Public beta. This document is a DRAFT pending legal review. Items marked “pending” (such as business ID and address) will be published before any sales begin. Questions: use the support form.

Data Processing Addendum (DPA) — DRAFT

Beta version. Operator: Roee. Business details will be published before sales begin.

DRAFT - REQUIRES LEGAL REVIEW. This document is a template prepared without legal advice. It must be reviewed and approved by a qualified Israeli lawyer and a GDPR-qualified adviser before publication or use. Bracketed placeholders must be completed by the owner; no identity details have been assumed.

Processor: Roee (Beta operator), business ID Business ID: pending, Business address: pending, Israel ("Processor"). Customer: the organization that accepted the Terms ("Controller"). Last updated: beta draft of 2026-10-17

This DPA forms part of the Terms of Service and applies where the Processor processes personal data contained in Customer Content on the Controller's behalf. It is intended to meet GDPR/UK GDPR Art. 28(3), the Israeli Privacy Protection Law (as amended by Amendment 13) and Regulation 15 of the Privacy Protection (Data Security) Regulations, 5777-2017 (outsourcing).

1. Subject matter, duration, nature and purpose

Hosting, analysis and monitoring of Customer Content to provide the Services selected by the Controller, for the term of the Terms plus the deletion period in §9.

2. Types of personal data and data subjects

Depending on the product: names, email addresses, order/refund identifiers and amounts (e.g. commerce exports); user names and commit/CI metadata (CI history); CRM configuration metadata (CRM snapshots — should not contain contact records); resource tags (cloud cost exports). Data subjects: the Controller's customers, employees and contractors. No special categories / "data of special sensitivity" are required by any product; the Controller shall not upload them.

3. Processor obligations

The Processor shall: (a) process only on documented instructions (the Terms, product configuration and this DPA), unless required by law; (b) ensure persons authorised to process are bound by confidentiality; (c) implement the security measures in Annex 1; (d) engage sub-processors only per §4; (e) assist with data-subject requests and with DPIAs/prior consultations where reasonably required; (f) notify the Controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer Content; (g) delete or return data per §9; (h) make available information necessary to demonstrate compliance and allow reasonable audits ([once per year, on 30 days' notice, at Controller's cost, by questionnaire first]).

4. Sub-processors

The Controller authorises the sub-processors on the Sub-processors page. The Processor will give at least 30 days' notice of new sub-processors by email/in-app; the Controller may object on reasonable data-protection grounds and, if unresolved, terminate the affected Service with a pro-rata refund. The Processor imposes equivalent data-protection obligations on each sub-processor.

5. International transfers

The Processor is established in Israel (EU and UK adequacy). Onward transfers to sub-processors outside Israel/EEA/UK rely on adequacy decisions or the EU SCCs (Module 3 where applicable) / UK Addendum, and on the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001.

6. Controller obligations

The Controller warrants it has a lawful basis and has given the notices required to upload the personal data, uploads only the minimum fields needed, removes secrets/credentials, and complies with the terms of the platform from which the data was exported.

7. Liability

As in the Terms.

8. Precedence

On conflict concerning personal data, this DPA prevails over the Terms.

9. Deletion

On account deletion, Customer Content is purged after the 30-day grace period; backups roll off within Backup retention period: pending. Run results are also deleted automatically after 365 days.

Annex 1 — Technical and organisational measures (summary)

Tenant isolation on every query; argon2id password hashing; hashed session tokens; HTTPS/HSTS; CSRF protection; rate limiting; SSRF-guarded outbound fetching; least-privilege production access (owner only) with MFA; encrypted managed database at rest CONFIRM per hosting provider: pending; dependency and secret scanning in CI; automatic retention; incident response procedure; no customer content in logs.