Data Processing Agreement (DPA)

Version 1.3, 19 October 2026. Published at operato-ai.com/dpa.

This Data Processing Agreement ("DPA") forms part of the Terms of Service (operato-ai.com/terms, the "agreement") between the customer ("Customer", the controller) and Operato AI ("Operato AI", the processor) for the use of the Operato AI platform at app.operato-ai.com (the "Service"). It applies automatically to every Customer who accepts the Terms of Service, and no signature is needed. A countersigned copy is available on request at privacy@operato-ai.com. The DPA covers the processing of personal data by Operato AI on the Customer's behalf under the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR, or equivalent laws.

Processor: Sarah Rolland, sole proprietor (Osek Patur) registered in Israel, trading as Operato AI. Contact: privacy@operato-ai.com

Controller: the Customer named on the account or order form.

1. Subject matter and duration

1.1 Operato AI processes personal data only to provide the Service to the Customer, as described in Annex 1.

1.2 This DPA lasts as long as Operato AI processes personal data for the Customer, and ends when that data has been deleted or returned under section 9.

2. Customer instructions

2.1 Operato AI processes personal data only on the Customer's documented instructions. The agreement, this DPA and the Customer's use of the Service's features are the Customer's complete instructions.

2.2 Operato AI will tell the Customer if it believes an instruction infringes data protection law, unless the law forbids it.

3. Confidentiality

Everyone Operato AI authorises to process personal data is bound by confidentiality. Today that is the founder only. Any future employee or contractor with access will sign a confidentiality undertaking before receiving access.

4. Security

4.1 Operato AI applies the technical and organisational measures described in Annex 2, appropriate to the risk of the processing.

4.2 Operato AI may update these measures as long as the overall level of protection does not decrease.

5. Sub-processors

5.1 The Customer gives general authorisation for Operato AI to use the sub-processors listed in Annex 3.

5.2 Operato AI will notify the Customer at least 30 days before adding or replacing a sub-processor, by email to the account owner, and by updating the list at operato-ai.com/privacy. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for the remaining period.

5.3 Operato AI imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible for their performance.

6. International transfers

6.1 Where personal data is transferred outside the EEA or the UK, Operato AI relies on a valid transfer mechanism: an adequacy decision (including the EU-US Data Privacy Framework for certified recipients), or the European Commission's Standard Contractual Clauses (2021/914) and, for the UK, the International Data Transfer Addendum, as offered by each sub-processor.

6.2 The platform and its database are hosted in the EU (Paris, France). Operato AI itself is operated from Israel, so access to the platform by Operato AI for support and maintenance is a transfer to Israel. Israel benefits from an adequacy decision of the European Commission (Decision 2011/61/EU, confirmed in the Commission's review of January 2024) and from UK adequacy regulations, which are the transfer mechanism for that access.

7. Assistance to the Customer

7.1 Data subject requests. Operato AI will forward any request it receives directly from a data subject to the Customer without responding to it, and will help the Customer answer such requests, taking into account the nature of the processing.

7.2 Other assistance. Operato AI will provide reasonable assistance with data protection impact assessments and consultations with supervisory authorities, to the extent they concern the Service.

8. Personal data breaches

8.1 Operato AI will notify the Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer personal data.

8.2 The notice will describe, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information that is not yet available will follow as it becomes available.

9. Deletion and return

9.1 At the Customer's choice, Operato AI will delete Customer personal data, or return it in a common machine-readable format (CSV or JSON) and then delete it, within 30 days of a written request to privacy@operato-ai.com, made at any time during the Service or after it ends.

9.2 If the Service ends without such a request, Operato AI keeps the Customer's data only for the retention period configured for the account, so that the Customer can reopen it, and then deletes it automatically. The default retention period is 400 days after the account ends; the Customer can shorten it, or ask for immediate deletion under section 9.1, at any time.

9.3 Backups are daily snapshots of the database, each kept for 30 days (Annex 2). Deleted data therefore disappears from all backups within 30 days of its deletion. Backups are not restored except to recover the Service, and if a restore is ever needed, data deleted in the meantime is deleted again.

9.4 This section does not apply to data Operato AI must keep by law (for example, invoicing records, which Paddle holds as Merchant of Record).

10. Audits

10.1 Operato AI will make available the information reasonably needed to demonstrate compliance with this DPA, including a completed security questionnaire.

10.2 If that information is not sufficient, the Customer may request an audit, no more than once a year, with at least 30 days' notice, at the Customer's cost, conducted by an auditor bound by confidentiality, during business hours and without access to other customers' data.

11. Liability and order of precedence

11.1 Each party's liability under this DPA is subject to the limitation of liability in the Terms of Service (operato-ai.com/terms, section "Service provided as is": total liability limited to the amounts paid in the twelve months before the claim, and no liability for indirect or consequential damages), without prejudice to the rights of data subjects under Article 82 GDPR.

11.2 If this DPA conflicts with the agreement on the processing of personal data, this DPA prevails.

12. Governing law and jurisdiction

12.1 As required by Article 28(3) GDPR, this DPA is governed by the law of the EU Member State in which the Customer is established, or by French law if the Customer is not established in the EU. Disputes arising from this DPA are subject to the courts of that Member State.

12.2 Where the UK GDPR applies to the Customer's data, this DPA is governed by the law of England and Wales, and disputes arising from it are subject to the courts of England and Wales.

12.3 Sections 12.1 and 12.2 apply to this DPA only. All other matters between the parties remain governed by the agreement (the Terms of Service at operato-ai.com/terms), including its choice of Israeli law, and nothing in this section limits the rights of data subjects or the powers of supervisory authorities under the GDPR.

13. Changes to this DPA

13.1 Operato AI may update this DPA, for example to reflect a new sub-processor or a change of legal entity. The version in force is published at operato-ai.com/dpa with its date.

13.2 Operato AI will notify the Customer by email at least 30 days before a change that reduces the protection of Customer personal data. Changes to the sub-processor list follow section 5.2.

Annex 1: Description of the processing

Note on brand data. Brand names, websites, competitors and the questions tracked are business information, not personal data. The questions sent to AI providers are category questions (for example "best CRM for small teams") and do not contain personal data.

Annex 2: Technical and organisational measures

Hosting and network

• The platform runs on Fly.io in the Paris region (France, EU). New accounts default to EU data residency.
• All traffic is HTTPS only, with TLS certificates issued and renewed automatically. Plain HTTP is redirected.

Encryption

• In transit: TLS for all connections to the platform, the API, and sub-processors.
• At rest: the database lives on an encrypted Fly.io volume. On top of that, sensitive fields (connected-account credentials and other designated personal data fields) are encrypted at the application level with AES-256-GCM, using a master key stored as a secret outside the database.

Access control

• Passwords are never stored. Only a scrypt hash with a per-user salt is kept.
• Sessions use random tokens, stored only as hashes, in HttpOnly, Secure, SameSite cookies. Customer sessions expire after 30 days, operator sessions after 7 days.
• Role-based access inside each customer account: owner, admin, analyst, viewer.
• Sign in with Google is available as an alternative to passwords.

Tenant isolation

• Every data access is scoped to the customer's organisation at the data-access layer, not only in the interface.

Operator access

• Production access is limited to the founder, through the hosting provider's authenticated tooling.
• Support access to a customer account (impersonation) is logged with the operator's identity.

Logging and abuse prevention

• Security-relevant events (sign-in, account creation, invitations, password resets, support access) are written to an audit log.
• Public endpoints (sign-up, sign-in, password reset, public checks) are rate limited.

Data minimisation and retention

• Only the data needed to run the Service is collected.
• A retention sweeper deletes data past its retention window. A per-identifier erasure function supports data subject requests.

Backups and recovery

• Automatic daily snapshots of the encrypted database volume by Fly.io, in the same EU region, each kept for 30 days, with restore tested.

Payments

• Payments are handled entirely by Paddle (Merchant of Record). Operato AI never receives or stores card details.

Development practices

• Every change runs an automated test suite (around 600 tests, including tenant isolation and authentication tests) before deployment.
• Secrets are kept in the hosting provider's secret store, never in source code.

Annex 3: Sub-processors

Last updated 18 October 2026.

Operato AI itself operates from Israel (section 6.2): European Commission adequacy decision.

Only when the Customer connects them (the Customer's own accounts, used under the Customer's own agreement with that provider): OpenAI Ads, Google Ads, Microsoft Advertising, Google Analytics 4, AppsFlyer, Adjust.