1. Scope and roles
This DPA forms part of the agreement between the Customer (controller) and [[LEGAL_ENTITY]] (processor). It applies to personal data we process on the Customer's behalf in providing the Service.
2. Processing details (Annex 1)
Subject matter and duration: provision of the Service for the subscription term plus the 30-day export window. Nature and purpose: hosting, storage, computation, display, reporting, notifications and support. Categories of data subjects: Customer's Users; individuals named in Aircraft Data (e.g. engineers, inspectors, signatories). Categories of data: identity and contact data of Users; names and licence references within technical records; audit and usage logs. No special-category data is intended to be processed.
3. Processor obligations
We will:
- •process only on the Customer's documented instructions (the agreement and use of the Service are those instructions);
- •ensure personnel are bound by confidentiality;
- •implement the security measures in Annex 2;
- •assist with data-subject requests and impact assessments;
- •notify the Customer without undue delay (target: within 48 hours) after becoming aware of a personal-data breach;
- •delete or return data at the end of the service;
- •make available information needed to demonstrate compliance, including reasonable audits no more than once per year on 30 days' notice.
4. Subprocessors (Annex 3)
The Customer authorises the subprocessors listed below. We will give at least 30 days' notice of a new subprocessor by updating this list and emailing account Owners. The Customer may object on reasonable data-protection grounds, and if we cannot address the objection, terminate the affected service. We impose data-protection terms on each subprocessor that are no less protective than this DPA.
| Subprocessor | Purpose | Data Categories | Location | Status |
|---|---|---|---|---|
| Vercel | Application hosting and compute | All customer data (in transit/at rest as processed by the application) | United States | Active |
| Neon | PostgreSQL database | All customer data | United States (AWS us-east-1) | Active |
| Clerk | Authentication and user management | Account identity data (name, email, sign-in events) | United States | Active |
| Anthropic | AI features (Fleet Assistant, PDF document extraction) | Query context data and uploaded-document content, only what a feature needs | United States | Active |
| FlightAware (AeroAPI) | Flight-data enrichment (estimated utilisation) | Aircraft registration (MSN) only | United States | Active |
| Stripe | Billing and payment processing | Billing and subscription data | United States | When enabled |
| Email provider (TBD) | Digest and notification email delivery | Account email address, notification content | To be confirmed | Planned |
Data residency: United States (Neon us-east-1, Vercel). Planned: EU (GCP europe-west1) — Phase 2 migration.
5. International transfers
Where processing involves a transfer to a country without an adequacy decision, the EU Standard Contractual Clauses (Module 2 controller-to-processor, and Module 3 for onward transfers to subprocessors), with the UK Addendum where relevant, are incorporated by reference.
6. Security measures (Annex 2)
We maintain:
- •logical tenant isolation enforced in the data-access layer and verified by automated tests;
- •role-based access control;
- •immutable audit trail of data changes;
- •TLS in transit;
- •provider-managed encryption at rest;
- •secrets held outside source control with automated secret scanning;
- •dependency vulnerability scanning in CI;
- •least-privilege production access;
- •documented incident response.
7. Liability and precedence
Liability under this DPA is subject to the agreement's limitation clause. If this DPA conflicts with the agreement on personal-data processing, this DPA prevails.
Countersigned copies: Customers who need a signed DPA should contact [[LEGAL_EMAIL]].