Data Processing Agreement

1. Parties and scope

This Data Processing Agreement (“DPA”) is between the customer that accepts our Terms of Service (“Customer”) and TC Ecom LLC, operator of Aroli (“Processor”). It applies to personal data that Processor processes on Customer's behalf when providing the Service (“Customer Personal Data”), and forms part of the Terms.

2. Roles

Customer is the controller (or, where Customer itself acts for another controller, a processor) of Customer Personal Data. Processor is a processor (or sub-processor, or “service provider” under applicable US state law) and processes Customer Personal Data only to provide the Service.

For personal data about Customer's own staff that Processor needs to run Customer's account (Account Data), Processor acts as an independent controller under its Privacy Policy; this DPA does not apply to that data.

3. Details of processing

• Subject matter and purpose: providing end-user authentication, license management, device binding, entitlements, variables, file storage, webhooks and related support to Customer.
• Duration: the term of the Terms, plus the period until deletion under section 12.
• Data subjects: End Users of Customer Applications.
• Categories of personal data: usernames; email addresses (optional, if Customer collects them); password hashes (Argon2id); hashed device identifiers and platform labels; IP addresses in request and audit logs; session metadata; license, activation and entitlement records; variables and files Customer chooses to store.
• Special categories: none intended. Customer must not store special categories of data in the Service unless agreed in writing.
• Processing operations: collection via the client API, storage, retrieval, verification, structuring, transmission via webhooks to endpoints Customer configures, and deletion.

4. Instructions

Processor processes Customer Personal Data only on Customer's documented instructions. The Terms, this DPA, and Customer's configuration and use of the Service (including through the dashboard and API) are Customer's instructions. Processor will inform Customer if it believes an instruction infringes applicable data protection law. Processor does not sell Customer Personal Data, does not use it for its own purposes, and does not combine it with other data except as needed to provide the Service.

5. Confidentiality

Processor ensures that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and access it only as needed to provide, secure and support the Service.

6. Security measures

Processor implements technical and organizational measures appropriate to the risk, including:

• Argon2id hashing of all passwords; session tokens and API keys stored only as SHA-256 hashes;
• license keys stored as HMAC verifiers, with plaintext shown to Customer only once;
• AES-256-GCM encryption at rest for signing keys, webhook secrets and MFA secrets;
• Ed25519 signatures on client API responses with per-application keys that can be rotated;
• tenant isolation checks on every request, role-based access control and optional TOTP MFA for dashboard accounts;
• rate limiting on authentication and licensing endpoints;
• audit logging of administrative actions;
• HMAC-SHA256 signed webhooks and rejection of private and loopback webhook targets;
• encryption in transit via HTTPS.

Processor may update these measures provided the overall level of protection is not reduced.

7. Subprocessors

Customer authorizes Processor to engage subprocessors. Processor imposes data protection obligations on each subprocessor that are no less protective than this DPA and remains responsible for their performance. Current subprocessors:

• Hosting and database provider - application hosting and databases. To be confirmed.
• S3-compatible object storage provider - storage of files Customer uploads. To be confirmed.
• Resend - transactional email (where Customer Personal Data includes End-User email addresses used for email flows).

Stripe processes payment data for Customer's own subscription to Aroli as part of Account Data, not Customer Personal Data.

Processor will notify Customer of intended changes to subprocessors in advance, giving Customer the opportunity to object on reasonable data protection grounds.

8. Assistance and data subject requests

Taking into account the nature of the processing, Processor assists Customer, by appropriate technical and organizational measures, in responding to requests from data subjects. Customer can view, export, correct and delete End-User data through the dashboard and the management API. If Processor receives a request directly from an End User, it will refer the End User to Customer and will not respond itself unless legally required. Processor will also provide reasonable assistance with data protection impact assessments and consultations with supervisory authorities.

9. Personal data breaches

Processor will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provide the information reasonably available to help Customer meet its own notification obligations.

10. International transfers

Processor is located in the United States, and Customer Personal Data may be processed there and in other countries where subprocessors operate. Where required by applicable law, transfers are made under appropriate safeguards.

11. Information and audits

Processor will make available information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits by Customer or an independent auditor mandated by Customer, on reasonable notice, at most once per year unless required by a supervisory authority or following a breach, and subject to confidentiality.

12. Return and deletion

Customer can delete End-User data at any time through the Service. When the Terms end, Processor will, at Customer's choice, enable export of Customer Personal Data and then delete it within a reasonable period, unless law requires retention.

13. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms, except where applicable law does not permit such limitation. If this DPA conflicts with the Terms regarding the processing of Customer Personal Data, this DPA prevails.

14. Contact

Data protection questions and notices under this DPA: