This Data Processing Agreement ("DPA") governs the processing of personal data by OpsBuilt, LLC on behalf of OBPrint customers. It supplements the Terms & Conditions and Privacy Policy.
1. Introduction
This Data Processing Agreement ("DPA") forms part of the Terms and Conditions between OpsBuilt, LLC ("OpsBuilt", "we", "us", or "our") and the customer ("you" or "your") who has subscribed to OBPrint.
This DPA applies when OpsBuilt processes Personal Data on your behalf as a data processor in the course of providing the OBPrint service.
2. Definitions
Capitalized terms used but not defined in this DPA have the meanings given in the Terms and Conditions. The terms "Personal Data", "Data Subject", "Processing", "Controller", "Processor", and "Supervisory Authority" have the meanings given in applicable data protection laws, including the GDPR and CCPA/CPRA.
3. Roles and Scope
You are the Controller of the Personal Data you upload to or process through OBPrint. OpsBuilt is the Processor, processing Personal Data on your behalf to provide the service.
The subject matter and duration of processing, the nature and purpose, and the types of Personal Data and categories of Data Subjects are described in our Privacy Policy and are determined by your use of OBPrint.
4. Our Processing Obligations
OpsBuilt will:
- Process Personal Data only on your documented instructions, including as necessary to provide the OBPrint service
- Ensure that persons authorized to process Personal Data are bound by confidentiality obligations
- Implement appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, or damage
- Assist you in responding to Data Subject requests to exercise their rights under applicable data protection laws, to the extent possible given the nature of the service
- Assist you in ensuring compliance with your obligations regarding security of processing, notification of personal data breaches, and data protection impact assessments
- At your choice, delete or return all Personal Data to you after the end of the provision of services, and delete existing copies unless applicable law requires storage
- Make available to you all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you
5. Sub-Processors
You authorize OpsBuilt to engage the following sub-processors to process Personal Data on your behalf:
- Supabase, Inc. — cloud database, authentication, and file storage
- Vercel, Inc. — application hosting
- Stripe, Inc. — payment processing
- Postmark (ActiveCampaign, LLC) — transactional email delivery
- PostHog, Inc. — product analytics (opt-in)
- Functional Software, Inc. (Sentry) — error monitoring
- OpenAI, LLC — AI assistant features (when you use OB-5)
6. International Transfers
Personal Data may be transferred to and processed in the United States and other countries where our sub-processors operate.
Where required by applicable law, OpsBuilt relies on appropriate safeguards for cross-border data transfers, including standard contractual clauses and data processing agreements with sub-processors.
7. Security Measures
OpsBuilt maintains administrative, physical, and technical safeguards designed to protect Personal Data. These include:
- Encryption of data in transit (TLS) and at rest
- Row-level security (RLS) policies isolating tenant data in the database
- Access controls and authentication requirements
- Regular security monitoring and vulnerability assessment
- Incident response procedures
8. Data Breach Notification
OpsBuilt will notify you without undue delay after becoming aware of a personal data breach affecting Personal Data processed on your behalf. Notifications will be sent to the email address associated with your account.
9. Liability
Each party's liability under this DPA is subject to the limitations of liability set forth in the Terms and Conditions.
10. Term and Termination
This DPA takes effect on the date you first use OBPrint and continues until termination of your subscription.
Upon termination, OpsBuilt will delete all Personal Data in accordance with our data retention practices, unless applicable law requires further storage.