Data Processing Agreement

Who this agreement is for#

This data processing agreement (the "DPA") is between you, the customer who accepted our terms of service, and SpecsGraph ("we", "us"). It is part of the terms and applies whenever we process personal data on your behalf in SpecsGraph Cloud ("Customer Personal Data"), whether you use the Service as a business or as an individual, on any plan. Where this DPA and the terms differ on personal data, this DPA applies.

For Customer Personal Data you are the controller, or a processor acting for your own controller, and we are your processor. For your account and our website we are the controller, as the privacy policy describes. Paddle.com, our reseller and Merchant of Record, is a controller of the data it collects at checkout, not our subprocessor.

What we process#

• Subject matter and purpose: hosting and running SpecsGraph Cloud for you: storing your workspaces, showing them to your members and the agents they connect, publishing approved specs to the repositories you connect, and sending the Service's emails.
• Duration: for as long as we provide the Service to you, and then until we delete the data as described under Deletion and return.
• Data subjects: your members and the people you invite, and anyone named in your workspace content.
• Types of personal data: names, email addresses, roles and sign-in identifiers of members and invitees; their comments, changes and activity in the workspace; and any personal data you or your agents put in workspace content. We do not ask for special categories of data; do not put them in a workspace.
• Nature of the processing: storage, retrieval, display, copying, export, transmission to the services you connect, backup and deletion.

Our obligations#

• We process Customer Personal Data only on your documented instructions: the terms, this DPA, and how you configure and use the Service, including transfers. If we think an instruction breaks data protection law, we tell you. If the law requires other processing, we tell you first, unless the law forbids it.
• Everyone we allow to process Customer Personal Data is bound to confidentiality.
• We keep appropriate technical and organisational measures to protect it, as Article 32 of the GDPR requires; Security below describes them.
• We help you, as far as we reasonably can given the nature of the processing, to answer requests from people exercising their rights, and with your own security, breach notifications, data protection impact assessments and consultations with authorities.
• We make available the information you need to show compliance with this DPA, and allow for and contribute to audits, as Audits below describes.

Security#

Traffic to the app and the MCP server is encrypted with HTTPS. Passwords and access tokens are stored only as one-way hashes. Access to a workspace is limited by membership and role, and an agent acts only with the rights of the member whose token or sign-in it uses. Databases are backed up, and the backups can be restored. Security and your data describes more.

Subprocessors#

You give us general authorisation to engage the subprocessors below. We bind each one by contract to data protection obligations no less protective than this DPA, and we stay responsible to you for their work.

We tell you at least 30 days before we add or replace a subprocessor, by email to the workspace owners or in the app, and update this list. If you object on reasonable data protection grounds, tell us at hello@specsgraph.io within those 30 days; if we cannot address the objection, you may stop using the affected Service and cancel your plan as the terms describe.

International transfers#

Where Customer Personal Data leaves the European Economic Area, the United Kingdom or Switzerland, we and our subprocessors rely on safeguards the law recognises, such as the Standard Contractual Clauses of the European Commission and, for the United Kingdom, its addendum to them.

Personal data breaches#

We notify you without undue delay after we become aware of a breach of security that affects Customer Personal Data. We tell you what we know of its nature, the data and the people concerned, its likely consequences and what we are doing about it, and we update you as we learn more.

Deletion and return#

Workspace owners can export a workspace at any time. When the agreement ends, they can still export it for 30 days; after that we delete Customer Personal Data, unless the law requires us to keep it. A deleted workspace is purged 30 days after its deletion, and deleted data leaves the backups as they roll over.

Audits#

Ask us at hello@specsgraph.io for the information you need to show compliance. If that is not enough, you, or an independent auditor bound to confidentiality whom you appoint, may audit our compliance with this DPA once a year, with 30 days' notice, during business hours and without access to other customers' data. Each side bears its own costs.

Liability and order of precedence#

The limits of liability in the terms apply to this DPA, except where the law does not allow them. If this DPA conflicts with the terms on personal data, this DPA applies; if it conflicts with the Standard Contractual Clauses, the clauses apply.

Contact#

Email hello@specsgraph.io.

Related documents#

• Privacy Policy→What we collect when you visit specsgraph.io or use SpecsGraph Cloud, why we collect it, who we share it with and how to use your rights.
• Terms of Service→The agreement between you and SpecsGraph for using the website and SpecsGraph Cloud, written to be read.
• Refund Policy→What we refund on a paid plan, how cancelling works and how to ask for your money back.
• Cookie Notice→The website sets no cookies. The app sets three, all of them needed to sign you in and keep your session safe; Paddle's checkout sets its own on billing pages.