Data Processing Addendum

Customer is the controller of personal data in Customer Content, and Arrebol is its processor. Arrebol is an independent controller for account, billing, security and service-operation data, which the Privacy Policy covers. "Data Protection Law" means all laws that apply to the processing, including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, and US state privacy laws such as the CCPA/CPRA.

Arrebol processes Customer personal data only on Customer’s documented instructions, which are the Terms, this DPA, and Customer’s use and configuration of the Service, unless law requires otherwise; in that case Arrebol will tell Customer first unless the law forbids it. Arrebol will tell Customer if it believes an instruction infringes Data Protection Law. Arrebol does not sell Customer personal data, share it for cross-context behavioral advertising, or use it for any purpose outside the business relationship, and will not combine it with other data except as the Service requires.

Arrebol ensures that anyone authorized to process Customer personal data is bound by confidentiality obligations and accesses it only as needed to provide, secure or support the Service.

Arrebol maintains appropriate technical and organizational measures, including:

• encryption of data in transit (TLS) and at rest;
• isolation of every workspace’s data enforced in the database by row-level security, with role-based access inside each workspace;
• private file storage reached only through short-lived signed links;
• passwordless sign-in (Google or one-time email codes) and multi-factor authentication for platform administration;
• least-privilege access to production systems, with administrative actions logged;
• rate limiting and abuse prevention on public endpoints;
• automated backups and tested restore procedures.

Customer gives general authorization for Arrebol to use subprocessors. The current subprocessors are: Supabase (database, authentication and file storage); Vercel (application hosting, delivery and request logs); Resend (sending email: sign-in codes, invitations, notifications, invoices); Google (sign in with Google); ImprovMX (forwarding email sent to our addresses (such as privacy@ and legal@) to our support inbox), as listed at uprush.work/subprocessors. Arrebol imposes data protection terms on each subprocessor that are no less protective than this DPA and remains responsible for its subprocessors.

Arrebol will give at least 30 days’ notice before a new subprocessor processes Customer personal data, to customers who subscribe to notices by emailing privacy@uprush.work, and by updating the list. Customer may object on reasonable data protection grounds within that period; the parties will discuss the objection in good faith, and if it cannot be resolved Customer may terminate the affected Service and receive a refund of prepaid fees for the unused period.

Taking into account the nature of the processing, Arrebol will help Customer respond to requests from data subjects exercising their rights, mainly through the Service’s own features (such as editing, exporting and deleting content). If Arrebol receives such a request directly, it will refer the person to Customer and will not respond itself except to confirm the referral. Arrebol will also reasonably assist Customer with data protection impact assessments and consultations with supervisory authorities related to the Service.

Arrebol will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer personal data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken or proposed. Arrebol will update Customer as more becomes known and take reasonable steps to contain and remedy the breach.

Customer can export and delete Customer Content through the Service at any time. Files moved to trash are permanently deleted after 30 days. When the Service ends, Customer may export its content for 30 days as described in the Terms; Arrebol then deletes Customer personal data from live systems, and it ages out of backups within 35 days, unless law requires Arrebol to keep it.

On written request, and no more than once a year unless required by a supervisory authority or after a breach, Arrebol will provide the information reasonably necessary to demonstrate compliance with this DPA, including answers to a reasonable security questionnaire and its subprocessors’ available audit reports or certifications. Where that information is not enough to meet a legal requirement, Customer may conduct an audit at its own cost, on reasonable notice, during business hours, under confidentiality terms, and in a way that does not compromise other customers’ data.

Arrebol processes Customer personal data in the United States. For transfers from the EEA, the parties agree to the standard contractual clauses adopted by the European Commission in Decision 2021/914, Module Two (controller to processor), which are incorporated by reference: Customer is the data exporter and Arrebol the data importer; Clause 7 (docking) applies; Clause 9 option 2 (general authorization, with the notice period in Section 6) applies; the optional language in Clause 11 does not apply; Clause 17 option 1 with the law of Ireland; Clause 18 with the courts of Ireland; and the details in Section 2 and the measures in Section 5 complete the Annexes. For transfers from the UK, the UK International Data Transfer Addendum to those clauses applies; for transfers from Switzerland, the clauses apply with references to the FADP and the Swiss Federal Data Protection and Information Commissioner. If Arrebol certifies under the EU-US Data Privacy Framework, it may rely on that certification instead.

Each party’s liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law does not allow it. If this DPA conflicts with the Terms, this DPA controls for the processing of Customer personal data; if the standard contractual clauses conflict with this DPA, the clauses control. Arrebol may update this DPA to reflect changes in law or the Service, provided the update does not materially lower the protection of Customer personal data; material changes follow the notice process in the Terms.