Data Processing Agreement

1. Scope

This agreement applies when a professional customer uses Aravo to process personal data about third parties, such as clients, providers, workspace members, invitees, access requesters, or report recipients.

The customer acts as controller for that data and Aravo acts as processor, processing the data only to provide, protect, and maintain the service.

2. Instructions and purpose

Aravo will process data according to the customer's instructions expressed through normal product use: storage, synchronization, document generation, shared reports, invitations, support, security, plan limits, and deletion.

Aravo will not sell data processed on behalf of the customer or use it for behavioral advertising.

3. Subprocessors

The customer authorizes the subprocessors needed to operate the service: Supabase, Cloudflare, Sentry, Resend, Google OAuth, and PostHog where analytics consent exists. The functional list is also maintained in the Privacy Policy.

If a materially new subprocessor is added, Aravo will try to reflect it on this page or in the applicable policy. Continued use of the service after the update means acceptance unless the law requires another mechanism.

4. Security

Aravo applies reasonable measures for an independent SaaS: session-based authentication, user/workspace access controls, Row Level Security on exposed tables, encryption in transit through HTTPS/TLS, restricted use of service keys, logical data separation, and provider security measures for storage at rest.

Aravo does not provide end-to-end encryption. The customer should not enter passwords, private keys, medical data, or other highly sensitive information that is not necessary to manage their professional activity.

5. Rights, return, and deletion

Aravo will reasonably assist the customer with access, rectification, deletion, objection, portability, or restriction requests, to the extent the information is under Aravo's control and the product does not allow direct management.

When the account or workspace is deleted, Aravo will delete production data according to the Privacy Policy, except minimal data that must be retained for legal, accounting, security, anti-fraud, or audit reasons. Backups may retain traces temporarily until technical rotation.

6. Incidents and transfers

If Aravo confirms a security incident affecting personal data processed on behalf of the customer, it will notify the customer without undue delay through available channels, providing the reasonably available information.

Some providers may process data outside the user's country of residence. Aravo aims to use providers with reasonable contractual and operational safeguards for SaaS services.