Data Processing Agreement (DPA)

1. Parties and acceptance

This Data Processing Agreement ("DPA") supplements the main services contract between:

• Data Controller: any legal entity or sole trader ("you", the "Customer") who uses the Neofir service with an active account, whether on a free or paid plan;
• Data Processor: ZYNTHYR OÜ, a company registered in Estonia, Registry Code 17501982, head office in Tallinn, operator of the Neofir product ("we", "Neofir").

This DPA applies automatically the moment you:

• Tick acceptance of the Terms, Privacy Policy and this DPA in the onboarding form (click-wrap), or
• Actively use the Neofir service (use constitutes implicit acceptance under GDPR Art. 28(9) — electronic form).

The accepted version is stored in our database (fields accepted_dpa_at + accepted_dpa_version) and is downloadable at any time as a PDF with electronic signature from the dashboard or on request at hello@neofir.com.

2. Definitions

Terms used in this DPA carry the meaning given by GDPR (EU Regulation 2016/679):

• Personal Data — any information relating to an identified or identifiable natural person (Art. 4(1)).
• Processing — any operation performed on data (Art. 4(2)).
• Controller — the natural or legal person determining the purposes and means of processing (Art. 4(7)). Here = the Customer.
• Processor — the entity processing data on behalf of the Controller (Art. 4(8)). Here = Neofir / ZYNTHYR OÜ.
• Sub-processor — any third party engaged by the Processor to perform specific processing activities on behalf of the Controller (Art. 28(2)). Live list: neofir.com/sub-processors/en.
• Personal Data Breach — breach of security leading to destruction, loss, alteration, disclosure of, or access to personal data (Art. 4(12)).
• Data Subject — the natural person whose data is processed. In the Neofir context = the Customer's end clients.
• SCC — Standard Contractual Clauses adopted by the European Commission (Decision 2021/914) for extra-EU transfers.

3. Subject matter, duration, nature and purpose

Subject matter: The Processor (Neofir) processes personal data of data subjects (the Customer's end clients) exclusively to provide the Customer with the Neofir service — a multi-channel AI conversational assistant with booking, calendar sync, FAQ answering and transactional messaging features.

Duration: For as long as the Customer maintains an active Neofir account, plus the retention periods set out at §13.

Nature of processing: automated, via a multi-tenant SaaS with per-organisation isolation (PostgreSQL Row-Level Security).

Purpose: exclusively to execute the Customer's documented instructions. Normal use of the Neofir interfaces (web dashboard, API, webhooks to connected channels) constitutes documented instructions within the meaning of Art. 28(3)(a). The Processor does not:

• use the customer-end data to train its own or any third party's models (Google Gemini is accessed via the paid API tier, whose terms exclude the use of submitted content for model training);
• do its own direct marketing to data subjects;
• sell, rent or transfer the data to third parties for any purpose other than operating the service;
• combine your data with other Customers' data for commercial profiling.

4. Data types and categories of data subjects

Categories of data subjects: the Customer's end clients — natural persons interacting with the Neofir assistant through the Customer's channels (website widget, Instagram DM, WhatsApp Business via Twilio BSP, optionally TikTok DM).

Categories of personal data:

Category	Examples	Source
Identification	First name, last name	Voluntarily provided by the data subject in conversation or in the booking form
Contact	Phone number (E.164), email address	Voluntarily provided in conversation or in the booking form
Social network identifier	Instagram ID, Facebook Page-scoped ID, TikTok Open ID	Third-party platform webhook (Meta, ByteDance)
Conversation content	Text messages exchanged with the assistant	Provided in conversation
Booking data	Service, date, time, short notes	Provided in conversation
Technical data	IP address, user-agent, anonymous visitor ID (technical cookie)	Captured automatically for sessionisation and anti-abuse

Special category data (Art. 9 GDPR): The Processor does not intentionally process sensitive data (health, biometric, political/religious/sexual orientation). The Customer undertakes not to upload documents containing such data into the Neofir RAG. If sensitive data appears incidentally in a conversation (e.g. a client mentions a medical condition in chat), the same level of security and retention is applied as for the rest of the data.

5. Controller's obligations

The Customer:

• Determines the purposes and means of processing in the relationship with its own clients;
• Guarantees it has a lawful basis (Art. 6 GDPR — typically performance of a contract or legitimate interest) for the Processor to process the data;
• Informs its clients about the AI assistant and the automated processing (recommended: a visible clause in your booking form or site footer);
• Responds directly to data subject requests (access, rectification, erasure) using the tools the Processor provides (Settings → Account → Delete, conversation/booking exports from the dashboard);
• Does not share account credentials (api_key, dashboard password, OAuth tokens) with unauthorised third parties;
• Notifies the Processor immediately of any account compromise at hello@neofir.com.

6. Processor's obligations (Art. 28(3))

The Processor:

• (a) processes the data solely on the Customer's documented instructions. Use of the API, dashboard and webhooks constitutes such instructions. If an instruction breaches GDPR, the Processor immediately informs the Customer;
• (b) ensures that personnel with access to the data are bound by confidentiality (NDA + contractual clauses, in force for at least 5 years after the working relationship ends);
• (c) takes all the security measures set out at §8 and Annex I (Art. 32);
• (d) complies with the conditions for sub-processors set out at §9 (Art. 28(2));
• (e) assists the Customer through technical and organisational measures to respond to data subject requests (§10);
• (f) assists the Customer in complying with Art. 32-36 (security, breach notification, DPIA, prior consultation);
• (g) at the Customer's choice, deletes or returns all the data at the end of the contract, per §13;
• (h) makes available to the Customer all information necessary to demonstrate compliance, including the public documentation (/sub-processors/en, /privacy/en, this DPA) and — on written request — responds to an annual compliance questionnaire (§14).

7. Confidentiality

Processor personnel with access to the Customer's data:

• Are bound by confidentiality (statutory or contractual) for at least 5 years after the end of the working/collaboration relationship;
• Have received basic GDPR training upon joining;
• Access data only on a "need to know" basis; all admin accesses are logged in admin_audit_log.

The Customer's data is not accessible to other Customers (multi-tenant with RLS).

8. Security measures (Art. 32)

The Processor implements the technical and organisational measures detailed in Annex I at the end of this DPA. Summary:

• TLS 1.2+ on all public endpoints, HSTS active;
• PostgreSQL database isolated per project, Row-Level Security on all tenant tables;
• OAuth tokens (Google Calendar, Meta/Instagram, TikTok) encrypted at the column level with AES-GCM 256-bit, never stored in plaintext;
• Daily Supabase backups with 7-day retention;
• Mandatory 2FA on all admin accounts (GitHub, Railway, Vercel, Supabase, Google Cloud);
• Logging and audit on all sensitive admin operations;
• Sentry error tracking with a beforeSend hook that strips PII (phone, email, request body) before transmission.

9. Authorised sub-processors (Art. 28(2))

The Customer grants the Processor general authorisation to use sub-processors to operate the Neofir service. The complete, up-to-date list is permanently published at neofir.com/sub-processors/en (current version: 1.2, 11 sub-processors — Supabase, Railway, Vercel, Google, Resend, Stripe, RoMarg, Twilio, Meta, Sentry, ElevenLabs).

Change notification: the Processor notifies the Customer by email at least 30 days in advance of adding or replacing a sub-processor.

Right to object: the Customer may object on reasonable grounds within 30 days of notification. If the objection makes it impossible to deliver the service as-is (e.g.: we cannot operate without a database), the Customer may terminate the contract with a pro-rata refund of the paid subscription.

All sub-processors have a signed DPA with ZYNTHYR OÜ or equivalent standard terms (EU-US Data Privacy Framework / SCC for extra-EU transfers). The Processor remains liable to the Customer for the acts and omissions of sub-processors.

10. Data subject rights

The Processor provides the Customer with the following technical tools to respond to data subject requests (GDPR Art. 15-22):

GDPR right	Neofir feature
Access (Art. 15)	Conversation + booking export per phone/email from dashboard or API GET /v1/conversations
Rectification (Art. 16)	Manual booking / contact editing from the dashboard
Erasure (Art. 17)	Settings → Account → Delete account (slug-typed confirmation) cascading across all tenant data; or selective booking/conversation deletion
Portability (Art. 20)	JSON export of bookings + conversations on request (24h SLA)
Objection (Art. 21)	Disable bot per channel (Instagram/WhatsApp/widget) from Settings → Integrations
Restriction (Art. 18)	Temporary account suspension on request via hello@neofir.com

Processor assistance SLA: reply to requests sent to hello@neofir.com within 5 business days at most. The Customer retains the obligation to deliver the final reply to the data subject within 30 days (Art. 12(3)).

11. Personal data breach notification (Art. 33)

If a security incident affects the Customer's personal data, the Processor:

• Notifies the Customer through the account's contact email within at most 48 hours of the Processor becoming aware of the incident;
• Provides: the nature of the breach, the categories and approximate number of data subjects, the categories and approximate number of records affected, the likely consequences, the measures taken or proposed;
• Assists the Customer in transmitting the notification to the competent supervisory authority (Estonia: AKI, Romania: ANSPDCP, or the relevant Member State authority) where applicable (Art. 33);
• Assists the Customer in communicating with data subjects if the risk is high (Art. 34);
• Cooperates with the supervisory authority on request.

12. Assistance with DPIAs (Art. 35-36)

If the Customer performs a Data Protection Impact Assessment (DPIA) for a high-risk processing operation involving Neofir, the Processor provides, on written request, the information reasonably in its possession:

• Description of the nature and purposes of the processing operations performed by Neofir;
• Up-to-date list of sub-processors and their locations;
• Security measures in place (Annex I);
• Documentation regarding international transfers.

13. Retention and deletion

During the active contract:

• Booking data: kept in full for 24 months from the booking date. After 24 months, customer_email and customer_phone are nullified automatically by the cron job jobs/gdpr-retention.ts;
• Conversations: kept for 24 months; after that, messages remain anonymised (visitor identifier removed);
• RAG documents: kept as long as the Customer does not delete them from the dashboard;
• OAuth tokens: kept as long as the Customer keeps the connection active in Settings → Integrations;
• Application logs (Pino, Railway): 7-day retention;
• Error stack-traces (Sentry): 30-day retention, no PII.

At contract end:

• At the Customer's request (or automatically if they choose "Delete account" from Settings → Account), all tenant data is deleted cascade within at most 30 days;
• The Customer may choose to have the data returned instead of deleted (JSON / CSV export) by writing to hello@neofir.com;
• Supabase backups (rolling 7-day retention) may contain residual data until the rotation cycle; they are encrypted at rest and not operationally accessible;
• Invoices and accounting records related to Stripe payments are kept for 10 years per EE and RO tax obligations (pseudonymised where possible).

14. Audit and inspection (Art. 28(3)(h))

The Customer is entitled, once per calendar year, to request from the Processor:

• A compliance report or equivalent certification (e.g. Supabase's published SOC 2 report, the security pages published by Vercel/Railway/Google Cloud);
• A written response to a standard compliance questionnaire (SIG Lite, CAIQ);
• A live demonstration (videoconference of up to 60 minutes) of the technical measures described in §8.

Physical on-site audits are accepted only for enterprise customers (over €10,000/year paid), with 30 days' advance notice, costs borne by the Customer, and without disrupting the Processor's ongoing operations.

15. International transfers (Chapter V)

The Customer's primary data is stored in the European Union (Supabase Frankfurt eu-central-1, Railway EU West, Vercel Frankfurt edge, RoMarg Bucharest).

Certain sub-processors operate servers in the US (Google, Resend, Sentry) or jointly in Ireland + US (Stripe, Twilio, Meta). All extra-EU transfers are covered by:

• EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) — for certified sub-processors (Google, Stripe, Twilio, Meta);
• Standard Contractual Clauses (SCC) 2021 version — for sub-processors not DPF-certified (Resend, Sentry).

The Processor does not transfer to third countries without a valid adequacy framework or SCC.

16. Liability

The Processor's liability under this DPA is limited to the amount paid by the Customer in the 12 months prior to the triggering event. Indirect damages (loss of profit, opportunity, reputation) are excluded, except in cases of gross negligence, wilful misconduct or intentional breach.

The limits above do not apply to the compensation obligations under GDPR Art. 82 (joint and several controller-processor liability towards the data subject), which remain in full and cannot be limited contractually between the parties and the data subject.

17. Term and termination

This DPA takes effect at the moment of acceptance (click-wrap at onboarding or implicit use) and remains in force for the duration of the main Neofir services contract, plus the retention periods at §13.

It terminates automatically upon termination of the main contract. The Processor may terminate this DPA with 30 days' notice if the Customer uses the service in repeated breach of the obligations at §5.

18. Governing law and dispute resolution

This DPA is governed by European Union law, primarily Regulation (EU) 2016/679 (GDPR), and subsidiarily by the law of the Republic of Estonia (jurisdiction of the Processor's registered office).

Disputes are resolved first amicably, by written notice to hello@neofir.com and direct negotiation of at least 30 days. Failing that, the competent court is at the Customer's seat (EU consumer) or, at the Customer's choice, the court at the Processor's seat in Tallinn.

Annex I — Technical and organisational measures (GDPR Art. 32)

I.1 Security in transit

• TLS 1.2+ on all public endpoints (api.neofir.com, app.neofir.com, cdn.neofir.com, neofir.com);
• HSTS enabled with max-age 1 year, includeSubDomains;
• Let's Encrypt certificates with monthly auto-renewal;
• Inbound webhooks signed with HMAC (Meta: SHA-256 App Secret; Twilio: SHA-1 Auth Token; Stripe: signing secret).

I.2 Security at rest

• PostgreSQL (Supabase, Frankfurt) with per-project isolation;
• Row-Level Security (RLS) active on all tenant tables — native multi-tenant; service_role bypass used only by the backend after manual organization_id verification;
• OAuth tokens + sensitive secrets encrypted at the column level with AES-GCM (256-bit key, rotatable) — never stored in plaintext;
• Daily Postgres backups with 7-day retention (Supabase Pro policy);
• Encrypted disk storage at the infrastructure provider (AWS for Supabase, Google Cloud for Railway).

I.3 Authentication and access

• Customer (Customer account): Supabase Auth with Google OAuth, email + password (bcrypt, min 8 characters) or phone OTP via Twilio;
• End clients (data subjects): no authentication required — they interact anonymously on the public channels;
• Dashboard sessions: JWT with rotation, cookie Secure + HttpOnly + SameSite=Lax;
• Platform admin access: limited to 1 person (Neofir administrator) + scripted, audited AI agents (Claude Code), gated by the email list in env var PLATFORM_ADMIN_EMAILS;
• Mandatory 2FA on all accounts with admin access (GitHub, Railway, Vercel, Supabase, Google Cloud, Meta Business, Twilio).

I.4 Logging, monitoring and audit

• All sensitive admin operations (account suspension, deletion, cross-tenant access) are logged in the admin_audit_log table;
• Application logs (Pino structured JSON) with 7-day retention on Railway;
• Error tracking (Sentry) with a beforeSend hook that strips PII (phone, email, request body, Authorization headers) before transmission;
• 10% trace sampling on Sentry free plan;
• External monitoring on the /health health-check endpoint.

I.5 Anti-fraud and availability

• Rate-limit per IP + per organisation + per email (configurable in apps/backend/src/lib/rate-limit.ts);
• Bot detection on the dashboard (Vercel BotID);
• Monthly per-organisation quota with cron reset 0 0 1 * *;
• Webhook signature verification with rejection of invalid payloads (logged for abuse detection).

I.6 Operational continuity

• Daily Supabase backups, 7-day point-in-time recovery;
• 1-click redeploy on Railway (rollback to the previous commit);
• Vercel deployment with rolling release and per-branch preview environments;
• Cron jobs (booking reminder, GDPR retention, Instagram token refresh, quota reset) with cycle logging and next-tick recovery on failure.

I.7 Processor's personnel

• Personnel with data access bound by contractual confidentiality clauses (NDA);
• Basic GDPR training upon joining;
• Access revoked within 24 hours of the end of the contractual relationship.

19. Contact

← Back to home  ·  Privacy Policy  ·  Terms of Service  ·  Sub-processors