Data Processing Agreement

This agreement is part of Borel's Terms of Service. It applies whenever Borel handles personal data of the people who use an app you built with Borel. For that data you are the controller and Borel is your processor, as the EU General Data Protection Regulation (GDPR) uses those words. Where this agreement and the Terms disagree about personal data, this agreement wins.

It does not cover your own Borel account. For that, Borel is the controller and the Privacy Policy applies.

• Why: to run the services your app uses after it ships: Borel Cloud (accounts, database and file storage), Borel AI, push notifications, tester invitations, and the reporting and blocking tools in apps that let people see each other's content.
• Whose data: the people who use your app, the testers you invite, and anyone whose details your users enter into it.
• What data: whatever your app stores or sends. Typically email addresses and sign-in details, the content people create, files, photos and recordings they upload, what they send to AI features, phone push tokens, tester email addresses, and reports about content. If your app collects sensitive data, such as health information, you are responsible for having a lawful basis for it.
• For how long: while your app uses these services, and then until deleted as described in section 9.

Borel handles this data only on your instructions. Your instructions are your app's code and settings, what you ask Borel to do in the builder, and this agreement. Borel will tell you if it believes an instruction breaks data protection law. If a law requires Borel to handle the data in some other way, Borel will tell you first unless that law forbids it.

Only people Borel authorises can reach this data, only to run the service, fix a fault or do what you ask, and each of them is bound to keep it confidential.

Borel protects this data with measures including:

• Encryption in transit for every connection, and encryption at rest by the database provider
• Row-level security switched on for every table in your app's database, so a signed-in person can only read and change the rows your app's rules allow them
• Keys and credentials kept encrypted on Borel's server and never shipped inside your app
• No point-in-time history kept for your app's database, so deleted data is really gone
• Rate limits on every call your app makes to Borel

One limit you need to know about: files your app's users upload can be read by anyone who has the file's address, in the same way as a public storage bucket. Only signed-in users can upload or delete files, but reading is open. Don't use file storage for anything that must stay private to one person.

You allow Borel to use the following companies to provide these services. Borel holds each of them to data protection terms that protect the data at least as well as this agreement, and remains responsible to you for what they do.

Before adding or replacing a sub-processor, Borel will email you at least 14 days ahead. If you object and we can't resolve it together, you may stop using the service concerned, and Borel will delete the data it holds for it as in section 9.

Borel will help you meet your own obligations, as far as it reasonably can:

• Your users' requests. Apps with accounts get an in-app account deletion that removes the person's account, rows and files. For access, correction or anything else, email us and we will help you answer.
• Breaches. Borel will tell you without undue delay after becoming aware of a breach affecting your app's data, with what we know and what we are doing about it, so you can notify your authority and your users where the law requires.
• Assessments. Borel will give you the information you need for a data protection impact assessment or a consultation with an authority.

Where a sub-processor handles data outside the EU, the transfer relies on the EU–US Data Privacy Framework for companies certified under it, and otherwise on the European Commission's standard contractual clauses in that company's data processing terms.

Deleting an app can be undone for 7 days. After that, Borel deletes its database, its users' accounts and its files. Deleting your Borel account deletes them at once. Export anything you or your users need before you delete. Borel keeps no copy of your app's users' data afterwards.

Borel will give you the information you need to show that this agreement is being kept, and will answer written questions about it. If that isn't enough, you or an auditor you appoint may audit Borel's compliance on reasonable notice, at your own cost, and not more than once a year unless a breach or an authority requires it.

Questions about this agreement, a request from one of your users, or an objection to a sub-processor: info@borel.one.