GoUltra returns or deletes Customer Personal Data at the end of service and deletes existing copies unless lawful retention is required. The Customer can export before closure, and mandatory switching and retrieval periods take precedence where applicable. Active deletion normally completes within 30 days, sooner where required. Lawfully retained copies are restricted to the justified purpose. Encrypted backup maxima and cleanup delay are not a blanket exception to erasure: where applicable law requires earlier destruction, that requirement controls. Deletion controls are reapplied before recovered data is returned to use, and processor deletion instructions are propagated as required.
8. International transfers
The verified transfer schedule forms part of the processing arrangements and identifies the actual parties, roles, locations and applicable mechanisms. The parties implement the valid instrument and necessary annexes, assessments and supplementary safeguards before a restricted transfer occurs. A reference to standard clauses or another provider's certification does not by itself establish a transfer mechanism for GoUltra. Where mandatory standard clauses are used, their required terms are not altered by this DPA and prevail in a conflict. Any lawful request for disclosure is assessed and challenged where appropriate, and the Customer is informed where permitted. Required local approvals or restrictions remain applicable.
9. Technical and organizational measures
Data is transmitted using HTTPS/TLS. Cloudflare encrypts content stored in D1 and R2. GoUltra encrypts credentials and access tokens using AES-256-GCM with a per-installation key wrapped by a versioned key, and refuses to store or transmit a designated credential unencrypted. Business identifiers and scoped queries separate tenant data; team permissions restrict access to authorized numbers and functions, and administrative endpoints are separately controlled. Authentication uses the deployed sign-in and verification mechanisms, optional time-based codes where offered and hashed session tokens. Administrative access is attributable and security events are logged without credentials or message content. Per-account and per-key controls limit abuse. Source is version controlled, changes are checked before deployment and prior tagged releases support rollback. These are factual control statements and do not imply certification or protection against every threat.
10. Backup schedule
Daily encrypted database recovery copies are kept for up to 45 days, weekly copies for 183 days, monthly copies for 366 days and copies outside the primary cloud account for 30 days, with a maximum additional cleanup delay of 7 days. Access is restricted to authorized recovery and security operations. Actual destinations and processing arrangements appear in the recipient register. The schedule is reviewed for necessity and does not override a shorter legal deletion duty. Restore procedures include verification that erased records do not reappear in normal use.