Effective date: 2026-10-18
This Data Processing Agreement ("DPA") forms part of the Terms of Service between the Customer and Andre Geha, trading as Ophiry, Baabda, Lebanon ("Processor"). It applies to personal data contained in Customer Data that the Processor processes on the Customer's behalf ("Customer Personal Data"). Capitalised terms not defined here have the meaning given in the Terms or in the applicable data protection law.
1. Roles
1.1 The Customer is the controller of Customer Personal Data and the Processor is its processor.
1.2 The Customer is responsible for having a lawful basis and all necessary notices and consents for the Customer Personal Data it uploads, and for the lawfulness of its instructions.
2. Scope of processing
| Subject matter | Providing the Ophiry Service under the Terms |
| Duration | The term of the Customer's use of the Service, plus the period until deletion under section 9 |
| Nature and purpose | Hosting, storing, indexing and displaying documents; generating and maintaining knowledge-base articles and answers with AI models; sending notifications |
| Personal data | Whatever personal data the Customer chooses to include in its documents and content, plus names and email addresses of the users and readers it invites |
| Data subjects | The Customer's employees, contractors, clients and other individuals mentioned in its content or invited to its workspace |
| Special categories | None. The Customer must not upload them unless agreed in writing (Terms, section 8.4) |
3. Processor obligations
The Processor shall:
- process Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use and configuration of the Service are those instructions. The Processor shall tell the Customer if it believes an instruction infringes data protection law;
- ensure that persons authorised to process it are bound by confidentiality;
- implement the security measures in section 5;
- assist the Customer, taking into account the nature of the processing, in responding to data subjects' requests and in meeting its obligations on security, breach notification and impact assessments. The Service's own tools are the primary means: export, deletion and access management;
- make available the information reasonably necessary to demonstrate compliance with this DPA.
4. Sub-processors
4.1 The Customer authorises the Processor to engage the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of the application, database and backups | Germany (EU) |
| Resend, Inc. | Sending service emails | United States |
| Cloudflare, Inc. | Domain name and email routing services | United States / global |
| Anthropic, PBC | AI model processing | United States |
| OpenAI, L.L.C. | AI model processing | United States |
| Google LLC | AI model processing | United States |
Payments are handled by Paddle.com, the Merchant of Record, as an independent controller and not as a sub-processor of Customer Data.
4.2 The Processor imposes on each sub-processor data protection obligations that are substantially equivalent to those in this DPA. AI model providers are used under terms that exclude training their models on the data sent to them.
4.3 The Processor will publish any intended change to this list on this page at least 30 days before it takes effect. The Customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the Customer's sole remedy is to terminate the affected Service and receive a refund of prepaid fees for the unused period.
5. Security measures
The Processor maintains technical and organisational measures appropriate to the risk, including:
- encryption of data in transit (TLS);
- isolation of each customer's workspace enforced by database row-level security;
- role-based access control within each workspace;
- encryption of stored third-party API keys;
- audit logging of changes;
- regular backups;
- restricted administrative access, protected by strong authentication.
6. Personal data breaches
The Processor shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include the information reasonably available to help the Customer meet its own notification obligations.
7. International transfers
Customer Data is hosted in the European Union. Where Customer Personal Data is transferred to a sub-processor in a country without an adequacy decision, the transfer relies on the standard contractual clauses or equivalent safeguards offered by that sub-processor. Where the law requires, the parties agree that the relevant standard contractual clauses are incorporated by reference.
8. Audits
The Processor shall answer the Customer's reasonable written questions about its compliance with this DPA once per year. Any further audit is subject to reasonable prior notice, confidentiality, the Customer's cost, and a scope that does not compromise the security or confidentiality of other customers' data.
9. Return and deletion
During the subscription and the read-only period that follows it, the Customer can export all its data with the Service's export feature. On the Customer's written request after the end of the subscription, the Processor deletes Customer Personal Data, except where retention is required by law, within a reasonable period, and backups are overwritten in their normal cycle.
10. Liability
Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms. The total liability under the Terms and this DPA together is subject to the single aggregate cap set out in the Terms.
11. Precedence
In case of conflict between this DPA and the Terms on the processing of Customer Personal Data, this DPA prevails.
Contact
Andre Geha, trading as Ophiry · Baabda, Lebanon · privacy@ophiry.com