Data Processing Agreement (DPA)

The Processor shall process Personal Data only:

• As necessary to provide the Service (PDF-to-ESX conversion platform)
• In accordance with Controller’s documented instructions (these Terms and this DPA)
• As required by applicable law

• Controller’s employees and authorized users
• Property owners and insured parties identified in uploaded documents
• Other individuals whose data appears in uploaded PDFs

• Identifiers: Name, email address, IP address
• Property information: Addresses, claim numbers
• Insurance information: Carrier names, policy references (if present in PDFs)
• Financial data: Subscription and billing records (Stripe customer ID only)

Personal Data is processed for the duration of the Service agreement and retained as follows:

• Conversion records and metadata: retained for the life of the account (this powers History and re-download); permanently purged within 90 days of account deletion.
• Uploaded source PDFs and generated ESX files: retained until the user deletes them (default), or automatically purged according to the account’s configurable retention window (1–30 days) when Ephemeral Privacy Mode is enabled on the account.
• Deleted conversions: soft-deleted and permanently purged 90 days after deletion.

The Processor shall process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country.

The Processor ensures that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

The Processor implements appropriate technical and organizational measures, including:

• Encryption in transit (TLS 1.3) and at rest (AES-128-CBC Fernet)
• Access controls (JWT authentication, MFA, role-based access)
• Immutable audit logging
• Multi-tenant data isolation
• Regular security reviews and risk assessments

Authorized Sub-Processors

Sub-Processor Engagement

The Controller provides general authorization for the Processor to engage the Sub-Processors listed above. The Processor shall:

• Inform the Controller of any intended changes concerning the addition or replacement of Sub-Processors
• Provide the Controller with an opportunity to object to such changes
• Impose data protection terms on Sub-Processors that are no less protective than this DPA
• Remain liable for the acts and omissions of its Sub-Processors

The Processor shall assist the Controller in fulfilling obligations to respond to Data Subject requests under GDPR/CCPA, including:

• Right of access (data export endpoint: POST /api/v1/privacy/export-data)
• Right to erasure (data deletion endpoint: POST /api/v1/privacy/delete-data)
• Right to rectification (profile update)
• Right to data portability (JSON export format)

The Processor shall notify the Controller without undue delay (within 48 hours) upon becoming aware of a Security Incident affecting Personal Data. The notification shall:

• Describe the nature of the incident
• Identify the categories and approximate number of Data Subjects concerned
• Describe the likely consequences
• Describe measures taken or proposed to address the incident

The Processor shall provide reasonable assistance to the Controller with data protection impact assessments and prior consultations with supervisory authorities.

Upon termination of the Service, the Processor shall, at the Controller’s choice:

• Return all Personal Data in a structured, commonly used, machine-readable format, or
• Delete all Personal Data, except where retention is required by law

For transfers of Personal Data from the EEA, UK, or Switzerland to the United States, the parties rely on the EU Standard Contractual Clauses (SCCs), Module Two (Controller-to-Processor), as incorporated by reference.

• Commission Implementing Decision (EU) 2021/914 of 4 June 2021
• Module Two: Transfer Controller to Processor
• Governing law: Ireland (Clause 17)
• Dispute resolution: Courts of Ireland (Clause 18)

The Processor makes available to the Controller all information necessary to demonstrate compliance with this DPA, including SOC 2 documentation and audit logs.

Upon reasonable notice (minimum 30 days) and no more than once per year, the Controller or its authorized auditor may conduct an on-site audit of the Processor’s data processing facilities, subject to:

• Confidentiality obligations
• Minimization of business disruption
• Controller bearing the costs of the audit
• Scope limited to Personal Data processing

Alternative: The Processor may provide a third-party audit report (e.g., SOC 2 report) in lieu of an on-site audit.