Data Processing Agreement

• Process personal data only on your documented instructions — the Terms, this DPA and your use of the service’s features — including for international transfers, unless EU or member-state law requires otherwise (we will tell you first unless the law forbids it).
• Tell you promptly if we believe an instruction infringes data protection law.
• Ensure everyone authorised to process the data is bound by confidentiality.
• Implement the technical and organisational measures in section 6.
• Help you respond to data subjects exercising their rights, with in-app tools (export, correction, deletion) and on request.
• Help you with security, breach notification, data protection impact assessments and prior consultation (Arts. 32–36), taking into account the information available to us.
• Not use your data to train AI models, sell it, or use it for our own purposes except to provide, secure and improve the service in aggregated, de-identified form.

You give general authorisation for the sub-processors on our Sub-processors page. We impose data protection obligations on them at least as protective as this DPA and remain liable for their performance. We will give at least 30 days’ notice of a new sub-processor; you may object on reasonable data-protection grounds, and if we can’t resolve the objection you may terminate the affected service and receive a pro-rata refund of prepaid fees.

Your data is stored in the EU (Microsoft Azure, Poland Central). Where a sub-processor processes it outside the European Economic Area, the transfer is covered by the European Commission’s Standard Contractual Clauses, the EU-US Data Privacy Framework where the sub-processor is certified, or another mechanism permitted by Chapter V GDPR, together with supplementary measures where needed.

We notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations (Arts. 33–34), updated as we learn more.

• Encryption in transit (TLS) and at rest; data hosted in EU Microsoft Azure data centres with their certified physical security.
• Logical separation of each customer’s data enforced in the database (row-level security); role-based access within each workspace; optional PIN-protected Vault.
• Hashed passwords and PINs; short-lived signed sessions; rate limiting and brute-force protection; secrets kept in managed secret stores.
• Audit logs and document version history; point-in-time database backups (7 days) in the same EU region.
• Least-privilege production access, dependency updates and automated tests on every change.

You can export and delete your data at any time in the app. When your account ends we delete your data immediately on account deletion — database backups expire within 7 days — unless law requires us to keep it.

We make available the information reasonably needed to demonstrate compliance with Art. 28, and allow audits by you or an independent auditor you mandate, on reasonable notice, at most once a year (more often after a breach or if a regulator requires it), during business hours and subject to confidentiality. We may first provide existing reports or answers to your questionnaire.

Liability under this DPA is subject to the limitations in the Terms, except where the law does not allow them to apply. If this DPA conflicts with the Terms on data protection, this DPA prevails.