Data Processing Agreement

1. Roles

You (the business) are the controller of the personal data in your workspace — for example your customers, students, parents, members and staff. Sirplix is your processor. Sirplix is operated by Ayman Ellaimouni, its founder, based in the United Arab Emirates. Sirplix is not yet a registered company; when it is, these pages will name the company and its registered address.

2. Instructions

We process that data only to provide Sirplix to you and as you instruct through the software (including automations and the accounts you connect) or in writing, unless the law requires otherwise — in which case we will tell you, unless the law forbids it.

3. Confidentiality

Only people who need to, and who are bound to confidentiality, can access it — today, only the founder, for support you ask for, security, or legal reasons.

4. Security

We keep the technical and organisational measures described in section 9 of our Privacy Policy: encryption in transit, hashed passwords and keys, AES-256-GCM encryption of stored access, per-business isolation in the database, least access, backups before every update, and automated isolation tests.

5. Sub-processors

You authorise these sub-processors; providers marked “only when” are used only if you switch that feature on:

• Namecheap, Inc. (USA): our server (data centre in San Jose, California), our domain and DNS, and our business email.
• Google LLC (USA): only when a business connects its own Google account (Calendar, Meet, Sheets, Drive, Gmail).
• Zoom Communications, Inc. (USA): only when a business or person connects their Zoom account.
• Meta Platforms, Inc. / WhatsApp (USA / Ireland): only when a business connects its WhatsApp Business account.
• Stripe, Inc. (USA): only when a business connects its own Stripe account to take payments.
• Anthropic, PBC (USA): only when the AI assistant is used with Claude; under Anthropic’s commercial terms, API data is not used to train its models.

We will tell you at least 30 days before adding or replacing a sub-processor that handles your content; you may object, and if we cannot address it you may end the service and receive your data.

6. International transfers

Data is hosted in the United States. Where the law requires safeguards for transfers, we rely on our providers’ data-protection terms (including standard contractual clauses where applicable) and the security measures above.

7. Helping you

We help you answer people who exercise their rights (access, correction, deletion, copies), and with security and data-protection assessments, as far as reasonable. Most of this you can do yourself in Sirplix (editing and deleting records, exporting boards).

8. Breaches

We will tell you without undue delay — and in any case within 72 hours — after becoming aware of a breach affecting your data, with what we know and what we are doing about it.

9. End of the service

When you close your business in Sirplix (or the service ends), we erase your data within 30 days, except backup copies, which are removed within 90 days. Export what you need first (each board can be exported).

10. Information

On request we give you the information reasonably needed to show we keep to this agreement.

11. Contact

• Customer support: support@sirplix.com
• Privacy and data requests: privacy@sirplix.com