GDPR Article 28 terms for Customers who process personal data through the Service — sub-processors, transfer mechanisms, and security commitments.
This Data Processing Agreement ("DPA") supplements the Terms of Service between Ovrin, Inc. ("Processor," "Ovrin") and the Customer ("Controller") and applies wherever Ovrin processes Personal Data on Controller's behalf in the course of providing the Service. It is designed to meet Article 28 GDPR and equivalent requirements under the UK GDPR and comparable state and national laws. In the event of conflict between this DPA and the Terms with respect to Personal Data, this DPA controls.
"Personal Data," "Processing," "Controller," "Processor," "Data Subject," and "Sub-processor" have the meanings given in the GDPR. "Personal Data" under this DPA means personal data contained within Customer Content processed by Ovrin as a Processor on Controller's behalf, and account/billing data where Ovrin acts as an independent Controller as described in the Privacy Policy.
For Personal Data within Customer Content, Customer is the Controller (or Processor acting on behalf of a further Controller) and Ovrin is the Processor. For account registration, billing, and usage data collected directly from Customer's authorized users, Ovrin acts as an independent Controller under the Privacy Policy.
Ovrin will process Personal Data only on Controller's documented instructions, which consist of: (a) performance of the Terms, (b) instructions given through the Service's ordinary functionality (e.g., which template to run, what to write to Memory), and (c) any additional written instructions agreed by the parties. Ovrin will inform Controller if, in its opinion, an instruction infringes GDPR or another data protection law.
Ovrin ensures personnel authorized to process Personal Data are bound by confidentiality obligations, receive appropriate data protection training, and access Personal Data strictly on a need-to-know basis for support, security, and operational purposes.
Ovrin implements technical and organizational measures appropriate to the risk, including: gVisor kernel isolation between sandboxes; default-deny network egress enforced per project; encryption in transit (TLS 1.2+) and at rest (AES-256); role-based access control and MFA for internal systems; audit logging of administrative access; and a documented incident response process. Full detail is published at /security and is incorporated by reference; Ovrin may update these measures provided it does not materially decrease the overall level of protection.
Controller provides general authorization for Ovrin to engage the Sub-processors listed below to support delivery of the Service. Ovrin will impose data protection obligations substantially similar to this DPA on each Sub-processor and remains liable for their performance. Ovrin will give Controller at least 14 days' notice (via email or dashboard notice) before adding or replacing a Sub-processor that will process Personal Data, during which Controller may object on reasonable data-protection grounds; if unresolved, Controller's exclusive remedy is to terminate the affected Service.
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Compute infrastructure, sandbox hosting, object storage | United States (us-east-1, us-west-2), European Union (eu-west-1) — region selectable by customer |
| Google Cloud Platform | Backup infrastructure and select regional capacity | United States, European Union |
| Anthropic, PBC | Processes prompts/output when a customer selects the claude-code template and supplies an Anthropic API key | United States |
| OpenAI, L.L.C. | Processes prompts/output when a customer selects the codex template and supplies an OpenAI API key | United States |
| Google LLC (Gemini API) | Processes prompts/output when a customer selects the gemini-cli template and supplies a Gemini API key | United States |
| DeepSeek | Processes prompts/output when a customer selects the deepseek-harness template and supplies a DeepSeek API key | People's Republic of China, Singapore |
| Stripe, Inc. | Payment processing and billing | United States |
| PostHog / analytics provider | Product usage analytics for the dashboard and marketing site | United States, European Union |
Where Ovrin or a Sub-processor processes Personal Data outside the country in which Controller is established, and that transfer is not otherwise covered by an adequacy decision, the parties incorporate the European Commission's Standard Contractual Clauses (Module 2: Controller to Processor, or Module 3 where Ovrin engages a Sub-processor as a further processor) by reference, with Controller as data exporter and Ovrin (or the relevant Sub-processor) as data importer. For transfers subject to UK GDPR, the parties additionally incorporate the UK International Data Transfer Addendum. Enterprise Customers may request region-pinned processing; see /security.
Taking into account the nature of the processing, Ovrin will assist Controller, insofar as possible, in responding to requests from Data Subjects to exercise their rights under applicable data protection law. If Ovrin receives such a request directly, it will not respond except to direct the Data Subject to Controller, unless legally compelled to respond.
Ovrin will notify Controller without undue delay, and in any event within 72 hours of becoming aware, of a confirmed Personal Data breach affecting Controller's Personal Data, with information reasonably available to support Controller's own notification obligations. Ovrin will take reasonable steps to contain and remediate the breach and will cooperate with Controller's reasonable requests related to it.
On reasonable prior written notice, no more than once per 12-month period (except following a confirmed breach or as required by a supervisory authority), Ovrin will make available information reasonably necessary to demonstrate compliance with this DPA, including current third-party audit reports (e.g. SOC 2) where available, and will permit and contribute to audits conducted by Controller or an independent auditor mandated by Controller, subject to confidentiality and reasonable scheduling to avoid disrupting other customers.
On termination of the Service, Ovrin will delete or, if requested in writing, return Personal Data within Customer Content within 30 days, except to the extent retention is required by law, consistent with the retention schedule in the Privacy Policy Section 8. Sandbox filesystem content is deleted automatically at the end of each sandbox's lifecycle regardless of account status.
Each party's liability arising out of this DPA is subject to the limitations and exclusions set out in the Terms of Service.
This DPA takes effect on the date Controller first processes Personal Data through the Service and remains in effect for as long as Ovrin processes Personal Data on Controller's behalf, notwithstanding termination of the underlying Terms.
This DPA is incorporated by reference into the Terms of Service for all Customers by default. Enterprise Customers requiring a countersigned version, additional Standard Contractual Clause annexes, or a specific sub-processor flow-down should contact legal@ovrin.app.