Data Processing Agreement

Version 2026-10-15 · Effective [DATE] · Draft for legal review · Tiếng Việt

This Data Processing Agreement ("DPA") is between you, the customer ("you", the "Controller"), and [COMPANY], a company registered in Vietnam with business registration number [NUMBER] and address [ADDRESS] ("Superlytix", "we", "us", the "Processor"). It forms part of our Terms and Conditions and applies whenever the files you upload to Superlytix.ai contain personal data. You do not need to sign anything: it applies automatically. If your organisation needs a signed copy, write to [email protected] and we will countersign this same text.

It is written to meet Vietnam's Law on Personal Data Protection and its implementing decree. We do not yet sign the EU and UK Standard Contractual Clauses by default: if your files contain personal data of people in the European Union or the United Kingdom, contact us before uploading it so we can agree the right safeguards with you first.

1. Our promises about your files, in plain words

Your files are yours. We handle them for one reason only: to build the Power BI report you asked for. Specifically:

• We never publish your files or anything in them. We never make what you upload public, list it, index it or show it to other users.
• We never disclose, share, sell, rent or trade your files or their contents with anyone. The only exceptions are the service providers in section 7, which receive only what they need to run the service for you, and a binding legal order (see 6.9).
• We never use your files to train, fine-tune, evaluate or improve any AI model, ours or anyone else's. Our AI provider is contractually barred from training on the data we send it.
• We never use your files for our own purposes: no marketing, no advertising, no analytics on their contents, no benchmarks, no datasets, no case studies or examples, unless you give us written permission for a specific use.
• No person at Superlytix opens your files unless you ask us to for support, or it is strictly needed to investigate a security incident or abuse, or the law requires it (section 6.3).
• The AI never receives your rows. It receives summaries of your columns, and values from columns that look like personal data are replaced by placeholders wherever they would appear (section 5). The Free plan sends nothing to the AI at all.
• You can delete everything at any time, and we delete automatically when your plan's retention period ends (section 4).

These promises describe what we do and do not do with your files. They are not a guarantee that no security incident can ever happen: no system is completely secure (see 6.4). The rest of this DPA turns these promises into contractual obligations.

2. Definitions

• Customer Data: the files, tables and values you upload, the descriptions and instructions you type, and everything the Service derives from them for you (models, previews, Power BI projects), as defined in the Terms.
• Personal data, processing, controller, processor and data subject have the meanings given in the applicable data protection law.
• Sub-processor: a third party we engage that processes Customer Data on our behalf.
• Security incident: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Data.

3. Roles and scope

3.1 For Customer Data, you are the controller (or you act for the controller, such as your employer or client) and we are the processor. For your account details (name, email, sign-in and billing records) we are the controller, as described in the Privacy Policy; this DPA does not cover them.

3.2 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are listed in Annex 1.

3.3 If this DPA and the Terms conflict on the processing of personal data, this DPA prevails.

4. How the app handles your uploaded files

We keep a record of each AI request for billing (date, model, tokens, cost, project name). It contains no file contents.

Our hosting provider keeps technical logs (request times, addresses, errors) for up to 30 days. They are not meant to contain file contents, but an error message may occasionally include a column name or value needed to diagnose a fault.

5. What the AI receives

5.1 Superlytix uses Anthropic's Claude through Anthropic's commercial API, only on paid plans. The Free plan makes no AI requests.

5.2 The AI receives: file and table names; column names, types and counts of filled and blank cells; for number columns, the minimum, maximum, average and shares of blanks, zeros and negatives; for text columns with few distinct values (such as regions, categories or statuses), those values with their counts; for columns with many distinct values, up to the 20 most common values, or 3 example values and a pattern; date ranges; the descriptions, questions and metric requests you type and the formulas of your metrics; and, for the PDF summary, the key figures and the finding sentences computed from your data.

5.3 The AI never receives whole rows or whole files. Columns that look like personal data (names, phone numbers, email addresses, street addresses, tax or ID numbers, dates of birth) are summarised as counts and a pattern only (for example "AAAA 999"). If one of their values appears anywhere else in a request (a question or metric request you typed, a formula or a finding sentence), it is replaced by a placeholder such as «V1» before sending, and the real value is put back only on our server. If our server cannot check a request against your data, the request is not sent and the built-in rules are used instead.

5.4 Personal-data detection is automatic and looks at column names and contents. It may miss a column with an unusual name. If that matters to you, switch off value summaries on the Describe step: every value from your data is then replaced by a placeholder, so the AI receives only table and column names, types, counts and your wording. You can also remove the column before uploading.

5.5 Under Anthropic's commercial terms, data sent through its API is not used to train its models. Anthropic deletes it within 30 days, except where it must keep it longer to enforce its usage policy (up to 2 years for requests its safety systems flag) or to meet a legal obligation.

6. Our obligations as processor

6.1 Instructions. We process Customer Data only on your documented instructions. Those instructions are the Terms, this DPA and the choices you make in the app (uploading, describing, adjusting, downloading, deleting). We tell you promptly if we believe an instruction breaks data protection law.

6.2 Purpose limitation. We process Customer Data only to provide, secure and support the Service for you. The commitments in section 1 are binding obligations under this DPA.

6.3 People. Access to production systems is limited to the people who run the Service, currently the founder. Everyone with access is bound by confidentiality. They access Customer Data only when you ask for help with a specific project and allow it, when strictly needed to investigate a security incident or abuse, or when the law requires it.

6.4 Security. We maintain the measures in Annex 2 and keep them appropriate to the risk. These measures reduce risk but cannot remove it: no system is completely secure, and we do not guarantee that Customer Data will never be accessed, lost, altered or disclosed without authorisation. You confirm that the measures in Annex 2 are appropriate for the data you choose to upload; if your data needs stronger protection, do not upload it, or remove the sensitive columns first.

6.5 Sub-processors. We use only the sub-processors in section 7, under written terms that protect Customer Data at least as well as this DPA. We remain responsible for them.

6.6 Helping with data subjects' requests. If someone asks us directly to see, correct or delete their data in your files, we pass the request to you and do not answer it ourselves. You can download or delete project files at any time in the app, and we help with anything the app cannot do.

6.7 Helping with assessments. We give you the information you reasonably need for your data protection impact assessments and for consultations with authorities.

6.8 Security incidents. We tell you without undue delay, and within 72 hours of becoming aware, of a security incident affecting your Customer Data. We include what we know: what happened, the data and people likely affected, the likely consequences and what we are doing about it. We add more as we learn it. Where the law sets a shorter deadline for notifying you or the authority, we meet that deadline.

6.9 Requests from authorities. If an authority demands Customer Data, we tell you first, unless the law forbids it. We disclose only what we are legally required to disclose.

6.10 End of service. When your account ends we delete Customer Data as in section 4. You can download your data first (Account → Download my data). We keep nothing except what the law requires us to keep, which does not include your files.

6.11 Demonstrating compliance. We answer your reasonable written questions about our processing, normally within 30 days. If the answers are not enough, or an authority requires it, you may audit our compliance once a year with 30 days' written notice, at your cost, in a way that does not expose other customers' data.

7. Sub-processors

Paddle (payments) and Resend (emails) handle your account and billing details only, never your files. They are covered by the Privacy Policy.

We will give you at least 14 days' notice by email before adding or replacing a sub-processor that handles Customer Data. If you object on reasonable data protection grounds and we cannot resolve it, you may end your subscription before the change and receive a pro-rata refund for the unused period.

8. Transfers outside Vietnam

Customer Data is stored in Singapore, and backup copies may be stored wherever Cloudflare places them. Column summaries for the AI are processed in the United States. You authorise these transfers when you accept the Terms. We prepare the cross-border transfer impact assessment that Vietnamese law requires, file it with the authority as the law requires, and make the relevant parts available to you on request. For personal data of people in the European Union or the United Kingdom, see the note at the top of this DPA.

9. Your obligations

9.1 You confirm that you have a lawful basis, and where needed the data subjects' consent or notice, for uploading the personal data in your files and for our processing of it under this DPA.

9.2 Please upload only the data the report needs. Avoid sensitive personal data (for example health, financial account, biometric or criminal-record data, or ID numbers) unless it is necessary, and remove or anonymise columns the report does not need.

9.3 You are responsible for the Power BI files after you download them, and for who you share them with.

10. Liability

Each party's liability under this DPA, including for a security incident, is subject to the limits and exclusions in section 13 of the Terms, except where the law does not allow those limits.

11. Duration and changes

This DPA lasts as long as we process Customer Data for you. We will tell you by email and in the app before any material change. A change never reduces the protections in section 1.

12. Contact

Questions about this DPA or your data: [email protected]. Person responsible for personal data protection: [DPO].

Annex 1 — Details of the processing

Annex 2 — Security measures

• Encryption in transit: every connection to the app uses HTTPS/TLS.
• Encryption at rest for backups: Cloudflare R2 encrypts all stored objects. The backup credentials can only reach the backup bucket.
• Account security: passwords are stored only as salted PBKDF2 hashes. Sessions use secure, HTTP-only cookies and expire. Email addresses are verified. Password resets use single-use links that expire after one hour.
• Isolation: each project belongs to one account, or one Enterprise team. Every request is checked against the signed-in account, and other users get "not found".
• Least privilege: owner and administrator functions are limited to one named account and enforced on the server. Production secrets live in environment variables, never in source code.
• Data minimisation: the AI receives summaries, never rows. Values from personal-data columns are replaced by placeholders in every request, and every value is replaced when the user switches value summaries off. The Free plan uses no AI.
• Retention and deletion: automatic deletion at the end of each plan's retention period, immediate deletion on request, and backups that expire after 14 days.
• Resilience: daily backups to separate storage, and hosting on a managed platform.
• Incident response: incidents are investigated and reported under section 6.8.

Language

This DPA is published in English and Vietnamese (Tiếng Việt). If the versions differ, the Vietnamese version prevails where Vietnamese law requires it, and the English version prevails in every other case.