Data Processing Addendum

Roles

For personal data Customer submits to the OrEqual API, Customer is the Controller and OrEqual is the Processor. For account and billing data we hold about Customer, OrEqual is the Controller.

Scope of processing

OrEqual processes personal data only to provide the service in accordance with Customer instructions and the published API documentation.

Security measures

OrEqual maintains technical and organizational measures including: encryption in transit and at rest, principle of least privilege for production access, MFA on all admin accounts, audit logging, vendor risk reviews, and an incident response process. A current TOMs document is available on request.

Sub-processors

OrEqual uses the sub-processors below to run the service. We give Customer prior notice of new sub-processors and a reasonable window to object.

• Vercel Inc. - application hosting and CDN (USA)
• Neon Inc. - managed Postgres database (USA / EU)
• Stripe, Inc. - payment processing and billing (USA)
• Resend - transactional email (USA)
• Crisp IM SAS - support chat (EU)
• Umami Software - cookieless web analytics (EU)
• Cloudflare, Inc. - DNS and network security (USA)

International transfers

Where personal data is transferred outside the EEA, UK, or Switzerland, OrEqual relies on the EU Standard Contractual Clauses (and UK Addendum where applicable), supplemented by the technical measures described above.

Data subject requests

OrEqual will, on Customer request and at Customer’s cost, provide reasonable assistance to enable Customer to respond to data subject requests under applicable law.

Breach notification

OrEqual will notify Customer without undue delay, and in any event within 72 hours, of a personal data breach affecting Customer data.

Return or deletion

On termination, OrEqual will delete Customer personal data within 90 days, except where retention is required by law.

Audit

OrEqual will, on reasonable written request and no more than once per year, make available documentation reasonably necessary to demonstrate compliance with this DPA.

Order of precedence

In the event of a conflict between this DPA and the Terms of Service, this DPA controls solely with respect to the processing of personal data.