Data Processing Agreement (DPA)
Between the Customer and Custom Ai Apps LLC for the Zipplee services.
1. Parties
This Data Processing Agreement ("DPA") is entered into between:
- Customer — the company or organization that has subscribed to the Services (the "Customer"), and
- Processor — Custom Ai Apps LLC, operator of the Zipplee services (the "Processor," "we," "us").
This DPA forms part of, and is subject to, the agreement under which the Customer accesses the Services (the "Agreement"). Where this DPA conflicts with the Agreement on the subject of data protection, this DPA controls.
2. Definitions
- Personal Data — any information relating to an identified or identifiable natural person that is processed under the Agreement.
- Processing — any operation performed on Personal Data, including collection, storage, use, transmission, and deletion.
- Controller — the party that determines the purposes and means of Processing Personal Data.
- Processor — the party that Processes Personal Data on behalf of the Controller.
- Sub-processor — a third party engaged by the Processor to Process Personal Data.
- Data Subject — the individual to whom Personal Data relates (for example, an employee of the Customer).
- Services — the Zipplee platform and related functionality.
3. Roles of the parties
For Personal Data Processed under the Agreement, the Customer is the Controller and Custom Ai Apps LLC is the Processor. The Processor will Process Personal Data only on documented instructions from the Customer, including as set out in this DPA and the Agreement, except where law requires otherwise (in which case the Processor will inform the Customer unless legally prohibited).
4. Scope and purpose of Processing
| Subject matter | Provision of the Zipplee services to the Customer. |
|---|---|
| Duration | For the term of the Agreement, plus any retention period described in Section 8. |
| Nature & purpose | Creating, storing, rendering, publishing, and delivering employee-facing communications and related content; supporting AI-assisted drafting; sending notifications. |
| Types of Personal Data | Account and user identifiers (names, work email addresses), authentication data, and any Personal Data the Customer chooses to include in content it creates. |
| Categories of Data Subjects | The Customer's authorized users, administrators, and employees who receive the Customer's communications. |
5. Sub-processors
The Customer authorizes the Processor to engage sub-processors to Process Personal Data in connection with the Services. The current list of sub-processors — including each provider's purpose, the data it Processes, and its location — is maintained at our sub-processors page.
The Processor will notify the Customer of any material change to its sub-processors (for example, adding a new sub-processor) and will give the Customer a reasonable opportunity to object on legitimate data-protection grounds. The Processor remains responsible for its sub-processors' compliance with obligations equivalent to those in this DPA.
6. Security measures
The Processor maintains appropriate technical and organizational measures to protect Personal Data, including:
- Encryption of data in transit (TLS/HTTPS) and at rest.
- Strict per-tenant data isolation enforced at the database layer via PostgreSQL Row-Level Security, so a customer can access only its own data.
- JWT-based authentication and access controls.
- Least-data collection — collecting only the Personal Data needed to provide the Services.
- Reliance on sub-processors that maintain independent SOC 2 Type II attestations for the underlying infrastructure.
A fuller description is available on our Trust & Security page. The Processor does not sell Personal Data and does not permit its AI providers to train their models on Customer content.
7. Data subject rights
Taking into account the nature of the Processing, the Processor will assist the Customer, by appropriate technical and organizational measures and insofar as reasonably possible, in responding to requests from Data Subjects to exercise their rights (such as access, correction, deletion, and portability). Where a Data Subject contacts the Processor directly regarding Customer data, the Processor will, where permitted, refer the request to the Customer rather than respond on the Customer's behalf. Deletion mechanics are described in our Data Retention & Deletion Policy.
8. Data breach notification
If the Processor becomes aware of a Personal Data breach affecting Customer data, it will notify the Customer without undue delay after becoming aware, and will provide the information reasonably available to help the Customer meet its own notification obligations, including the nature of the breach, the categories and approximate number of records affected (where known), and the measures taken or proposed to address it.
9. Return and deletion of data
Upon termination or expiry of the Agreement, the Processor will, at the Customer's choice, make Customer Personal Data available for export and then delete it, or delete it directly, within the timeframes set out in the Data Retention & Deletion Policy, except where retention is required by law. Backups are rotated on the schedule described in that policy.
10. International transfers
The Services are hosted in the United States. The Customer acknowledges that Personal Data will be Processed in the United States by the Processor and its sub-processors. Where Personal Data is transferred from a jurisdiction that restricts cross-border transfers, the parties will put in place an appropriate transfer mechanism (such as Standard Contractual Clauses) as required by applicable law. [review with counsel for your specific jurisdiction]
11. Liability
Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement. [review with counsel — align caps and carve-outs with the master Agreement]
12. Governing law
This DPA is governed by the laws of the State of Texas, USA, without regard to its conflict-of-laws rules. [placeholder — review with counsel; confirm venue and whether a different governing law applies to your engagement]
13. Signatures
| Customer (Controller) |
Name: ________________________ Title: ________________________ Date: ________________________ Signature: ________________________ |
|---|---|
| Custom Ai Apps LLC (Processor) |
Name: ________________________ Title: ________________________ Date: ________________________ Signature: ________________________ |
Questions about this DPA: todd@customaiapps.ai.