Data Processing Addendum

1. Roles

You, the customer, are the controller — under Law 25, the enterprise that entrusts the information — for the personal data of your applications' users. OmniLab is your processor (the service provider to whom you entrust it) and processes that data only on your behalf.

For your own account data as a Makasi user, OmniLab is the controller: the Privacy Policy applies, not this DPA.

2. Subject matter and duration

Subject matter: hosting and operating the applications you build with Makasi — database, file storage, authentication, email sending and the mailboxes of your domains — and the AI-assisted work you ask the agents to perform on them.

Duration: for as long as you use the service, then until deletion as described under "End of processing".

3. Nature and purpose of the processing

Storage, hosting, backup, transmission and display of the data and, at your request, reading and modification by the AI agents or by our team (hands-on help), for the sole purpose of providing the service to you.

4. Categories of data and data subjects

Data subjects: the users, visitors, customers and contacts of your applications, and the correspondents of your hosted mailboxes.

Categories of data: whatever your applications collect — typically identification and contact data, account credentials (passwords stored hashed), the content and files they receive, messages, and technical data such as IP addresses and logs. You decide what is collected. The service is not designed for special categories of data (health, biometrics and the like); if you process them, you are responsible for the additional safeguards the law requires.

5. Your instructions

We process the data only on your documented instructions — the Terms, this DPA, your configuration of the service and your requests in the product — unless the law requires otherwise, in which case we inform you first unless the law forbids it. We tell you if we believe an instruction infringes data protection law.

6. Our obligations

Confidentiality — only people who need access to operate the service have it, and they are bound by confidentiality.

Purpose limitation — we never use your applications' users' data for our own purposes: no marketing, no sale, no profiling.

Incidents — we notify you without undue delay of any breach or attempted breach affecting that data (a "confidentiality incident" under Law 25), with the information available to help you meet your own obligations.

Records — we keep a record of the processing carried out on your behalf.

7. Subprocessors

You give us a general authorisation to use subprocessors. Current categories: infrastructure hosting (Hetzner, Germany); encrypted off-site backups (Backblaze); network, DNS and anti-abuse protection (Cloudflare); outbound email delivery (Amazon SES, Frankfurt region); AI model providers — which may change at any time among Anthropic, OpenAI, Google, xAI, Groq, Together AI and Fireworks AI (United States), Cohere (Canada), Mistral (France, European Union), Zhipu, DeepSeek, Moonshot and Qwen/Alibaba (China) — which receive only what you send to the agents or what the agents read while working on your project; web search by the agents (Brave Search) and royalty-free image search (Openverse, WordPress Foundation, United States); domain registration (Porkbun).

Services you connect to your applications yourself, with your own keys — for example your own Stripe or Resend account — are your providers, not our subprocessors.

We impose on each subprocessor data protection obligations substantially equivalent to this DPA and remain responsible to you for their performance. The exception is those of the AI model providers listed above whose API terms, which apply as they stand, do not guarantee that data will not be used to train their models, or do not include the standard contractual clauses: their obligations are those of these terms, which are not equivalent to this DPA. We announce any addition or replacement on this page and by email at least 30 days before it takes effect; you may object on reasonable grounds and, if we cannot resolve the objection, terminate the affected service.

8. Security measures

Encryption in transit (TLS) for all traffic; secrets and API keys encrypted at rest, with strong encryption (AES-256); each project runs in an isolated environment with network isolation and its own database and storage credentials; daily encrypted backups kept off-site for 30 days; access to production systems restricted to authorised staff and logged; monitoring and alerting on the platform.

9. Assistance

Taking into account the nature of the processing, we help you respond to requests from your applications' users (access, rectification, deletion, portability) — mostly through the tools the service already provides: database access, export (paid plans) and deletion — and, where needed, with your impact assessments and consultations with supervisory authorities.

10. End of processing

When you delete a project or your account, or when the service ends, you can first retrieve your code and data: through the full export on any paid plan, or on written request on the free plan. The data is then deleted from production systems within 30 days and from encrypted backups within a further 30 days, unless the law requires us to keep it. We keep no copy beyond that.

11. Audits and verifications

We make available the information needed to demonstrate compliance with this DPA and answer your written questions. If that is not enough, you may carry out an audit yourself or through an independent auditor bound by confidentiality, once a year, with 30 days' notice, at your expense, without disrupting the service or accessing other customers' data.

In accordance with Law 25, we allow your person in charge of the protection of personal information to carry out any verification relating to the confidentiality of the information you entrust to us.

12. International transfers

Your applications' data is hosted in the European Union, in Germany. OmniLab is based in Canada, which benefits from a European Commission adequacy decision for commercial organizations.

Where a subprocessor processes data outside the European Union or Canada — notably AI model providers in the United States and China — the transfer relies on the European Commission's standard contractual clauses where that subprocessor's data processing terms include them, or on another mechanism recognised by the GDPR, and on the safeguards identified in the privacy impact assessment we conducted under section 17 of Law 25. Absent standard contractual clauses — which may be the case for AI model providers listed under "Subprocessors" — the transfer relies only on their API terms and on those safeguards.

13. Contact

Questions about this DPA or your applications' data: [email protected]. Person in charge of the protection of personal information: OmniLab's Chief Executive Officer (CEO).