Data Processing Addendum

Last updated October 31, 2026

Version 2026-10-31

This addendum forms part of the Terms of service between the customer accepting those terms and Di Cosmo Vincenzo (the processor, “we”). It applies when we process personal data in a customer workspace on the customer's behalf. The customer is the controller, or a processor authorised by its controller to appoint us. In a conflict about that processing, this addendum prevails over the terms. Our own account administration is described in the Privacy policy.

Processing details and instructions

The subject matter is provision of the Octosup backlog and collaboration service during the agreement and the period needed for return or deletion. Processing includes receiving, organising, storing, retrieving, displaying, transmitting to authorised recipients and deleting workspace data. The purpose is to provide the workspace, its history and the integrations the customer requests.

Data subjects may include the customer's team members, contractors, clients and other people mentioned in workspace content. Data includes names, contact details, identifiers, authorship and activity records, and personal information contained in cards, comments, requests, documents and attachments. Special-category data and criminal-offence data must not be uploaded.

The agreement, this addendum and the customer's use of the service constitute documented instructions. We process data only on those instructions, including for international transfers, unless required by EU or Member State law. In that case, we inform the customer before processing unless the law prohibits notice. We immediately inform the customer if, in our opinion, an instruction infringes data protection law. We do not use workspace data for our own advertising or model training.

Customer responsibilities

The customer determines a lawful basis, supplies required notices, respects data-subject rights and limits uploaded data and access to what is necessary. The person accepting on its behalf must be authorised. The customer controls membership, agent permissions and instructions; it must not issue unlawful instructions.

Confidentiality and security

We ensure that people authorised to process personal data are bound by confidentiality or an appropriate statutory duty. We implement technical and organisational measures appropriate to risk under Article 32 GDPR, including access controls, private attachment storage, encrypted transport, authentication, separation of workspace access, and provider-managed database backups as described below. We take measures appropriate to risk to respond to incidents and restore access under Article 32 GDPR; this does not guarantee uninterrupted service, a fixed recovery time or recovery of every attachment. We assess and review those measures and provide relevant information on request. The customer must protect its credentials and review access granted to members and external agents.

Subprocessors and transfers

The customer gives general written authorisation for Supabase (authentication, database, storage and realtime), Vercel (hosting and server functions) and Resend (transactional email), and their authorised subprocessors necessary to supply those services. App data storage and server functions are in Frankfurt; transactional email is sent from Ireland. Provider support and operations can involve access outside the EEA, including the United States.

Before adding or replacing a subprocessor, we notify the customer at its account contact address at least 30 days in advance, giving it an opportunity to object on reasonable data protection grounds. We work to resolve an objection; if no suitable solution is possible, the customer may end the affected service before the change takes effect.

We impose the same applicable data protection obligations on subprocessors by written agreement and remain responsible to the customer for their performance. Transfers outside the EEA require applicable adequacy decisions, including the EU–US Data Privacy Framework for certified recipients and covered transfers, or appropriate safeguards such as the European Commission's Standard Contractual Clauses. We provide information about recipients and safeguards on request.

Requests, incidents and assessments

Taking account of the nature of processing, we assist the customer through appropriate measures with requests for access, correction, erasure, restriction, objection and portability. We notify the customer of requests concerning its workspace and do not respond on its behalf unless instructed or legally required.

We notify the customer without undue delay after becoming aware of a personal data breach. We provide available information about its nature, affected data and people, likely consequences, contact point and mitigation, and supply further details as they become available. We assist with obligations under Articles 32–36 GDPR, including breach notifications, impact assessments and prior consultation, taking account of the information available to us.

Return, deletion and backups

At the end of the service, we return or delete personal data at the customer's choice and delete remaining copies unless EU or Member State law requires retention. Contact us to arrange a return before closing a workspace. We explain any applicable retention requirement and restrict retained data to that purpose.

Deleting a member's account does not delete the customer's shared workspace content. Personal workspaces close immediately and become eligible for permanent deletion after 14 days. Database backups are retained for 7 days; they do not include attachment files, and PITR is disabled. Backups are not used for ordinary service access. Restoration must account for deletion requests before data is returned to service. Resend keeps email content and delivery logs for 30 days. These technical periods do not remove the customer's right to request return or deletion.

Information and audits

We make available the information necessary to demonstrate compliance with Article 28 GDPR and allow and contribute to audits, including inspections, by the customer or an independent auditor it appoints. We agree reasonable arrangements to protect other customers' confidentiality and service security; those arrangements do not prevent a legally required audit or regulatory access.

Contact and version

Send instructions, audit requests and data protection questions to hello@octosup.ai. This addendum is version 2026-10-31, accepted with the terms. Material changes are notified under the terms; subprocessor changes follow the notice above.