Data Processing Agreement

1. Scope and roles

This Data Processing Agreement applies when you use Embarko to run an app that handles personal data and you are subject to data protection law such as the UK GDPR or EU GDPR. In that arrangement you are the data controller and Embarko is your processor. It takes effect when you deploy such an app; no separate signature is needed.

Where the account belongs to a company, the company is the controller and its members act on its behalf. This DPA sits alongside our Terms of Service and Privacy Policy; if they conflict on the processing of personal data, this document wins. Embarko is operated by SuperHeroes Inc., 651 N Broad St, Suite 201, Middletown, Delaware 19702.

2. What we process, and why

Embarko runs the app you deploy. Any personal data inside it is processed only to provide that service:

• App source and configuration — the archive you deploy, plus environment variables and secrets, stored so the app can be built and run.
• App runtime data — whatever your app writes to its database or file storage while running. We store it, serve it back to your app, and include it in backups on the plans that have them.
• Request metadata — paths, referrers, coarse geography, status codes, and user agent classes for requests to your live app, processed for your analytics and for abuse prevention and reliability. Raw request records are deleted after 100 days.
• Logs — build output and your app's own runtime output, kept for 30 days for debugging and then deleted.
• Account and membership data — the email addresses, roles, and join records of the people in your workspace, processed to operate access control.

We do not read, index, or analyse the contents of your app's data beyond what running, backing up, and serving it requires, and we do not use it to train AI models.

3. Duration and deletion

• We process personal data for as long as your app exists on Embarko.
• Deleting an app removes its running instance, its stored data, and its backups. Deleting a workspace does the same for all of its apps.
• Closing an account deletes its apps and their data.
• Every deletion can be undone for 7 days, and after an account is terminated you can ask for a copy of its data for 7 days. After that, deleted data is removed permanently.
• We delete or return personal data on your written instruction, subject to any legal retention duty.

4. Your responsibilities as controller

• Having a lawful basis for the personal data your app processes.
• Giving your own privacy notice to the people whose data your app holds.
• Assessing the risk before putting special category data — health, financial, biometric, data about children — into an app you run here.
• Configuring your app's own access controls correctly, and keeping your deploy tokens and secrets safe.
• Deleting apps and data once you no longer need them.

5. Our obligations as processor

• We process personal data only on your documented instructions — which, in practice, means running, serving, and backing up the app you deployed.
• We do not sell it and we do not use it for our own purposes.
• Our staff and contractors are bound by confidentiality obligations.
• We maintain the technical and organisational measures in section 6.
• We notify you without undue delay, and in any event within 72 hours, once we become aware of a personal data breach affecting your data, with what we know at the time.
• We help you respond to data subject requests and to regulators where the information is within our control.
• We make available the information you need to show that this DPA is being met, and we allow audits as set out below.

Audits. You can check how we meet this DPA in two steps:

• Documents first. Once a year, at no cost, we answer your security questionnaire and share our infrastructure provider's ISO/IEC 27001 certificate. Email hello@embarko.ai to ask.
• Then an inspection, if you still need one. If the documents do not answer your question, or a regulator requires it, you or an independent auditor may inspect how we process your data.

An inspection has these limits:

• You give us at least 30 days' written notice and a proposed scope.
• At most once in any 12 months, unless a regulator requires it or it follows a personal data breach affecting your data.
• It takes place during business hours, remotely where possible, and does not disrupt the service.
• The auditor signs a confidentiality agreement with us and is not a competitor of Embarko.
• It covers only how we process your data. It does not include other customers' data or our infrastructure provider's facilities, which their ISO/IEC 27001 certificate covers.
• You pay your own costs and the auditor's. If the time we spend goes beyond one working day, we may charge for it at reasonable rates, agreed before the inspection.
• You share the audit report with us.

6. Security measures

• All traffic is served over HTTPS, on both *.embarko.app and connected custom domains.
• Data is encrypted in transit, and encrypted at rest by our storage provider.
• Environment variables and app secrets are encrypted at rest under a separate key.
• Deploy tokens are stored hashed, are scoped to one workspace, and can be revoked individually.
• Each app runs isolated from every other app, with its own persistent storage.
• Access to production infrastructure is restricted to the people who need it and is logged.

Our security page describes these controls in more detail.

7. Sub-processors

We use the providers below to deliver Embarko. Each is bound by data processing terms with us. We will give you notice before adding or replacing one, and you may object on reasonable data protection grounds.

8. Changes and contact

We update this DPA as the service changes, and the date at the top of the page changes with it. For questions, a signed copy, or a security review, email hello@embarko.ai.