Data Processing Agreement
Version 2026-10-04 · Effective [DATE] · Draft for legal review
This Data Processing Agreement ("DPA") is between you, the customer ("you", the "Controller"), and [COMPANY], a company registered in Vietnam with business registration number [NUMBER] and address [ADDRESS] ("Superlytix", "we", "us", the "Processor"). It forms part of our Terms and Conditions and applies whenever the files you upload to Superlytix.ai contain personal data. You do not need to sign anything: it applies automatically. If your organisation needs a signed copy, write to [EMAIL] and we will countersign this same text.
It is written to meet Vietnam's Law on Personal Data Protection and Decree 356 and, where they apply to you, Article 28 of the EU and UK General Data Protection Regulation. [Lawyer: confirm the statutory references and add the EU/UK Standard Contractual Clauses by reference if EU/UK customers are accepted.]
1. Our promises about your files, in plain words
Your files are yours. We handle them for one reason only: to build the Power BI report you asked for. Specifically:
- We never publish your files or anything in them. Nothing you upload is ever made public, listed, indexed or shown to other users.
- We never disclose, share, sell, rent or trade your files or their contents with anyone. The only exceptions are the service providers in section 7, which receive only what they need to run the service for you, and a binding legal order (see 6.9).
- We never use your files to train, fine-tune, evaluate or improve any AI model, ours or anyone else's. Our AI provider is contractually barred from training on the data we send it.
- We never use your files for our own purposes: no marketing, no advertising, no analytics on their contents, no benchmarks, no datasets, no case studies or examples, unless you give us written permission for a specific use.
- No person at Superlytix opens your files unless you ask us to for support, or it is strictly needed to investigate a security incident or abuse, or the law requires it (section 6.3).
- The AI never receives your rows. It receives summaries of your columns, and columns that look like personal data are sent without their values (section 5). The Free plan sends nothing to the AI at all.
- You can delete everything at any time, and we delete automatically when your plan's retention period ends (section 4).
The rest of this DPA turns these promises into contractual obligations.
2. Definitions
- Customer Data: the files, tables and values you upload, the descriptions and instructions you type, and everything the Service derives from them for you (models, previews, Power BI projects), as defined in the Terms.
- Personal data, processing, controller, processor and data subject have the meanings given in the applicable data protection law.
- Sub-processor: a third party we engage that processes Customer Data on our behalf.
- Security incident: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Data.
3. Roles and scope
3.1 For Customer Data, you are the controller (or you act for the controller, such as your employer or client) and we are the processor. For your account details (name, email, sign-in and billing records) we are the controller, as described in the Privacy Policy; this DPA does not cover them.
3.2 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are listed in Annex 1.
3.3 If this DPA and the Terms conflict on the processing of personal data, this DPA prevails.
4. How the app handles your uploaded files
| Step | What happens | Where |
|---|---|---|
| Upload | The file travels over an encrypted connection (HTTPS/TLS) and is saved in a folder that belongs to your project. | Our server, Railway, Singapore region |
| Reading | Our own software reads the file to find tables, column types, blanks, totals, dates and links between tables. This runs on our server; no one reads the file by hand. | Our server |
| AI steps (paid plans only) | Summaries of your columns, never rows, are sent to our AI provider to suggest the model and report (section 5). | Anthropic, United States |
| Building | Our software writes the Power BI project from your choices. You download it as a zip. | Our server |
| Access | Only your account can open your project, and on Enterprise, the members of your team. Every request is checked against the signed-in account. | Our server |
| Backups | A daily copy of the app's data, including uploaded files, is stored encrypted for disaster recovery and deleted automatically after 14 days. Generated Power BI downloads are not backed up. | Cloudflare R2 [Lawyer/Ethan: confirm the bucket's location] |
| Retention | Projects and their files are deleted automatically when the plan's retention period ends: Free 3 days, Single Use 14 days, Plus 30 days, Pro 90 days after the last change; Enterprise keeps them until you delete them. | Our server |
| Deletion | Deleting a project, or your account (Account → Delete my account), removes the files from our server immediately. Copies in backups expire within 14 days and are never restored except to recover from a disaster. | Our server and backups |
| Your copy | Downloaded Power BI files live on your computer. We have no access to them once downloaded. | Your computer |
We keep a record of each AI request for billing (date, model, tokens, cost, project name). It contains no file contents.
Our hosting provider keeps technical logs (request times, addresses, errors) for a limited period. They are not meant to contain file contents, but an error message may occasionally include a column name or value needed to diagnose a fault. [Ethan: confirm Railway's log retention period.]
5. What the AI receives
5.1 Superlytix uses Anthropic's Claude through Anthropic's commercial API, only on paid plans. The Free plan makes no AI requests.
5.2 The AI receives: file and table names; column names, types and counts of filled and blank cells; for number columns, the minimum, maximum, average and shares of blanks, zeros and negatives; for text columns with few distinct values (such as regions, categories or statuses), those values with their counts; for columns with many distinct values, up to the 20 most common values, or 3 example values and a pattern; date ranges; and the descriptions, questions and metric requests you type.
5.3 The AI never receives whole rows or whole files. Columns that look like personal data (names, phone numbers, email addresses, street addresses, tax or ID numbers) are sent as counts and a pattern only (for example "AAAA 999"), never their values.
5.4 Personal-data detection is automatic and looks at column names and contents. It may miss a column with an unusual name. If that matters to you, switch off value summaries on the Describe step, which sends column names, types and counts only, or remove the column before uploading.
5.5 Under Anthropic's commercial terms, data sent through its API is not used to train its models, and Anthropic keeps it only for a limited period for trust and safety purposes. [Lawyer: confirm against Anthropic's current commercial terms and retention period.]
6. Our obligations as processor
6.1 Instructions. We process Customer Data only on your documented instructions. Those instructions are the Terms, this DPA and the choices you make in the app (uploading, describing, adjusting, downloading, deleting). We tell you promptly if we believe an instruction breaks data protection law.
6.2 Purpose limitation. We process Customer Data only to provide, secure and support the Service for you. The commitments in section 1 are binding obligations under this DPA.
6.3 People. Access to production systems is limited to the people who run the Service, currently the founder. Everyone with access is bound by confidentiality. They access Customer Data only when you ask for help with a specific project and allow it, when strictly needed to investigate a security incident or abuse, or when the law requires it.
6.4 Security. We maintain the measures in Annex 2 and keep them appropriate to the risk.
6.5 Sub-processors. We use only the sub-processors in section 7, under written terms that protect Customer Data at least as well as this DPA. We remain responsible for them.
6.6 Helping with data subjects' requests. If someone asks us directly to see, correct or delete their data in your files, we pass the request to you and do not answer it ourselves. You can download or delete project files at any time in the app, and we help with anything the app cannot do.
6.7 Helping with assessments. We give you the information you reasonably need for your data protection impact assessments and for consultations with authorities.
6.8 Security incidents. We tell you without undue delay, and within 72 hours of becoming aware, of a security incident affecting your Customer Data. We include what we know: what happened, the data and people likely affected, the likely consequences and what we are doing about it. We add more as we learn it. [Lawyer: align with the notification deadlines in Decree 356.]
6.9 Requests from authorities. If an authority demands Customer Data, we tell you first, unless the law forbids it. We disclose only what we are legally required to disclose.
6.10 End of service. When your account ends we delete Customer Data as in section 4. You can download your data first (Account → Download my data). We keep nothing except what the law requires us to keep, which does not include your files.
6.11 Demonstrating compliance. We answer your reasonable written questions about our processing, normally within 30 days. If the answers are not enough, or an authority requires it, you may audit our compliance once a year with 30 days' written notice, at your cost, in a way that does not expose other customers' data. [Lawyer: review audit terms.]
7. Sub-processors
| Sub-processor | What it does | Customer Data it handles | Location |
|---|---|---|---|
| Railway Corporation | Hosts the app and stores your projects | All uploaded files and projects | Singapore region |
| Cloudflare, Inc. | Stores the encrypted daily backups (R2) | Backup copies, deleted after 14 days | [Lawyer/Ethan: confirm the R2 bucket's location] |
| Anthropic, PBC | AI steps on paid plans | Column summaries only (section 5); never rows | United States |
Paddle (payments) and Resend (emails) handle your account and billing details only, never your files. They are covered by the Privacy Policy.
We will give you at least 14 days' notice by email before adding or replacing a sub-processor that handles Customer Data. If you object on reasonable data protection grounds and we cannot resolve it, you may end your subscription before the change and receive a pro-rata refund for the unused period.
8. Transfers outside Vietnam
Customer Data is stored in Singapore. Column summaries for the AI are processed in the United States. We have prepared, and keep on file, the cross-border transfer impact assessment that Vietnamese law requires, and we make the relevant parts available to you on request. Where the EU or UK GDPR applies, transfers rely on the Standard Contractual Clauses or another lawful mechanism. [Lawyer: confirm the filing status and the mechanism for each region.]
9. Your obligations
9.1 You confirm that you have a lawful basis, and where needed the data subjects' consent or notice, for uploading the personal data in your files and for our processing of it under this DPA.
9.2 Please upload only the data the report needs. Avoid sensitive personal data (for example health, financial account, biometric or criminal-record data, or ID numbers) unless it is necessary, and remove or anonymise columns the report does not need.
9.3 You are responsible for the Power BI files after you download them, and for who you share them with.
10. Liability
Each party's liability under this DPA is subject to the limits and exclusions in section 13 of the Terms, except where the law does not allow those limits.
11. Duration and changes
This DPA lasts as long as we process Customer Data for you. We will tell you by email and in the app before any material change. A change never reduces the protections in section 1.
12. Contact
Questions about this DPA or your data: [EMAIL]. Person responsible for personal data protection: [DPO].
Annex 1 — Details of the processing
| Item | Details |
|---|---|
| Subject matter | Turning spreadsheets and CSV files you upload into a Power BI project |
| Duration | For the life of each project, limited by the plan's retention period, plus up to 14 days in backups |
| Nature of processing | Storage, reading, profiling of columns, summarising, transformation into a data model and report, and deletion |
| Purpose | Only to provide the Service to you: build, preview and deliver your Power BI report |
| Types of personal data | Whatever your files contain. Typically: names, work contact details (email, phone), customer and employee identifiers, addresses, and transaction or sales figures linked to people |
| Categories of data subjects | Whatever your files concern. Typically: your customers, employees, suppliers, sales representatives and business contacts |
| Sensitive data | Not needed by the Service. Upload it only if your report requires it (see 9.2) |
Annex 2 — Security measures
- Encryption in transit: every connection to the app uses HTTPS/TLS.
- Encryption at rest for backups: Cloudflare R2 encrypts all stored objects. The backup credentials can only reach the backup bucket.
- Account security: passwords are stored only as salted PBKDF2 hashes. Sessions use secure, HTTP-only cookies and expire. Email addresses are verified. Password resets use single-use links that expire after one hour.
- Isolation: each project belongs to one account, or one Enterprise team. Every request is checked against the signed-in account, and other users get "not found".
- Least privilege: owner and administrator functions are limited to one named account and enforced on the server. Production secrets live in environment variables, never in source code.
- Data minimisation: the AI receives summaries, never rows. Personal-data columns are sent without values. The Free plan uses no AI.
- Retention and deletion: automatic deletion at the end of each plan's retention period, immediate deletion on request, and backups that expire after 14 days.
- Resilience: daily backups to separate storage, and hosting on a managed platform.
- Incident response: incidents are investigated and reported under section 6.8.
[Lawyer: review the whole document before publication. Ethan: complete the placeholders when the company is registered.]