Data Processing Agreement

1. Roles and scope

The customer is the controller or business and appoints Raavue as processor or service provider for Customer Data. Raavue remains an independent controller for its own account, security, billing, support, and legal-compliance records as described in the Privacy Policy.

“Customer Data” means data submitted to Raavue by or for the customer, including uploaded files, report instructions, and resulting reports. “Data Protection Law” means privacy and data-protection law applicable to the processing, including the GDPR, Saudi PDPL, and CCPA where applicable.

2. Processing instructions

Raavue will process Customer Data only to provide, secure, support, and improve the contracted service; follow documented customer instructions; comply with law; or protect the service from abuse. The agreement, product configuration, support requests, and authorized account actions are documented instructions.

If Raavue believes an instruction violates Data Protection Law, it may pause the affected processing and notify the customer. The customer is responsible for the lawfulness, accuracy, minimization, and notices associated with Customer Data.

3. Processing details

4. Confidentiality and access

• Access is limited to authorized people and systems with a service, security, legal, or support need.
• People authorized to process Customer Data are bound by confidentiality obligations.
• Raavue uses account authentication, least-privilege controls, and row-level database access controls.
• The customer controls its users, credentials, organization roles, and the data it submits.

5. Security measures

• TLS encryption in transit and provider encryption at rest.
• Supabase authentication, row-level security, service-role separation, and optional multifactor authentication.
• CSRF protection, security headers, rate limiting, input validation, and restricted administrative functions.
• Logging and monitoring for availability, abuse, report operations, and security events.
• Automated deletion of files and reports under the applicable retention window.
• Incident investigation, containment, recovery, and notification procedures.

Security is risk-based and evolves with the service. No technical measure eliminates all risk.

6. Subprocessors

The customer generally authorizes the subprocessors below for the described functions. Raavue will require data-protection obligations appropriate to their processing and remains responsible for its obligations under this DPA.

Raavue may replace or add a provider where reasonably necessary and will make the current list available here. A customer with a reasonable data-protection objection may contact privacy@raavue.com.

7. Data-subject and customer assistance

Taking into account the nature of processing, Raavue will reasonably assist the customer with access, correction, deletion, restriction, objection, portability, security, incident, impact-assessment, and regulator obligations. If Raavue receives a request concerning Customer Data, it will ordinarily direct the requester to the customer unless law permits or requires a direct response.

8. Return and deletion

Authenticated users can export account and report records and download retained files. Standard automatic file and report deletion is seven days for Trial and Starter, thirty days for Professional, and configured by agreement for Enterprise. Upon a valid account-deletion request or termination, Raavue will delete or de-identify Customer Data unless retention is required by law. Provider backups expire according to protected backup cycles and are not returned to active use except for disaster recovery.

9. Security incidents

Raavue will notify the customer without undue delay after confirming a personal-data breach affecting Customer Data and will provide reasonably available information about its nature, likely consequences, affected data, mitigation, and contact point. Notification is not an admission of fault or liability.

10. International transfers

Customer Data may be processed where Raavue and its providers operate. Where required, the parties will use an approved transfer mechanism, such as applicable standard contractual clauses, together with supplementary safeguards appropriate to the transfer.

11. CCPA service-provider restrictions

Where the CCPA applies and Customer Data is personal information for which the customer is a business, Raavue acts as a service provider or contractor. Raavue will not sell or share that Customer Data; retain, use, or disclose it outside the business purposes specified in the agreement or direct business relationship except as legally permitted; or combine it with personal information received from another source except as legally permitted. Raavue will notify the customer if it can no longer meet an applicable obligation and will reasonably cooperate with steps to stop and remediate unauthorized use.

12. Information and audits

On reasonable written request, Raavue will provide information necessary to demonstrate compliance. Audits must be proportionate, protect other customers, avoid access to source code or security secrets unless specifically required, and normally rely first on current documentation or independent reports. On-site review requires reasonable notice and may be subject to confidentiality, security, frequency, and cost arrangements.

13. Priority and changes

If this DPA conflicts with the service agreement on personal-data processing, this DPA controls. Raavue may update this DPA to reflect law, providers, or service changes without materially reducing customer protections. Material changes will be identified by the effective date and communicated where required.