Data Processing Addendum

The Customer determines the purpose and means of processing personal data inside plaintext that the Customer’s users encrypt. The Processor hosts the resulting envelope and discloses it at most once to a caller who presents a valid lookup proof. The Processor does not decide the meaning of plaintext and cannot read it.

The Customer instructs the Processor to (a) store the envelope for the chosen 1-hour, 24-hour, 3-day, or 7-day lifetime, (b) disclose it at most once on a valid reveal, and (c) delete it on reveal, expiry, a valid DSA or AUP notice that identifies the public identifier, or a lawful order. These Terms-of-Use actions are the documented instructions. Additional instructions must be possible inside this architecture; the Processor will refuse an instruction that requires decryption, identity lookup, or exactly-once delivery.

The Processor is Alexandru Jungean, a natural person in Romania, European Union. Persons who act for the Processor (if any) will be under a confidentiality duty. The Processor will not use Customer envelopes for its own purposes other than providing the Service, securing it, and complying with law.

• Browser-only AES-256-GCM; unique nonce; authenticated associated data bound to the public identifier.
• Fragment-only proof and AES key; reveal body is public identifier plus proof only.
• HMAC verifier, version-bound keys, constant-time compare; raw proof not stored.
• Atomic delete-and-return; generic unavailable outcomes; no SELECT-then-DELETE.
• Deny-all RLS for public database roles; elevated server role only for the application.
• First-party CSP; no third-party scripts on create/reveal; no-referrer; no-store.
• Privacy-denylist application logs; no capability material.
• Hashed rate limits; TLS to the site; TLS to the database in live production.
• Hourly in-database purge; 6-hour physical-delete SLA after expiry.

These measures match the shipped, tested architecture. They are not a certification. The Customer remains responsible for the capability link, the recipient, and endpoint security.

The Customer gives a general prior authorisation to the subprocessors listed in Infrastructure and Subprocessors. The Processor will publish a material change on that page. The Customer may object within 14 days as described there. Because this is a single-tenant-free architecture, the Processor cannot offer a Customer-specific region or a Customer-specific host. The Customer’s remedy after a reasoned objection may be to stop submitting envelopes.

Secret rows are stored in the EEA (Ireland). Hosting and logs may involve a United States company as described in the Privacy Policy. The Processor uses processors that rely on an adequacy decision and/or the Commission’s standard contractual clauses. The Customer authorises those transfers for the purpose of this DPA.

The Processor will assist the Customer with data-subject requests to the extent possible. Article 11 applies: the Processor usually cannot identify a data subject or locate a row without a public identifier. The Processor cannot decrypt. Portability of plaintext is impossible for the Processor; the Customer already had plaintext in the browser at create time.

The Processor will notify the Customer without undue delay after becoming aware of a personal-data breach that affects Customer envelopes, using alex.jungean@gmail.com if the Customer has written to that address as a professional contact, or by a notice on the Service if no contact exists. Notification will not include capability material.

Audits are limited to this DPA, the public architecture documents, and written answers. The Customer may not demand production of HMAC keys, live rows of other customers, or a decrypt demonstration. On-site audit of a natural person’s private premises is not available; a reasonable remote review of public security statements is.

Return of ciphertext is the at-most-once Reveal to a caller with a valid proof, or not at all. The Processor does not offer a bulk export. Deletion is automatic on Reveal or expiry plus purge. After that, return is impossible. On termination of the Customer’s use, remaining envelopes follow the same clocks.

Each party remains liable under GDPR for its own role. The limitation of liability in the Terms of Use applies to the extent permitted, and does not reduce mandatory GDPR liability. This DPA lasts until the Customer stops using the Service and all of the Customer’s envelopes have been revealed, expired, or purged. Survival: confidentiality, this sentence, and provisions that by nature survive.